1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
24 */
25
26 /* Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */
27 /* All Rights Reserved */
28 /*
29 * Copyright 2016 Joyent, Inc.
30 */
31
32 #include <sys/types.h>
33 #include <sys/param.h>
34 #include <sys/thread.h>
35 #include <sys/sysmacros.h>
36 #include <sys/signal.h>
37 #include <sys/cred.h>
38 #include <sys/user.h>
39 #include <sys/errno.h>
40 #include <sys/vnode.h>
41 #include <sys/mman.h>
42 #include <sys/kmem.h>
43 #include <sys/proc.h>
44 #include <sys/pathname.h>
45 #include <sys/cmn_err.h>
46 #include <sys/systm.h>
47 #include <sys/elf.h>
48 #include <sys/vmsystm.h>
49 #include <sys/debug.h>
50 #include <sys/auxv.h>
51 #include <sys/exec.h>
52 #include <sys/prsystm.h>
53 #include <vm/as.h>
54 #include <vm/rm.h>
55 #include <vm/seg.h>
56 #include <vm/seg_vn.h>
57 #include <sys/modctl.h>
58 #include <sys/systeminfo.h>
59 #include <sys/vmparam.h>
60 #include <sys/machelf.h>
61 #include <sys/shm_impl.h>
62 #include <sys/archsystm.h>
63 #include <sys/fasttrap.h>
64 #include <sys/brand.h>
65 #include "elf_impl.h"
66 #include <sys/sdt.h>
67 #include <sys/siginfo.h>
68
69 #if defined(__x86)
70 #include <sys/comm_page_util.h>
71 #endif /* defined(__x86) */
72
73
74 extern int at_flags;
75
76 #define ORIGIN_STR "ORIGIN"
77 #define ORIGIN_STR_SIZE 6
78
79 static int getelfhead(vnode_t *, cred_t *, Ehdr *, int *, int *, int *);
80 static int getelfphdr(vnode_t *, cred_t *, const Ehdr *, int, caddr_t *,
81 ssize_t *);
82 static int getelfshdr(vnode_t *, cred_t *, const Ehdr *, int, int, caddr_t *,
83 ssize_t *, caddr_t *, ssize_t *);
84 static size_t elfsize(Ehdr *, int, caddr_t, uintptr_t *);
85 static int mapelfexec(vnode_t *, Ehdr *, int, caddr_t,
86 Phdr **, Phdr **, Phdr **, Phdr **, Phdr *,
87 caddr_t *, caddr_t *, intptr_t *, intptr_t *, size_t, long *, size_t *);
88
89 typedef enum {
90 STR_CTF,
91 STR_SYMTAB,
92 STR_DYNSYM,
93 STR_STRTAB,
94 STR_DYNSTR,
95 STR_SHSTRTAB,
96 STR_NUM
97 } shstrtype_t;
98
99 static const char *shstrtab_data[] = {
100 ".SUNW_ctf",
101 ".symtab",
102 ".dynsym",
103 ".strtab",
104 ".dynstr",
105 ".shstrtab"
106 };
107
108 typedef struct shstrtab {
109 int sst_ndx[STR_NUM];
110 int sst_cur;
111 } shstrtab_t;
112
113 static void
shstrtab_init(shstrtab_t * s)114 shstrtab_init(shstrtab_t *s)
115 {
116 bzero(&s->sst_ndx, sizeof (s->sst_ndx));
117 s->sst_cur = 1;
118 }
119
120 static int
shstrtab_ndx(shstrtab_t * s,shstrtype_t type)121 shstrtab_ndx(shstrtab_t *s, shstrtype_t type)
122 {
123 int ret;
124
125 if ((ret = s->sst_ndx[type]) != 0)
126 return (ret);
127
128 ret = s->sst_ndx[type] = s->sst_cur;
129 s->sst_cur += strlen(shstrtab_data[type]) + 1;
130
131 return (ret);
132 }
133
134 static size_t
shstrtab_size(const shstrtab_t * s)135 shstrtab_size(const shstrtab_t *s)
136 {
137 return (s->sst_cur);
138 }
139
140 static void
shstrtab_dump(const shstrtab_t * s,char * buf)141 shstrtab_dump(const shstrtab_t *s, char *buf)
142 {
143 int i, ndx;
144
145 *buf = '\0';
146 for (i = 0; i < STR_NUM; i++) {
147 if ((ndx = s->sst_ndx[i]) != 0)
148 (void) strcpy(buf + ndx, shstrtab_data[i]);
149 }
150 }
151
152 static int
dtrace_safe_phdr(Phdr * phdrp,struct uarg * args,uintptr_t base)153 dtrace_safe_phdr(Phdr *phdrp, struct uarg *args, uintptr_t base)
154 {
155 ASSERT(phdrp->p_type == PT_SUNWDTRACE);
156
157 /*
158 * See the comment in fasttrap.h for information on how to safely
159 * update this program header.
160 */
161 if (phdrp->p_memsz < PT_SUNWDTRACE_SIZE ||
162 (phdrp->p_flags & (PF_R | PF_W | PF_X)) != (PF_R | PF_W | PF_X))
163 return (-1);
164
165 args->thrptr = phdrp->p_vaddr + base;
166
167 return (0);
168 }
169
170 /*
171 * Map in the executable pointed to by vp. Returns 0 on success.
172 */
173 int
mapexec_brand(vnode_t * vp,uarg_t * args,Ehdr * ehdr,Addr * uphdr_vaddr,intptr_t * voffset,caddr_t exec_file,int * interp,caddr_t * bssbase,caddr_t * brkbase,size_t * brksize,uintptr_t * lddatap)174 mapexec_brand(vnode_t *vp, uarg_t *args, Ehdr *ehdr, Addr *uphdr_vaddr,
175 intptr_t *voffset, caddr_t exec_file, int *interp, caddr_t *bssbase,
176 caddr_t *brkbase, size_t *brksize, uintptr_t *lddatap)
177 {
178 size_t len;
179 struct vattr vat;
180 caddr_t phdrbase = NULL;
181 ssize_t phdrsize;
182 int nshdrs, shstrndx, nphdrs;
183 int error = 0;
184 Phdr *uphdr = NULL;
185 Phdr *junk = NULL;
186 Phdr *dynphdr = NULL;
187 Phdr *dtrphdr = NULL;
188 uintptr_t lddata;
189 long execsz;
190 intptr_t minaddr;
191
192 if (lddatap != NULL)
193 *lddatap = NULL;
194
195 if (error = execpermissions(vp, &vat, args)) {
196 uprintf("%s: Cannot execute %s\n", exec_file, args->pathname);
197 return (error);
198 }
199
200 if ((error = getelfhead(vp, CRED(), ehdr, &nshdrs, &shstrndx,
201 &nphdrs)) != 0 ||
202 (error = getelfphdr(vp, CRED(), ehdr, nphdrs, &phdrbase,
203 &phdrsize)) != 0) {
204 uprintf("%s: Cannot read %s\n", exec_file, args->pathname);
205 return (error);
206 }
207
208 if ((len = elfsize(ehdr, nphdrs, phdrbase, &lddata)) == 0) {
209 uprintf("%s: Nothing to load in %s", exec_file, args->pathname);
210 kmem_free(phdrbase, phdrsize);
211 return (ENOEXEC);
212 }
213 if (lddatap != NULL)
214 *lddatap = lddata;
215
216 if (error = mapelfexec(vp, ehdr, nphdrs, phdrbase, &uphdr, &dynphdr,
217 &junk, &dtrphdr, NULL, bssbase, brkbase, voffset, &minaddr,
218 len, &execsz, brksize)) {
219 uprintf("%s: Cannot map %s\n", exec_file, args->pathname);
220 kmem_free(phdrbase, phdrsize);
221 return (error);
222 }
223
224 /*
225 * Inform our caller if the executable needs an interpreter.
226 */
227 *interp = (dynphdr == NULL) ? 0 : 1;
228
229 /*
230 * If this is a statically linked executable, voffset should indicate
231 * the address of the executable itself (it normally holds the address
232 * of the interpreter).
233 */
234 if (ehdr->e_type == ET_EXEC && *interp == 0)
235 *voffset = minaddr;
236
237 if (uphdr != NULL) {
238 *uphdr_vaddr = uphdr->p_vaddr;
239 } else {
240 *uphdr_vaddr = (Addr)-1;
241 }
242
243 kmem_free(phdrbase, phdrsize);
244 return (error);
245 }
246
247 /*ARGSUSED*/
248 int
elfexec(vnode_t * vp,execa_t * uap,uarg_t * args,intpdata_t * idatap,int level,long * execsz,int setid,caddr_t exec_file,cred_t * cred,int brand_action)249 elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
250 int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred,
251 int brand_action)
252 {
253 caddr_t phdrbase = NULL;
254 caddr_t bssbase = 0;
255 caddr_t brkbase = 0;
256 size_t brksize = 0;
257 ssize_t dlnsize;
258 aux_entry_t *aux;
259 int error;
260 ssize_t resid;
261 int fd = -1;
262 intptr_t voffset;
263 Phdr *dyphdr = NULL;
264 Phdr *stphdr = NULL;
265 Phdr *uphdr = NULL;
266 Phdr *junk = NULL;
267 size_t len;
268 ssize_t phdrsize;
269 int postfixsize = 0;
270 int i, hsize;
271 Phdr *phdrp;
272 Phdr *dataphdrp = NULL;
273 Phdr *dtrphdr;
274 Phdr *capphdr = NULL;
275 Cap *cap = NULL;
276 ssize_t capsize;
277 int hasu = 0;
278 int hasauxv = 0;
279 int hasdy = 0;
280 int branded = 0;
281
282 struct proc *p = ttoproc(curthread);
283 struct user *up = PTOU(p);
284 struct bigwad {
285 Ehdr ehdr;
286 aux_entry_t elfargs[__KERN_NAUXV_IMPL];
287 char dl_name[MAXPATHLEN];
288 char pathbuf[MAXPATHLEN];
289 struct vattr vattr;
290 struct execenv exenv;
291 } *bigwad; /* kmem_alloc this behemoth so we don't blow stack */
292 Ehdr *ehdrp;
293 int nshdrs, shstrndx, nphdrs;
294 char *dlnp;
295 char *pathbufp;
296 rlim64_t limit;
297 rlim64_t roundlimit;
298
299 ASSERT(p->p_model == DATAMODEL_ILP32 || p->p_model == DATAMODEL_LP64);
300
301 bigwad = kmem_alloc(sizeof (struct bigwad), KM_SLEEP);
302 ehdrp = &bigwad->ehdr;
303 dlnp = bigwad->dl_name;
304 pathbufp = bigwad->pathbuf;
305
306 /*
307 * Obtain ELF and program header information.
308 */
309 if ((error = getelfhead(vp, CRED(), ehdrp, &nshdrs, &shstrndx,
310 &nphdrs)) != 0 ||
311 (error = getelfphdr(vp, CRED(), ehdrp, nphdrs, &phdrbase,
312 &phdrsize)) != 0)
313 goto out;
314
315 /*
316 * Prevent executing an ELF file that has no entry point.
317 */
318 if (ehdrp->e_entry == 0) {
319 uprintf("%s: Bad entry point\n", exec_file);
320 goto bad;
321 }
322
323 /*
324 * Put data model that we're exec-ing to into the args passed to
325 * exec_args(), so it will know what it is copying to on new stack.
326 * Now that we know whether we are exec-ing a 32-bit or 64-bit
327 * executable, we can set execsz with the appropriate NCARGS.
328 */
329 #ifdef _LP64
330 if (ehdrp->e_ident[EI_CLASS] == ELFCLASS32) {
331 args->to_model = DATAMODEL_ILP32;
332 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS32-1);
333 } else {
334 args->to_model = DATAMODEL_LP64;
335 args->stk_prot &= ~PROT_EXEC;
336 #if defined(__i386) || defined(__amd64)
337 args->dat_prot &= ~PROT_EXEC;
338 #endif
339 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS64-1);
340 }
341 #else /* _LP64 */
342 args->to_model = DATAMODEL_ILP32;
343 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS-1);
344 #endif /* _LP64 */
345
346 /*
347 * We delay invoking the brand callback until we've figured out
348 * what kind of elf binary we're trying to run, 32-bit or 64-bit.
349 * We do this because now the brand library can just check
350 * args->to_model to see if the target is 32-bit or 64-bit without
351 * having do duplicate all the code above.
352 */
353 if ((level < 2) &&
354 (brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
355 error = BROP(p)->b_elfexec(vp, uap, args,
356 idatap, level + 1, execsz, setid, exec_file, cred,
357 brand_action);
358 goto out;
359 }
360
361 /*
362 * Determine aux size now so that stack can be built
363 * in one shot (except actual copyout of aux image),
364 * determine any non-default stack protections,
365 * and still have this code be machine independent.
366 */
367 hsize = ehdrp->e_phentsize;
368 phdrp = (Phdr *)phdrbase;
369 for (i = nphdrs; i > 0; i--) {
370 switch (phdrp->p_type) {
371 case PT_INTERP:
372 hasauxv = hasdy = 1;
373 break;
374 case PT_PHDR:
375 hasu = 1;
376 break;
377 case PT_SUNWSTACK:
378 args->stk_prot = PROT_USER;
379 if (phdrp->p_flags & PF_R)
380 args->stk_prot |= PROT_READ;
381 if (phdrp->p_flags & PF_W)
382 args->stk_prot |= PROT_WRITE;
383 if (phdrp->p_flags & PF_X)
384 args->stk_prot |= PROT_EXEC;
385 break;
386 case PT_LOAD:
387 dataphdrp = phdrp;
388 break;
389 case PT_SUNWCAP:
390 capphdr = phdrp;
391 break;
392 }
393 phdrp = (Phdr *)((caddr_t)phdrp + hsize);
394 }
395
396 if (ehdrp->e_type != ET_EXEC) {
397 dataphdrp = NULL;
398 hasauxv = 1;
399 }
400
401 /* Copy BSS permissions to args->dat_prot */
402 if (dataphdrp != NULL) {
403 args->dat_prot = PROT_USER;
404 if (dataphdrp->p_flags & PF_R)
405 args->dat_prot |= PROT_READ;
406 if (dataphdrp->p_flags & PF_W)
407 args->dat_prot |= PROT_WRITE;
408 if (dataphdrp->p_flags & PF_X)
409 args->dat_prot |= PROT_EXEC;
410 }
411
412 /*
413 * If a auxvector will be required - reserve the space for
414 * it now. This may be increased by exec_args if there are
415 * ISA-specific types (included in __KERN_NAUXV_IMPL).
416 */
417 if (hasauxv) {
418 /*
419 * If a AUX vector is being built - the base AUX
420 * entries are:
421 *
422 * AT_BASE
423 * AT_FLAGS
424 * AT_PAGESZ
425 * AT_SUN_AUXFLAGS
426 * AT_SUN_HWCAP
427 * AT_SUN_HWCAP2
428 * AT_SUN_PLATFORM (added in stk_copyout)
429 * AT_SUN_EXECNAME (added in stk_copyout)
430 * AT_NULL
431 *
432 * total == 9
433 */
434 if (hasdy && hasu) {
435 /*
436 * Has PT_INTERP & PT_PHDR - the auxvectors that
437 * will be built are:
438 *
439 * AT_PHDR
440 * AT_PHENT
441 * AT_PHNUM
442 * AT_ENTRY
443 * AT_LDDATA
444 *
445 * total = 5
446 */
447 args->auxsize = (9 + 5) * sizeof (aux_entry_t);
448 } else if (hasdy) {
449 /*
450 * Has PT_INTERP but no PT_PHDR
451 *
452 * AT_EXECFD
453 * AT_LDDATA
454 *
455 * total = 2
456 */
457 args->auxsize = (9 + 2) * sizeof (aux_entry_t);
458 } else {
459 args->auxsize = 9 * sizeof (aux_entry_t);
460 }
461 } else {
462 args->auxsize = 0;
463 }
464
465 /*
466 * If this binary is using an emulator, we need to add an
467 * AT_SUN_EMULATOR aux entry.
468 */
469 if (args->emulator != NULL)
470 args->auxsize += sizeof (aux_entry_t);
471
472 /*
473 * On supported kernels (x86_64) make room in the auxv for the
474 * AT_SUN_COMMPAGE entry. This will go unpopulated on i86xpv systems
475 * which do not provide such functionality.
476 */
477 #if defined(__amd64)
478 args->auxsize += sizeof (aux_entry_t);
479 #endif /* defined(__amd64) */
480
481 if ((brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
482 branded = 1;
483 /*
484 * We will be adding 4 entries to the aux vectors. One for
485 * the the brandname and 3 for the brand specific aux vectors.
486 */
487 args->auxsize += 4 * sizeof (aux_entry_t);
488 }
489
490 /* Hardware/Software capabilities */
491 if (capphdr != NULL &&
492 (capsize = capphdr->p_filesz) > 0 &&
493 capsize <= 16 * sizeof (*cap)) {
494 int ncaps = capsize / sizeof (*cap);
495 Cap *cp;
496
497 cap = kmem_alloc(capsize, KM_SLEEP);
498 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)cap,
499 capsize, (offset_t)capphdr->p_offset,
500 UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid)) != 0) {
501 uprintf("%s: Cannot read capabilities section\n",
502 exec_file);
503 goto out;
504 }
505 for (cp = cap; cp < cap + ncaps; cp++) {
506 if (cp->c_tag == CA_SUNW_SF_1 &&
507 (cp->c_un.c_val & SF1_SUNW_ADDR32)) {
508 if (args->to_model == DATAMODEL_LP64)
509 args->addr32 = 1;
510 break;
511 }
512 }
513 }
514
515 aux = bigwad->elfargs;
516 /*
517 * Move args to the user's stack.
518 * This can fill in the AT_SUN_PLATFORM and AT_SUN_EXECNAME aux entries.
519 */
520 if ((error = exec_args(uap, args, idatap, (void **)&aux)) != 0) {
521 if (error == -1) {
522 error = ENOEXEC;
523 goto bad;
524 }
525 goto out;
526 }
527 /* we're single threaded after this point */
528
529 /*
530 * If this is an ET_DYN executable (shared object),
531 * determine its memory size so that mapelfexec() can load it.
532 */
533 if (ehdrp->e_type == ET_DYN)
534 len = elfsize(ehdrp, nphdrs, phdrbase, NULL);
535 else
536 len = 0;
537
538 dtrphdr = NULL;
539
540 if ((error = mapelfexec(vp, ehdrp, nphdrs, phdrbase, &uphdr, &dyphdr,
541 &stphdr, &dtrphdr, dataphdrp, &bssbase, &brkbase, &voffset, NULL,
542 len, execsz, &brksize)) != 0)
543 goto bad;
544
545 if (uphdr != NULL && dyphdr == NULL)
546 goto bad;
547
548 if (dtrphdr != NULL && dtrace_safe_phdr(dtrphdr, args, voffset) != 0) {
549 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, exec_file);
550 goto bad;
551 }
552
553 if (dyphdr != NULL) {
554 size_t len;
555 uintptr_t lddata;
556 char *p;
557 struct vnode *nvp;
558
559 dlnsize = dyphdr->p_filesz;
560
561 if (dlnsize > MAXPATHLEN || dlnsize <= 0)
562 goto bad;
563
564 /*
565 * Read in "interpreter" pathname.
566 */
567 if ((error = vn_rdwr(UIO_READ, vp, dlnp, dyphdr->p_filesz,
568 (offset_t)dyphdr->p_offset, UIO_SYSSPACE, 0, (rlim64_t)0,
569 CRED(), &resid)) != 0) {
570 uprintf("%s: Cannot obtain interpreter pathname\n",
571 exec_file);
572 goto bad;
573 }
574
575 if (resid != 0 || dlnp[dlnsize - 1] != '\0')
576 goto bad;
577
578 /*
579 * Search for '$ORIGIN' token in interpreter path.
580 * If found, expand it.
581 */
582 for (p = dlnp; p = strchr(p, '$'); ) {
583 uint_t len, curlen;
584 char *_ptr;
585
586 if (strncmp(++p, ORIGIN_STR, ORIGIN_STR_SIZE))
587 continue;
588
589 curlen = 0;
590 len = p - dlnp - 1;
591 if (len) {
592 bcopy(dlnp, pathbufp, len);
593 curlen += len;
594 }
595 if (_ptr = strrchr(args->pathname, '/')) {
596 len = _ptr - args->pathname;
597 if ((curlen + len) > MAXPATHLEN)
598 break;
599
600 bcopy(args->pathname, &pathbufp[curlen], len);
601 curlen += len;
602 } else {
603 /*
604 * executable is a basename found in the
605 * current directory. So - just substitue
606 * '.' for ORIGIN.
607 */
608 pathbufp[curlen] = '.';
609 curlen++;
610 }
611 p += ORIGIN_STR_SIZE;
612 len = strlen(p);
613
614 if ((curlen + len) > MAXPATHLEN)
615 break;
616 bcopy(p, &pathbufp[curlen], len);
617 curlen += len;
618 pathbufp[curlen++] = '\0';
619 bcopy(pathbufp, dlnp, curlen);
620 }
621
622 /*
623 * /usr/lib/ld.so.1 is known to be a symlink to /lib/ld.so.1
624 * (and /usr/lib/64/ld.so.1 is a symlink to /lib/64/ld.so.1).
625 * Just in case /usr is not mounted, change it now.
626 */
627 if (strcmp(dlnp, USR_LIB_RTLD) == 0)
628 dlnp += 4;
629 error = lookupname(dlnp, UIO_SYSSPACE, FOLLOW, NULLVPP, &nvp);
630 if (error && dlnp != bigwad->dl_name) {
631 /* new kernel, old user-level */
632 error = lookupname(dlnp -= 4, UIO_SYSSPACE, FOLLOW,
633 NULLVPP, &nvp);
634 }
635 if (error) {
636 uprintf("%s: Cannot find %s\n", exec_file, dlnp);
637 goto bad;
638 }
639
640 /*
641 * Setup the "aux" vector.
642 */
643 if (uphdr) {
644 if (ehdrp->e_type == ET_DYN) {
645 /* don't use the first page */
646 bigwad->exenv.ex_brkbase = (caddr_t)PAGESIZE;
647 bigwad->exenv.ex_bssbase = (caddr_t)PAGESIZE;
648 } else {
649 bigwad->exenv.ex_bssbase = bssbase;
650 bigwad->exenv.ex_brkbase = brkbase;
651 }
652 bigwad->exenv.ex_brksize = brksize;
653 bigwad->exenv.ex_magic = elfmagic;
654 bigwad->exenv.ex_vp = vp;
655 setexecenv(&bigwad->exenv);
656
657 ADDAUX(aux, AT_PHDR, uphdr->p_vaddr + voffset)
658 ADDAUX(aux, AT_PHENT, ehdrp->e_phentsize)
659 ADDAUX(aux, AT_PHNUM, nphdrs)
660 ADDAUX(aux, AT_ENTRY, ehdrp->e_entry + voffset)
661 } else {
662 if ((error = execopen(&vp, &fd)) != 0) {
663 VN_RELE(nvp);
664 goto bad;
665 }
666
667 ADDAUX(aux, AT_EXECFD, fd)
668 }
669
670 if ((error = execpermissions(nvp, &bigwad->vattr, args)) != 0) {
671 VN_RELE(nvp);
672 uprintf("%s: Cannot execute %s\n", exec_file, dlnp);
673 goto bad;
674 }
675
676 /*
677 * Now obtain the ELF header along with the entire program
678 * header contained in "nvp".
679 */
680 kmem_free(phdrbase, phdrsize);
681 phdrbase = NULL;
682 if ((error = getelfhead(nvp, CRED(), ehdrp, &nshdrs,
683 &shstrndx, &nphdrs)) != 0 ||
684 (error = getelfphdr(nvp, CRED(), ehdrp, nphdrs, &phdrbase,
685 &phdrsize)) != 0) {
686 VN_RELE(nvp);
687 uprintf("%s: Cannot read %s\n", exec_file, dlnp);
688 goto bad;
689 }
690
691 /*
692 * Determine memory size of the "interpreter's" loadable
693 * sections. This size is then used to obtain the virtual
694 * address of a hole, in the user's address space, large
695 * enough to map the "interpreter".
696 */
697 if ((len = elfsize(ehdrp, nphdrs, phdrbase, &lddata)) == 0) {
698 VN_RELE(nvp);
699 uprintf("%s: Nothing to load in %s\n", exec_file, dlnp);
700 goto bad;
701 }
702
703 dtrphdr = NULL;
704
705 error = mapelfexec(nvp, ehdrp, nphdrs, phdrbase, &junk, &junk,
706 &junk, &dtrphdr, NULL, NULL, NULL, &voffset, NULL, len,
707 execsz, NULL);
708 if (error || junk != NULL) {
709 VN_RELE(nvp);
710 uprintf("%s: Cannot map %s\n", exec_file, dlnp);
711 goto bad;
712 }
713
714 /*
715 * We use the DTrace program header to initialize the
716 * architecture-specific user per-LWP location. The dtrace
717 * fasttrap provider requires ready access to per-LWP scratch
718 * space. We assume that there is only one such program header
719 * in the interpreter.
720 */
721 if (dtrphdr != NULL &&
722 dtrace_safe_phdr(dtrphdr, args, voffset) != 0) {
723 VN_RELE(nvp);
724 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, dlnp);
725 goto bad;
726 }
727
728 VN_RELE(nvp);
729 ADDAUX(aux, AT_SUN_LDDATA, voffset + lddata)
730 }
731
732 if (hasauxv) {
733 int auxf = AF_SUN_HWCAPVERIFY;
734
735 /*
736 * Note: AT_SUN_PLATFORM and AT_SUN_EXECNAME were filled in via
737 * exec_args()
738 */
739 ADDAUX(aux, AT_BASE, voffset)
740 ADDAUX(aux, AT_FLAGS, at_flags)
741 ADDAUX(aux, AT_PAGESZ, PAGESIZE)
742 /*
743 * Linker flags. (security)
744 * p_flag not yet set at this time.
745 * We rely on gexec() to provide us with the information.
746 * If the application is set-uid but this is not reflected
747 * in a mismatch between real/effective uids/gids, then
748 * don't treat this as a set-uid exec. So we care about
749 * the EXECSETID_UGIDS flag but not the ...SETID flag.
750 */
751 if ((setid &= ~EXECSETID_SETID) != 0)
752 auxf |= AF_SUN_SETUGID;
753
754 /*
755 * If we're running a native process from within a branded
756 * zone under pfexec then we clear the AF_SUN_SETUGID flag so
757 * that the native ld.so.1 is able to link with the native
758 * libraries instead of using the brand libraries that are
759 * installed in the zone. We only do this for processes
760 * which we trust because we see they are already running
761 * under pfexec (where uid != euid). This prevents a
762 * malicious user within the zone from crafting a wrapper to
763 * run native suid commands with unsecure libraries interposed.
764 */
765 if ((brand_action == EBA_NATIVE) && (PROC_IS_BRANDED(p) &&
766 (setid &= ~EXECSETID_SETID) != 0))
767 auxf &= ~AF_SUN_SETUGID;
768
769 /*
770 * Record the user addr of the auxflags aux vector entry
771 * since brands may optionally want to manipulate this field.
772 */
773 args->auxp_auxflags =
774 (char *)((char *)args->stackend +
775 ((char *)&aux->a_type -
776 (char *)bigwad->elfargs));
777 ADDAUX(aux, AT_SUN_AUXFLAGS, auxf);
778 /*
779 * Hardware capability flag word (performance hints)
780 * Used for choosing faster library routines.
781 * (Potentially different between 32-bit and 64-bit ABIs)
782 */
783 #if defined(_LP64)
784 if (args->to_model == DATAMODEL_NATIVE) {
785 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap)
786 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2)
787 } else {
788 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap32)
789 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap32_2)
790 }
791 #else
792 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap)
793 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2)
794 #endif
795 if (branded) {
796 /*
797 * Reserve space for the brand-private aux vectors,
798 * and record the user addr of that space.
799 */
800 args->auxp_brand =
801 (char *)((char *)args->stackend +
802 ((char *)&aux->a_type -
803 (char *)bigwad->elfargs));
804 ADDAUX(aux, AT_SUN_BRAND_AUX1, 0)
805 ADDAUX(aux, AT_SUN_BRAND_AUX2, 0)
806 ADDAUX(aux, AT_SUN_BRAND_AUX3, 0)
807 }
808
809 /*
810 * Add the comm page auxv entry, mapping it in if needed.
811 */
812 #if defined(__amd64)
813 if (args->commpage != NULL ||
814 (args->commpage = (uintptr_t)comm_page_mapin()) != NULL) {
815 ADDAUX(aux, AT_SUN_COMMPAGE, args->commpage)
816 } else {
817 /*
818 * If the comm page cannot be mapped, pad out the auxv
819 * to satisfy later size checks.
820 */
821 ADDAUX(aux, AT_NULL, 0)
822 }
823 #endif /* defined(__amd64) */
824
825 ADDAUX(aux, AT_NULL, 0)
826 postfixsize = (char *)aux - (char *)bigwad->elfargs;
827
828 /*
829 * We make assumptions above when we determine how many aux
830 * vector entries we will be adding. However, if we have an
831 * invalid elf file, it is possible that mapelfexec might
832 * behave differently (but not return an error), in which case
833 * the number of aux entries we actually add will be different.
834 * We detect that now and error out.
835 */
836 if (postfixsize != args->auxsize) {
837 DTRACE_PROBE2(elfexec_badaux, int, postfixsize,
838 int, args->auxsize);
839 goto bad;
840 }
841 ASSERT(postfixsize <= __KERN_NAUXV_IMPL * sizeof (aux_entry_t));
842 }
843
844 /*
845 * For the 64-bit kernel, the limit is big enough that rounding it up
846 * to a page can overflow the 64-bit limit, so we check for btopr()
847 * overflowing here by comparing it with the unrounded limit in pages.
848 * If it hasn't overflowed, compare the exec size with the rounded up
849 * limit in pages. Otherwise, just compare with the unrounded limit.
850 */
851 limit = btop(p->p_vmem_ctl);
852 roundlimit = btopr(p->p_vmem_ctl);
853 if ((roundlimit > limit && *execsz > roundlimit) ||
854 (roundlimit < limit && *execsz > limit)) {
855 mutex_enter(&p->p_lock);
856 (void) rctl_action(rctlproc_legacy[RLIMIT_VMEM], p->p_rctls, p,
857 RCA_SAFE);
858 mutex_exit(&p->p_lock);
859 error = ENOMEM;
860 goto bad;
861 }
862
863 bzero(up->u_auxv, sizeof (up->u_auxv));
864 up->u_commpagep = args->commpage;
865 if (postfixsize) {
866 int num_auxv;
867
868 /*
869 * Copy the aux vector to the user stack.
870 */
871 error = execpoststack(args, bigwad->elfargs, postfixsize);
872 if (error)
873 goto bad;
874
875 /*
876 * Copy auxv to the process's user structure for use by /proc.
877 * If this is a branded process, the brand's exec routine will
878 * copy it's private entries to the user structure later. It
879 * relies on the fact that the blank entries are at the end.
880 */
881 num_auxv = postfixsize / sizeof (aux_entry_t);
882 ASSERT(num_auxv <= sizeof (up->u_auxv) / sizeof (auxv_t));
883 aux = bigwad->elfargs;
884 for (i = 0; i < num_auxv; i++) {
885 up->u_auxv[i].a_type = aux[i].a_type;
886 up->u_auxv[i].a_un.a_val = (aux_val_t)aux[i].a_un.a_val;
887 }
888 }
889
890 /*
891 * Pass back the starting address so we can set the program counter.
892 */
893 args->entry = (uintptr_t)(ehdrp->e_entry + voffset);
894
895 if (!uphdr) {
896 if (ehdrp->e_type == ET_DYN) {
897 /*
898 * If we are executing a shared library which doesn't
899 * have a interpreter (probably ld.so.1) then
900 * we don't set the brkbase now. Instead we
901 * delay it's setting until the first call
902 * via grow.c::brk(). This permits ld.so.1 to
903 * initialize brkbase to the tail of the executable it
904 * loads (which is where it needs to be).
905 */
906 bigwad->exenv.ex_brkbase = (caddr_t)0;
907 bigwad->exenv.ex_bssbase = (caddr_t)0;
908 bigwad->exenv.ex_brksize = 0;
909 } else {
910 bigwad->exenv.ex_brkbase = brkbase;
911 bigwad->exenv.ex_bssbase = bssbase;
912 bigwad->exenv.ex_brksize = brksize;
913 }
914 bigwad->exenv.ex_magic = elfmagic;
915 bigwad->exenv.ex_vp = vp;
916 setexecenv(&bigwad->exenv);
917 }
918
919 ASSERT(error == 0);
920 goto out;
921
922 bad:
923 if (fd != -1) /* did we open the a.out yet */
924 (void) execclose(fd);
925
926 psignal(p, SIGKILL);
927
928 if (error == 0)
929 error = ENOEXEC;
930 out:
931 if (phdrbase != NULL)
932 kmem_free(phdrbase, phdrsize);
933 if (cap != NULL)
934 kmem_free(cap, capsize);
935 kmem_free(bigwad, sizeof (struct bigwad));
936 return (error);
937 }
938
939 /*
940 * Compute the memory size requirement for the ELF file.
941 */
942 static size_t
elfsize(Ehdr * ehdrp,int nphdrs,caddr_t phdrbase,uintptr_t * lddata)943 elfsize(Ehdr *ehdrp, int nphdrs, caddr_t phdrbase, uintptr_t *lddata)
944 {
945 size_t len;
946 Phdr *phdrp = (Phdr *)phdrbase;
947 int hsize = ehdrp->e_phentsize;
948 int first = 1;
949 int dfirst = 1; /* first data segment */
950 uintptr_t loaddr = 0;
951 uintptr_t hiaddr = 0;
952 uintptr_t lo, hi;
953 int i;
954
955 for (i = nphdrs; i > 0; i--) {
956 if (phdrp->p_type == PT_LOAD) {
957 lo = phdrp->p_vaddr;
958 hi = lo + phdrp->p_memsz;
959 if (first) {
960 loaddr = lo;
961 hiaddr = hi;
962 first = 0;
963 } else {
964 if (loaddr > lo)
965 loaddr = lo;
966 if (hiaddr < hi)
967 hiaddr = hi;
968 }
969
970 /*
971 * save the address of the first data segment
972 * of a object - used for the AT_SUNW_LDDATA
973 * aux entry.
974 */
975 if ((lddata != NULL) && dfirst &&
976 (phdrp->p_flags & PF_W)) {
977 *lddata = lo;
978 dfirst = 0;
979 }
980 }
981 phdrp = (Phdr *)((caddr_t)phdrp + hsize);
982 }
983
984 len = hiaddr - (loaddr & PAGEMASK);
985 len = roundup(len, PAGESIZE);
986
987 return (len);
988 }
989
990 /*
991 * Read in the ELF header and program header table.
992 * SUSV3 requires:
993 * ENOEXEC File format is not recognized
994 * EINVAL Format recognized but execution not supported
995 */
996 static int
getelfhead(vnode_t * vp,cred_t * credp,Ehdr * ehdr,int * nshdrs,int * shstrndx,int * nphdrs)997 getelfhead(vnode_t *vp, cred_t *credp, Ehdr *ehdr, int *nshdrs, int *shstrndx,
998 int *nphdrs)
999 {
1000 int error;
1001 ssize_t resid;
1002
1003 /*
1004 * We got here by the first two bytes in ident,
1005 * now read the entire ELF header.
1006 */
1007 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)ehdr,
1008 sizeof (Ehdr), (offset_t)0, UIO_SYSSPACE, 0,
1009 (rlim64_t)0, credp, &resid)) != 0)
1010 return (error);
1011
1012 /*
1013 * Since a separate version is compiled for handling 32-bit and
1014 * 64-bit ELF executables on a 64-bit kernel, the 64-bit version
1015 * doesn't need to be able to deal with 32-bit ELF files.
1016 */
1017 if (resid != 0 ||
1018 ehdr->e_ident[EI_MAG2] != ELFMAG2 ||
1019 ehdr->e_ident[EI_MAG3] != ELFMAG3)
1020 return (ENOEXEC);
1021
1022 if ((ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) ||
1023 #if defined(_ILP32) || defined(_ELF32_COMPAT)
1024 ehdr->e_ident[EI_CLASS] != ELFCLASS32 ||
1025 #else
1026 ehdr->e_ident[EI_CLASS] != ELFCLASS64 ||
1027 #endif
1028 !elfheadcheck(ehdr->e_ident[EI_DATA], ehdr->e_machine,
1029 ehdr->e_flags))
1030 return (EINVAL);
1031
1032 *nshdrs = ehdr->e_shnum;
1033 *shstrndx = ehdr->e_shstrndx;
1034 *nphdrs = ehdr->e_phnum;
1035
1036 /*
1037 * If e_shnum, e_shstrndx, or e_phnum is its sentinel value, we need
1038 * to read in the section header at index zero to acces the true
1039 * values for those fields.
1040 */
1041 if ((*nshdrs == 0 && ehdr->e_shoff != 0) ||
1042 *shstrndx == SHN_XINDEX || *nphdrs == PN_XNUM) {
1043 Shdr shdr;
1044
1045 if (ehdr->e_shoff == 0)
1046 return (EINVAL);
1047
1048 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)&shdr,
1049 sizeof (shdr), (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0,
1050 (rlim64_t)0, credp, &resid)) != 0)
1051 return (error);
1052
1053 if (*nshdrs == 0)
1054 *nshdrs = shdr.sh_size;
1055 if (*shstrndx == SHN_XINDEX)
1056 *shstrndx = shdr.sh_link;
1057 if (*nphdrs == PN_XNUM && shdr.sh_info != 0)
1058 *nphdrs = shdr.sh_info;
1059 }
1060
1061 return (0);
1062 }
1063
1064 #ifdef _ELF32_COMPAT
1065 extern size_t elf_nphdr_max;
1066 #else
1067 size_t elf_nphdr_max = 1000;
1068 #endif
1069
1070 static int
getelfphdr(vnode_t * vp,cred_t * credp,const Ehdr * ehdr,int nphdrs,caddr_t * phbasep,ssize_t * phsizep)1071 getelfphdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, int nphdrs,
1072 caddr_t *phbasep, ssize_t *phsizep)
1073 {
1074 ssize_t resid, minsize;
1075 int err;
1076
1077 /*
1078 * Since we're going to be using e_phentsize to iterate down the
1079 * array of program headers, it must be 8-byte aligned or else
1080 * a we might cause a misaligned access. We use all members through
1081 * p_flags on 32-bit ELF files and p_memsz on 64-bit ELF files so
1082 * e_phentsize must be at least large enough to include those
1083 * members.
1084 */
1085 #if !defined(_LP64) || defined(_ELF32_COMPAT)
1086 minsize = offsetof(Phdr, p_flags) + sizeof (((Phdr *)NULL)->p_flags);
1087 #else
1088 minsize = offsetof(Phdr, p_memsz) + sizeof (((Phdr *)NULL)->p_memsz);
1089 #endif
1090 if (ehdr->e_phentsize < minsize || (ehdr->e_phentsize & 3))
1091 return (EINVAL);
1092
1093 *phsizep = nphdrs * ehdr->e_phentsize;
1094
1095 if (*phsizep > sizeof (Phdr) * elf_nphdr_max) {
1096 if ((*phbasep = kmem_alloc(*phsizep, KM_NOSLEEP)) == NULL)
1097 return (ENOMEM);
1098 } else {
1099 *phbasep = kmem_alloc(*phsizep, KM_SLEEP);
1100 }
1101
1102 if ((err = vn_rdwr(UIO_READ, vp, *phbasep, *phsizep,
1103 (offset_t)ehdr->e_phoff, UIO_SYSSPACE, 0, (rlim64_t)0,
1104 credp, &resid)) != 0) {
1105 kmem_free(*phbasep, *phsizep);
1106 *phbasep = NULL;
1107 return (err);
1108 }
1109
1110 return (0);
1111 }
1112
1113 #ifdef _ELF32_COMPAT
1114 extern size_t elf_nshdr_max;
1115 extern size_t elf_shstrtab_max;
1116 #else
1117 size_t elf_nshdr_max = 10000;
1118 size_t elf_shstrtab_max = 100 * 1024;
1119 #endif
1120
1121
1122 static int
getelfshdr(vnode_t * vp,cred_t * credp,const Ehdr * ehdr,int nshdrs,int shstrndx,caddr_t * shbasep,ssize_t * shsizep,char ** shstrbasep,ssize_t * shstrsizep)1123 getelfshdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr,
1124 int nshdrs, int shstrndx, caddr_t *shbasep, ssize_t *shsizep,
1125 char **shstrbasep, ssize_t *shstrsizep)
1126 {
1127 ssize_t resid, minsize;
1128 int err;
1129 Shdr *shdr;
1130
1131 /*
1132 * Since we're going to be using e_shentsize to iterate down the
1133 * array of section headers, it must be 8-byte aligned or else
1134 * a we might cause a misaligned access. We use all members through
1135 * sh_entsize (on both 32- and 64-bit ELF files) so e_shentsize
1136 * must be at least large enough to include that member. The index
1137 * of the string table section must also be valid.
1138 */
1139 minsize = offsetof(Shdr, sh_entsize) + sizeof (shdr->sh_entsize);
1140 if (ehdr->e_shentsize < minsize || (ehdr->e_shentsize & 3) ||
1141 shstrndx >= nshdrs)
1142 return (EINVAL);
1143
1144 *shsizep = nshdrs * ehdr->e_shentsize;
1145
1146 if (*shsizep > sizeof (Shdr) * elf_nshdr_max) {
1147 if ((*shbasep = kmem_alloc(*shsizep, KM_NOSLEEP)) == NULL)
1148 return (ENOMEM);
1149 } else {
1150 *shbasep = kmem_alloc(*shsizep, KM_SLEEP);
1151 }
1152
1153 if ((err = vn_rdwr(UIO_READ, vp, *shbasep, *shsizep,
1154 (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, (rlim64_t)0,
1155 credp, &resid)) != 0) {
1156 kmem_free(*shbasep, *shsizep);
1157 return (err);
1158 }
1159
1160 /*
1161 * Pull the section string table out of the vnode; fail if the size
1162 * is zero.
1163 */
1164 shdr = (Shdr *)(*shbasep + shstrndx * ehdr->e_shentsize);
1165 if ((*shstrsizep = shdr->sh_size) == 0) {
1166 kmem_free(*shbasep, *shsizep);
1167 return (EINVAL);
1168 }
1169
1170 if (*shstrsizep > elf_shstrtab_max) {
1171 if ((*shstrbasep = kmem_alloc(*shstrsizep,
1172 KM_NOSLEEP)) == NULL) {
1173 kmem_free(*shbasep, *shsizep);
1174 return (ENOMEM);
1175 }
1176 } else {
1177 *shstrbasep = kmem_alloc(*shstrsizep, KM_SLEEP);
1178 }
1179
1180 if ((err = vn_rdwr(UIO_READ, vp, *shstrbasep, *shstrsizep,
1181 (offset_t)shdr->sh_offset, UIO_SYSSPACE, 0, (rlim64_t)0,
1182 credp, &resid)) != 0) {
1183 kmem_free(*shbasep, *shsizep);
1184 kmem_free(*shstrbasep, *shstrsizep);
1185 return (err);
1186 }
1187
1188 /*
1189 * Make sure the strtab is null-terminated to make sure we
1190 * don't run off the end of the table.
1191 */
1192 (*shstrbasep)[*shstrsizep - 1] = '\0';
1193
1194 return (0);
1195 }
1196
1197 static int
mapelfexec(vnode_t * vp,Ehdr * ehdr,int nphdrs,caddr_t phdrbase,Phdr ** uphdr,Phdr ** dyphdr,Phdr ** stphdr,Phdr ** dtphdr,Phdr * dataphdrp,caddr_t * bssbase,caddr_t * brkbase,intptr_t * voffset,intptr_t * minaddr,size_t len,long * execsz,size_t * brksize)1198 mapelfexec(
1199 vnode_t *vp,
1200 Ehdr *ehdr,
1201 int nphdrs,
1202 caddr_t phdrbase,
1203 Phdr **uphdr,
1204 Phdr **dyphdr,
1205 Phdr **stphdr,
1206 Phdr **dtphdr,
1207 Phdr *dataphdrp,
1208 caddr_t *bssbase,
1209 caddr_t *brkbase,
1210 intptr_t *voffset,
1211 intptr_t *minaddr,
1212 size_t len,
1213 long *execsz,
1214 size_t *brksize)
1215 {
1216 Phdr *phdr;
1217 int i, prot, error;
1218 caddr_t addr = NULL;
1219 size_t zfodsz;
1220 int ptload = 0;
1221 int page;
1222 off_t offset;
1223 int hsize = ehdr->e_phentsize;
1224 caddr_t mintmp = (caddr_t)-1;
1225 extern int use_brk_lpg;
1226
1227 if (ehdr->e_type == ET_DYN) {
1228 /*
1229 * Obtain the virtual address of a hole in the
1230 * address space to map the "interpreter".
1231 */
1232 map_addr(&addr, len, (offset_t)0, 1, 0);
1233 if (addr == NULL)
1234 return (ENOMEM);
1235 *voffset = (intptr_t)addr;
1236
1237 /*
1238 * Calculate the minimum vaddr so it can be subtracted out.
1239 * According to the ELF specification, since PT_LOAD sections
1240 * must be sorted by increasing p_vaddr values, this is
1241 * guaranteed to be the first PT_LOAD section.
1242 */
1243 phdr = (Phdr *)phdrbase;
1244 for (i = nphdrs; i > 0; i--) {
1245 if (phdr->p_type == PT_LOAD) {
1246 *voffset -= (uintptr_t)phdr->p_vaddr;
1247 break;
1248 }
1249 phdr = (Phdr *)((caddr_t)phdr + hsize);
1250 }
1251
1252 } else {
1253 *voffset = 0;
1254 }
1255 phdr = (Phdr *)phdrbase;
1256 for (i = nphdrs; i > 0; i--) {
1257 switch (phdr->p_type) {
1258 case PT_LOAD:
1259 if ((*dyphdr != NULL) && (*uphdr == NULL))
1260 return (0);
1261
1262 ptload = 1;
1263 prot = PROT_USER;
1264 if (phdr->p_flags & PF_R)
1265 prot |= PROT_READ;
1266 if (phdr->p_flags & PF_W)
1267 prot |= PROT_WRITE;
1268 if (phdr->p_flags & PF_X)
1269 prot |= PROT_EXEC;
1270
1271 addr = (caddr_t)((uintptr_t)phdr->p_vaddr + *voffset);
1272
1273 /*
1274 * Keep track of the segment with the lowest starting
1275 * address.
1276 */
1277 if (addr < mintmp)
1278 mintmp = addr;
1279
1280 zfodsz = (size_t)phdr->p_memsz - phdr->p_filesz;
1281
1282 offset = phdr->p_offset;
1283 if (((uintptr_t)offset & PAGEOFFSET) ==
1284 ((uintptr_t)addr & PAGEOFFSET) &&
1285 (!(vp->v_flag & VNOMAP))) {
1286 page = 1;
1287 } else {
1288 page = 0;
1289 }
1290
1291 /*
1292 * Set the heap pagesize for OOB when the bss size
1293 * is known and use_brk_lpg is not 0.
1294 */
1295 if (brksize != NULL && use_brk_lpg &&
1296 zfodsz != 0 && phdr == dataphdrp &&
1297 (prot & PROT_WRITE)) {
1298 size_t tlen = P2NPHASE((uintptr_t)addr +
1299 phdr->p_filesz, PAGESIZE);
1300
1301 if (zfodsz > tlen) {
1302 curproc->p_brkpageszc =
1303 page_szc(map_pgsz(MAPPGSZ_HEAP,
1304 curproc, addr + phdr->p_filesz +
1305 tlen, zfodsz - tlen, 0));
1306 }
1307 }
1308
1309 if (curproc->p_brkpageszc != 0 && phdr == dataphdrp &&
1310 (prot & PROT_WRITE)) {
1311 uint_t szc = curproc->p_brkpageszc;
1312 size_t pgsz = page_get_pagesize(szc);
1313 caddr_t ebss = addr + phdr->p_memsz;
1314 size_t extra_zfodsz;
1315
1316 ASSERT(pgsz > PAGESIZE);
1317
1318 extra_zfodsz = P2NPHASE((uintptr_t)ebss, pgsz);
1319
1320 if (error = execmap(vp, addr, phdr->p_filesz,
1321 zfodsz + extra_zfodsz, phdr->p_offset,
1322 prot, page, szc))
1323 goto bad;
1324 if (brksize != NULL)
1325 *brksize = extra_zfodsz;
1326 } else {
1327 if (error = execmap(vp, addr, phdr->p_filesz,
1328 zfodsz, phdr->p_offset, prot, page, 0))
1329 goto bad;
1330 }
1331
1332 if (bssbase != NULL && addr >= *bssbase &&
1333 phdr == dataphdrp) {
1334 *bssbase = addr + phdr->p_filesz;
1335 }
1336 if (brkbase != NULL && addr >= *brkbase) {
1337 *brkbase = addr + phdr->p_memsz;
1338 }
1339
1340 *execsz += btopr(phdr->p_memsz);
1341 break;
1342
1343 case PT_INTERP:
1344 if (ptload)
1345 goto bad;
1346 *dyphdr = phdr;
1347 break;
1348
1349 case PT_SHLIB:
1350 *stphdr = phdr;
1351 break;
1352
1353 case PT_PHDR:
1354 if (ptload)
1355 goto bad;
1356 *uphdr = phdr;
1357 break;
1358
1359 case PT_NULL:
1360 case PT_DYNAMIC:
1361 case PT_NOTE:
1362 break;
1363
1364 case PT_SUNWDTRACE:
1365 if (dtphdr != NULL)
1366 *dtphdr = phdr;
1367 break;
1368
1369 default:
1370 break;
1371 }
1372 phdr = (Phdr *)((caddr_t)phdr + hsize);
1373 }
1374
1375 if (minaddr != NULL) {
1376 ASSERT(mintmp != (caddr_t)-1);
1377 *minaddr = (intptr_t)mintmp;
1378 }
1379
1380 return (0);
1381 bad:
1382 if (error == 0)
1383 error = EINVAL;
1384 return (error);
1385 }
1386
1387 int
elfnote(vnode_t * vp,offset_t * offsetp,int type,int descsz,void * desc,rlim64_t rlimit,cred_t * credp)1388 elfnote(vnode_t *vp, offset_t *offsetp, int type, int descsz, void *desc,
1389 rlim64_t rlimit, cred_t *credp)
1390 {
1391 Note note;
1392 int error;
1393
1394 bzero(¬e, sizeof (note));
1395 bcopy("CORE", note.name, 4);
1396 note.nhdr.n_type = type;
1397 /*
1398 * The System V ABI states that n_namesz must be the length of the
1399 * string that follows the Nhdr structure including the terminating
1400 * null. The ABI also specifies that sufficient padding should be
1401 * included so that the description that follows the name string
1402 * begins on a 4- or 8-byte boundary for 32- and 64-bit binaries
1403 * respectively. However, since this change was not made correctly
1404 * at the time of the 64-bit port, both 32- and 64-bit binaries
1405 * descriptions are only guaranteed to begin on a 4-byte boundary.
1406 */
1407 note.nhdr.n_namesz = 5;
1408 note.nhdr.n_descsz = roundup(descsz, sizeof (Word));
1409
1410 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, ¬e,
1411 sizeof (note), rlimit, credp))
1412 return (error);
1413
1414 *offsetp += sizeof (note);
1415
1416 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, desc,
1417 note.nhdr.n_descsz, rlimit, credp))
1418 return (error);
1419
1420 *offsetp += note.nhdr.n_descsz;
1421 return (0);
1422 }
1423
1424 /*
1425 * Copy the section data from one vnode to the section of another vnode.
1426 */
1427 static void
copy_scn(Shdr * src,vnode_t * src_vp,Shdr * dst,vnode_t * dst_vp,Off * doffset,void * buf,size_t size,cred_t * credp,rlim64_t rlimit)1428 copy_scn(Shdr *src, vnode_t *src_vp, Shdr *dst, vnode_t *dst_vp, Off *doffset,
1429 void *buf, size_t size, cred_t *credp, rlim64_t rlimit)
1430 {
1431 ssize_t resid;
1432 size_t len, n = src->sh_size;
1433 offset_t off = 0;
1434
1435 while (n != 0) {
1436 len = MIN(size, n);
1437 if (vn_rdwr(UIO_READ, src_vp, buf, len, src->sh_offset + off,
1438 UIO_SYSSPACE, 0, (rlim64_t)0, credp, &resid) != 0 ||
1439 resid >= len ||
1440 core_write(dst_vp, UIO_SYSSPACE, *doffset + off,
1441 buf, len - resid, rlimit, credp) != 0) {
1442 dst->sh_size = 0;
1443 dst->sh_offset = 0;
1444 return;
1445 }
1446
1447 ASSERT(n >= len - resid);
1448
1449 n -= len - resid;
1450 off += len - resid;
1451 }
1452
1453 *doffset += src->sh_size;
1454 }
1455
1456 #ifdef _ELF32_COMPAT
1457 extern size_t elf_datasz_max;
1458 #else
1459 size_t elf_datasz_max = 1 * 1024 * 1024;
1460 #endif
1461
1462 /*
1463 * This function processes mappings that correspond to load objects to
1464 * examine their respective sections for elfcore(). It's called once with
1465 * v set to NULL to count the number of sections that we're going to need
1466 * and then again with v set to some allocated buffer that we fill in with
1467 * all the section data.
1468 */
1469 static int
process_scns(core_content_t content,proc_t * p,cred_t * credp,vnode_t * vp,Shdr * v,int nv,rlim64_t rlimit,Off * doffsetp,int * nshdrsp)1470 process_scns(core_content_t content, proc_t *p, cred_t *credp, vnode_t *vp,
1471 Shdr *v, int nv, rlim64_t rlimit, Off *doffsetp, int *nshdrsp)
1472 {
1473 vnode_t *lastvp = NULL;
1474 struct seg *seg;
1475 int i, j;
1476 void *data = NULL;
1477 size_t datasz = 0;
1478 shstrtab_t shstrtab;
1479 struct as *as = p->p_as;
1480 int error = 0;
1481
1482 if (v != NULL)
1483 shstrtab_init(&shstrtab);
1484
1485 i = 1;
1486 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
1487 uint_t prot;
1488 vnode_t *mvp;
1489 void *tmp = NULL;
1490 caddr_t saddr = seg->s_base;
1491 caddr_t naddr;
1492 caddr_t eaddr;
1493 size_t segsize;
1494
1495 Ehdr ehdr;
1496 int nshdrs, shstrndx, nphdrs;
1497 caddr_t shbase;
1498 ssize_t shsize;
1499 char *shstrbase;
1500 ssize_t shstrsize;
1501
1502 Shdr *shdr;
1503 const char *name;
1504 size_t sz;
1505 uintptr_t off;
1506
1507 int ctf_ndx = 0;
1508 int symtab_ndx = 0;
1509
1510 /*
1511 * Since we're just looking for text segments of load
1512 * objects, we only care about the protection bits; we don't
1513 * care about the actual size of the segment so we use the
1514 * reserved size. If the segment's size is zero, there's
1515 * something fishy going on so we ignore this segment.
1516 */
1517 if (seg->s_ops != &segvn_ops ||
1518 SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 ||
1519 mvp == lastvp || mvp == NULL || mvp->v_type != VREG ||
1520 (segsize = pr_getsegsize(seg, 1)) == 0)
1521 continue;
1522
1523 eaddr = saddr + segsize;
1524 prot = pr_getprot(seg, 1, &tmp, &saddr, &naddr, eaddr);
1525 pr_getprot_done(&tmp);
1526
1527 /*
1528 * Skip this segment unless the protection bits look like
1529 * what we'd expect for a text segment.
1530 */
1531 if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC)
1532 continue;
1533
1534 if (getelfhead(mvp, credp, &ehdr, &nshdrs, &shstrndx,
1535 &nphdrs) != 0 ||
1536 getelfshdr(mvp, credp, &ehdr, nshdrs, shstrndx,
1537 &shbase, &shsize, &shstrbase, &shstrsize) != 0)
1538 continue;
1539
1540 off = ehdr.e_shentsize;
1541 for (j = 1; j < nshdrs; j++, off += ehdr.e_shentsize) {
1542 Shdr *symtab = NULL, *strtab;
1543
1544 shdr = (Shdr *)(shbase + off);
1545
1546 if (shdr->sh_name >= shstrsize)
1547 continue;
1548
1549 name = shstrbase + shdr->sh_name;
1550
1551 if (strcmp(name, shstrtab_data[STR_CTF]) == 0) {
1552 if ((content & CC_CONTENT_CTF) == 0 ||
1553 ctf_ndx != 0)
1554 continue;
1555
1556 if (shdr->sh_link > 0 &&
1557 shdr->sh_link < nshdrs) {
1558 symtab = (Shdr *)(shbase +
1559 shdr->sh_link * ehdr.e_shentsize);
1560 }
1561
1562 if (v != NULL && i < nv - 1) {
1563 if (shdr->sh_size > datasz &&
1564 shdr->sh_size <= elf_datasz_max) {
1565 if (data != NULL)
1566 kmem_free(data, datasz);
1567
1568 datasz = shdr->sh_size;
1569 data = kmem_alloc(datasz,
1570 KM_SLEEP);
1571 }
1572
1573 v[i].sh_name = shstrtab_ndx(&shstrtab,
1574 STR_CTF);
1575 v[i].sh_addr = (Addr)(uintptr_t)saddr;
1576 v[i].sh_type = SHT_PROGBITS;
1577 v[i].sh_addralign = 4;
1578 *doffsetp = roundup(*doffsetp,
1579 v[i].sh_addralign);
1580 v[i].sh_offset = *doffsetp;
1581 v[i].sh_size = shdr->sh_size;
1582 if (symtab == NULL) {
1583 v[i].sh_link = 0;
1584 } else if (symtab->sh_type ==
1585 SHT_SYMTAB &&
1586 symtab_ndx != 0) {
1587 v[i].sh_link =
1588 symtab_ndx;
1589 } else {
1590 v[i].sh_link = i + 1;
1591 }
1592
1593 copy_scn(shdr, mvp, &v[i], vp,
1594 doffsetp, data, datasz, credp,
1595 rlimit);
1596 }
1597
1598 ctf_ndx = i++;
1599
1600 /*
1601 * We've already dumped the symtab.
1602 */
1603 if (symtab != NULL &&
1604 symtab->sh_type == SHT_SYMTAB &&
1605 symtab_ndx != 0)
1606 continue;
1607
1608 } else if (strcmp(name,
1609 shstrtab_data[STR_SYMTAB]) == 0) {
1610 if ((content & CC_CONTENT_SYMTAB) == 0 ||
1611 symtab != 0)
1612 continue;
1613
1614 symtab = shdr;
1615 }
1616
1617 if (symtab != NULL) {
1618 if ((symtab->sh_type != SHT_DYNSYM &&
1619 symtab->sh_type != SHT_SYMTAB) ||
1620 symtab->sh_link == 0 ||
1621 symtab->sh_link >= nshdrs)
1622 continue;
1623
1624 strtab = (Shdr *)(shbase +
1625 symtab->sh_link * ehdr.e_shentsize);
1626
1627 if (strtab->sh_type != SHT_STRTAB)
1628 continue;
1629
1630 if (v != NULL && i < nv - 2) {
1631 sz = MAX(symtab->sh_size,
1632 strtab->sh_size);
1633 if (sz > datasz &&
1634 sz <= elf_datasz_max) {
1635 if (data != NULL)
1636 kmem_free(data, datasz);
1637
1638 datasz = sz;
1639 data = kmem_alloc(datasz,
1640 KM_SLEEP);
1641 }
1642
1643 if (symtab->sh_type == SHT_DYNSYM) {
1644 v[i].sh_name = shstrtab_ndx(
1645 &shstrtab, STR_DYNSYM);
1646 v[i + 1].sh_name = shstrtab_ndx(
1647 &shstrtab, STR_DYNSTR);
1648 } else {
1649 v[i].sh_name = shstrtab_ndx(
1650 &shstrtab, STR_SYMTAB);
1651 v[i + 1].sh_name = shstrtab_ndx(
1652 &shstrtab, STR_STRTAB);
1653 }
1654
1655 v[i].sh_type = symtab->sh_type;
1656 v[i].sh_addr = symtab->sh_addr;
1657 if (ehdr.e_type == ET_DYN ||
1658 v[i].sh_addr == 0)
1659 v[i].sh_addr +=
1660 (Addr)(uintptr_t)saddr;
1661 v[i].sh_addralign =
1662 symtab->sh_addralign;
1663 *doffsetp = roundup(*doffsetp,
1664 v[i].sh_addralign);
1665 v[i].sh_offset = *doffsetp;
1666 v[i].sh_size = symtab->sh_size;
1667 v[i].sh_link = i + 1;
1668 v[i].sh_entsize = symtab->sh_entsize;
1669 v[i].sh_info = symtab->sh_info;
1670
1671 copy_scn(symtab, mvp, &v[i], vp,
1672 doffsetp, data, datasz, credp,
1673 rlimit);
1674
1675 v[i + 1].sh_type = SHT_STRTAB;
1676 v[i + 1].sh_flags = SHF_STRINGS;
1677 v[i + 1].sh_addr = symtab->sh_addr;
1678 if (ehdr.e_type == ET_DYN ||
1679 v[i + 1].sh_addr == 0)
1680 v[i + 1].sh_addr +=
1681 (Addr)(uintptr_t)saddr;
1682 v[i + 1].sh_addralign =
1683 strtab->sh_addralign;
1684 *doffsetp = roundup(*doffsetp,
1685 v[i + 1].sh_addralign);
1686 v[i + 1].sh_offset = *doffsetp;
1687 v[i + 1].sh_size = strtab->sh_size;
1688
1689 copy_scn(strtab, mvp, &v[i + 1], vp,
1690 doffsetp, data, datasz, credp,
1691 rlimit);
1692 }
1693
1694 if (symtab->sh_type == SHT_SYMTAB)
1695 symtab_ndx = i;
1696 i += 2;
1697 }
1698 }
1699
1700 kmem_free(shstrbase, shstrsize);
1701 kmem_free(shbase, shsize);
1702
1703 lastvp = mvp;
1704 }
1705
1706 if (v == NULL) {
1707 if (i == 1)
1708 *nshdrsp = 0;
1709 else
1710 *nshdrsp = i + 1;
1711 goto done;
1712 }
1713
1714 if (i != nv - 1) {
1715 cmn_err(CE_WARN, "elfcore: core dump failed for "
1716 "process %d; address space is changing", p->p_pid);
1717 error = EIO;
1718 goto done;
1719 }
1720
1721 v[i].sh_name = shstrtab_ndx(&shstrtab, STR_SHSTRTAB);
1722 v[i].sh_size = shstrtab_size(&shstrtab);
1723 v[i].sh_addralign = 1;
1724 *doffsetp = roundup(*doffsetp, v[i].sh_addralign);
1725 v[i].sh_offset = *doffsetp;
1726 v[i].sh_flags = SHF_STRINGS;
1727 v[i].sh_type = SHT_STRTAB;
1728
1729 if (v[i].sh_size > datasz) {
1730 if (data != NULL)
1731 kmem_free(data, datasz);
1732
1733 datasz = v[i].sh_size;
1734 data = kmem_alloc(datasz,
1735 KM_SLEEP);
1736 }
1737
1738 shstrtab_dump(&shstrtab, data);
1739
1740 if ((error = core_write(vp, UIO_SYSSPACE, *doffsetp,
1741 data, v[i].sh_size, rlimit, credp)) != 0)
1742 goto done;
1743
1744 *doffsetp += v[i].sh_size;
1745
1746 done:
1747 if (data != NULL)
1748 kmem_free(data, datasz);
1749
1750 return (error);
1751 }
1752
1753 int
elfcore(vnode_t * vp,proc_t * p,cred_t * credp,rlim64_t rlimit,int sig,core_content_t content)1754 elfcore(vnode_t *vp, proc_t *p, cred_t *credp, rlim64_t rlimit, int sig,
1755 core_content_t content)
1756 {
1757 offset_t poffset, soffset;
1758 Off doffset;
1759 int error, i, nphdrs, nshdrs;
1760 int overflow = 0;
1761 struct seg *seg;
1762 struct as *as = p->p_as;
1763 union {
1764 Ehdr ehdr;
1765 Phdr phdr[1];
1766 Shdr shdr[1];
1767 } *bigwad;
1768 size_t bigsize;
1769 size_t phdrsz, shdrsz;
1770 Ehdr *ehdr;
1771 Phdr *v;
1772 caddr_t brkbase;
1773 size_t brksize;
1774 caddr_t stkbase;
1775 size_t stksize;
1776 int ntries = 0;
1777 klwp_t *lwp = ttolwp(curthread);
1778
1779 top:
1780 /*
1781 * Make sure we have everything we need (registers, etc.).
1782 * All other lwps have already stopped and are in an orderly state.
1783 */
1784 ASSERT(p == ttoproc(curthread));
1785 prstop(0, 0);
1786
1787 AS_LOCK_ENTER(as, RW_WRITER);
1788 nphdrs = prnsegs(as, 0) + 2; /* two CORE note sections */
1789
1790 /*
1791 * Count the number of section headers we're going to need.
1792 */
1793 nshdrs = 0;
1794 if (content & (CC_CONTENT_CTF | CC_CONTENT_SYMTAB)) {
1795 (void) process_scns(content, p, credp, NULL, NULL, NULL, 0,
1796 NULL, &nshdrs);
1797 }
1798 AS_LOCK_EXIT(as);
1799
1800 ASSERT(nshdrs == 0 || nshdrs > 1);
1801
1802 /*
1803 * The core file contents may required zero section headers, but if
1804 * we overflow the 16 bits allotted to the program header count in
1805 * the ELF header, we'll need that program header at index zero.
1806 */
1807 if (nshdrs == 0 && nphdrs >= PN_XNUM)
1808 nshdrs = 1;
1809
1810 phdrsz = nphdrs * sizeof (Phdr);
1811 shdrsz = nshdrs * sizeof (Shdr);
1812
1813 bigsize = MAX(sizeof (*bigwad), MAX(phdrsz, shdrsz));
1814 bigwad = kmem_alloc(bigsize, KM_SLEEP);
1815
1816 ehdr = &bigwad->ehdr;
1817 bzero(ehdr, sizeof (*ehdr));
1818
1819 ehdr->e_ident[EI_MAG0] = ELFMAG0;
1820 ehdr->e_ident[EI_MAG1] = ELFMAG1;
1821 ehdr->e_ident[EI_MAG2] = ELFMAG2;
1822 ehdr->e_ident[EI_MAG3] = ELFMAG3;
1823 ehdr->e_ident[EI_CLASS] = ELFCLASS;
1824 ehdr->e_type = ET_CORE;
1825
1826 #if !defined(_LP64) || defined(_ELF32_COMPAT)
1827
1828 #if defined(__sparc)
1829 ehdr->e_ident[EI_DATA] = ELFDATA2MSB;
1830 ehdr->e_machine = EM_SPARC;
1831 #elif defined(__i386) || defined(__i386_COMPAT)
1832 ehdr->e_ident[EI_DATA] = ELFDATA2LSB;
1833 ehdr->e_machine = EM_386;
1834 #else
1835 #error "no recognized machine type is defined"
1836 #endif
1837
1838 #else /* !defined(_LP64) || defined(_ELF32_COMPAT) */
1839
1840 #if defined(__sparc)
1841 ehdr->e_ident[EI_DATA] = ELFDATA2MSB;
1842 ehdr->e_machine = EM_SPARCV9;
1843 #elif defined(__amd64)
1844 ehdr->e_ident[EI_DATA] = ELFDATA2LSB;
1845 ehdr->e_machine = EM_AMD64;
1846 #else
1847 #error "no recognized 64-bit machine type is defined"
1848 #endif
1849
1850 #endif /* !defined(_LP64) || defined(_ELF32_COMPAT) */
1851
1852 /*
1853 * If the count of program headers or section headers or the index
1854 * of the section string table can't fit in the mere 16 bits
1855 * shortsightedly allotted to them in the ELF header, we use the
1856 * extended formats and put the real values in the section header
1857 * as index 0.
1858 */
1859 ehdr->e_version = EV_CURRENT;
1860 ehdr->e_ehsize = sizeof (Ehdr);
1861
1862 if (nphdrs >= PN_XNUM)
1863 ehdr->e_phnum = PN_XNUM;
1864 else
1865 ehdr->e_phnum = (unsigned short)nphdrs;
1866
1867 ehdr->e_phoff = sizeof (Ehdr);
1868 ehdr->e_phentsize = sizeof (Phdr);
1869
1870 if (nshdrs > 0) {
1871 if (nshdrs >= SHN_LORESERVE)
1872 ehdr->e_shnum = 0;
1873 else
1874 ehdr->e_shnum = (unsigned short)nshdrs;
1875
1876 if (nshdrs - 1 >= SHN_LORESERVE)
1877 ehdr->e_shstrndx = SHN_XINDEX;
1878 else
1879 ehdr->e_shstrndx = (unsigned short)(nshdrs - 1);
1880
1881 ehdr->e_shoff = ehdr->e_phoff + ehdr->e_phentsize * nphdrs;
1882 ehdr->e_shentsize = sizeof (Shdr);
1883 }
1884
1885 if (error = core_write(vp, UIO_SYSSPACE, (offset_t)0, ehdr,
1886 sizeof (Ehdr), rlimit, credp))
1887 goto done;
1888
1889 poffset = sizeof (Ehdr);
1890 soffset = sizeof (Ehdr) + phdrsz;
1891 doffset = sizeof (Ehdr) + phdrsz + shdrsz;
1892
1893 v = &bigwad->phdr[0];
1894 bzero(v, phdrsz);
1895
1896 setup_old_note_header(&v[0], p);
1897 v[0].p_offset = doffset = roundup(doffset, sizeof (Word));
1898 doffset += v[0].p_filesz;
1899
1900 setup_note_header(&v[1], p);
1901 v[1].p_offset = doffset = roundup(doffset, sizeof (Word));
1902 doffset += v[1].p_filesz;
1903
1904 mutex_enter(&p->p_lock);
1905
1906 brkbase = p->p_brkbase;
1907 brksize = p->p_brksize;
1908
1909 stkbase = p->p_usrstack - p->p_stksize;
1910 stksize = p->p_stksize;
1911
1912 mutex_exit(&p->p_lock);
1913
1914 AS_LOCK_ENTER(as, RW_WRITER);
1915 i = 2;
1916 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
1917 caddr_t eaddr = seg->s_base + pr_getsegsize(seg, 0);
1918 caddr_t saddr, naddr;
1919 void *tmp = NULL;
1920 extern struct seg_ops segspt_shmops;
1921
1922 for (saddr = seg->s_base; saddr < eaddr; saddr = naddr) {
1923 uint_t prot;
1924 size_t size;
1925 int type;
1926 vnode_t *mvp;
1927
1928 prot = pr_getprot(seg, 0, &tmp, &saddr, &naddr, eaddr);
1929 prot &= PROT_READ | PROT_WRITE | PROT_EXEC;
1930 if ((size = (size_t)(naddr - saddr)) == 0)
1931 continue;
1932 if (i == nphdrs) {
1933 overflow++;
1934 continue;
1935 }
1936 v[i].p_type = PT_LOAD;
1937 v[i].p_vaddr = (Addr)(uintptr_t)saddr;
1938 v[i].p_memsz = size;
1939 if (prot & PROT_READ)
1940 v[i].p_flags |= PF_R;
1941 if (prot & PROT_WRITE)
1942 v[i].p_flags |= PF_W;
1943 if (prot & PROT_EXEC)
1944 v[i].p_flags |= PF_X;
1945
1946 /*
1947 * Figure out which mappings to include in the core.
1948 */
1949 type = SEGOP_GETTYPE(seg, saddr);
1950
1951 if (saddr == stkbase && size == stksize) {
1952 if (!(content & CC_CONTENT_STACK))
1953 goto exclude;
1954
1955 } else if (saddr == brkbase && size == brksize) {
1956 if (!(content & CC_CONTENT_HEAP))
1957 goto exclude;
1958
1959 } else if (seg->s_ops == &segspt_shmops) {
1960 if (type & MAP_NORESERVE) {
1961 if (!(content & CC_CONTENT_DISM))
1962 goto exclude;
1963 } else {
1964 if (!(content & CC_CONTENT_ISM))
1965 goto exclude;
1966 }
1967
1968 } else if (seg->s_ops != &segvn_ops) {
1969 goto exclude;
1970
1971 } else if (type & MAP_SHARED) {
1972 if (shmgetid(p, saddr) != SHMID_NONE) {
1973 if (!(content & CC_CONTENT_SHM))
1974 goto exclude;
1975
1976 } else if (SEGOP_GETVP(seg, seg->s_base,
1977 &mvp) != 0 || mvp == NULL ||
1978 mvp->v_type != VREG) {
1979 if (!(content & CC_CONTENT_SHANON))
1980 goto exclude;
1981
1982 } else {
1983 if (!(content & CC_CONTENT_SHFILE))
1984 goto exclude;
1985 }
1986
1987 } else if (SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 ||
1988 mvp == NULL || mvp->v_type != VREG) {
1989 if (!(content & CC_CONTENT_ANON))
1990 goto exclude;
1991
1992 } else if (prot == (PROT_READ | PROT_EXEC)) {
1993 if (!(content & CC_CONTENT_TEXT))
1994 goto exclude;
1995
1996 } else if (prot == PROT_READ) {
1997 if (!(content & CC_CONTENT_RODATA))
1998 goto exclude;
1999
2000 } else {
2001 if (!(content & CC_CONTENT_DATA))
2002 goto exclude;
2003 }
2004
2005 doffset = roundup(doffset, sizeof (Word));
2006 v[i].p_offset = doffset;
2007 v[i].p_filesz = size;
2008 doffset += size;
2009 exclude:
2010 i++;
2011 }
2012 ASSERT(tmp == NULL);
2013 }
2014 AS_LOCK_EXIT(as);
2015
2016 if (overflow || i != nphdrs) {
2017 if (ntries++ == 0) {
2018 kmem_free(bigwad, bigsize);
2019 overflow = 0;
2020 goto top;
2021 }
2022 cmn_err(CE_WARN, "elfcore: core dump failed for "
2023 "process %d; address space is changing", p->p_pid);
2024 error = EIO;
2025 goto done;
2026 }
2027
2028 if ((error = core_write(vp, UIO_SYSSPACE, poffset,
2029 v, phdrsz, rlimit, credp)) != 0)
2030 goto done;
2031
2032 if ((error = write_old_elfnotes(p, sig, vp, v[0].p_offset, rlimit,
2033 credp)) != 0)
2034 goto done;
2035
2036 if ((error = write_elfnotes(p, sig, vp, v[1].p_offset, rlimit,
2037 credp, content)) != 0)
2038 goto done;
2039
2040 for (i = 2; i < nphdrs; i++) {
2041 prkillinfo_t killinfo;
2042 sigqueue_t *sq;
2043 int sig, j;
2044
2045 if (v[i].p_filesz == 0)
2046 continue;
2047
2048 /*
2049 * If dumping out this segment fails, rather than failing
2050 * the core dump entirely, we reset the size of the mapping
2051 * to zero to indicate that the data is absent from the core
2052 * file and or in the PF_SUNW_FAILURE flag to differentiate
2053 * this from mappings that were excluded due to the core file
2054 * content settings.
2055 */
2056 if ((error = core_seg(p, vp, v[i].p_offset,
2057 (caddr_t)(uintptr_t)v[i].p_vaddr, v[i].p_filesz,
2058 rlimit, credp)) == 0) {
2059 continue;
2060 }
2061
2062 if ((sig = lwp->lwp_cursig) == 0) {
2063 /*
2064 * We failed due to something other than a signal.
2065 * Since the space reserved for the segment is now
2066 * unused, we stash the errno in the first four
2067 * bytes. This undocumented interface will let us
2068 * understand the nature of the failure.
2069 */
2070 (void) core_write(vp, UIO_SYSSPACE, v[i].p_offset,
2071 &error, sizeof (error), rlimit, credp);
2072
2073 v[i].p_filesz = 0;
2074 v[i].p_flags |= PF_SUNW_FAILURE;
2075 if ((error = core_write(vp, UIO_SYSSPACE,
2076 poffset + sizeof (v[i]) * i, &v[i], sizeof (v[i]),
2077 rlimit, credp)) != 0)
2078 goto done;
2079
2080 continue;
2081 }
2082
2083 /*
2084 * We took a signal. We want to abort the dump entirely, but
2085 * we also want to indicate what failed and why. We therefore
2086 * use the space reserved for the first failing segment to
2087 * write our error (which, for purposes of compatability with
2088 * older core dump readers, we set to EINTR) followed by any
2089 * siginfo associated with the signal.
2090 */
2091 bzero(&killinfo, sizeof (killinfo));
2092 killinfo.prk_error = EINTR;
2093
2094 sq = sig == SIGKILL ? curproc->p_killsqp : lwp->lwp_curinfo;
2095
2096 if (sq != NULL) {
2097 bcopy(&sq->sq_info, &killinfo.prk_info,
2098 sizeof (sq->sq_info));
2099 } else {
2100 killinfo.prk_info.si_signo = lwp->lwp_cursig;
2101 killinfo.prk_info.si_code = SI_NOINFO;
2102 }
2103
2104 #if (defined(_SYSCALL32_IMPL) || defined(_LP64))
2105 /*
2106 * If this is a 32-bit process, we need to translate from the
2107 * native siginfo to the 32-bit variant. (Core readers must
2108 * always have the same data model as their target or must
2109 * be aware of -- and compensate for -- data model differences.)
2110 */
2111 if (curproc->p_model == DATAMODEL_ILP32) {
2112 siginfo32_t si32;
2113
2114 siginfo_kto32((k_siginfo_t *)&killinfo.prk_info, &si32);
2115 bcopy(&si32, &killinfo.prk_info, sizeof (si32));
2116 }
2117 #endif
2118
2119 (void) core_write(vp, UIO_SYSSPACE, v[i].p_offset,
2120 &killinfo, sizeof (killinfo), rlimit, credp);
2121
2122 /*
2123 * For the segment on which we took the signal, indicate that
2124 * its data now refers to a siginfo.
2125 */
2126 v[i].p_filesz = 0;
2127 v[i].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED |
2128 PF_SUNW_SIGINFO;
2129
2130 /*
2131 * And for every other segment, indicate that its absence
2132 * is due to a signal.
2133 */
2134 for (j = i + 1; j < nphdrs; j++) {
2135 v[j].p_filesz = 0;
2136 v[j].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED;
2137 }
2138
2139 /*
2140 * Finally, write out our modified program headers.
2141 */
2142 if ((error = core_write(vp, UIO_SYSSPACE,
2143 poffset + sizeof (v[i]) * i, &v[i],
2144 sizeof (v[i]) * (nphdrs - i), rlimit, credp)) != 0)
2145 goto done;
2146
2147 break;
2148 }
2149
2150 if (nshdrs > 0) {
2151 bzero(&bigwad->shdr[0], shdrsz);
2152
2153 if (nshdrs >= SHN_LORESERVE)
2154 bigwad->shdr[0].sh_size = nshdrs;
2155
2156 if (nshdrs - 1 >= SHN_LORESERVE)
2157 bigwad->shdr[0].sh_link = nshdrs - 1;
2158
2159 if (nphdrs >= PN_XNUM)
2160 bigwad->shdr[0].sh_info = nphdrs;
2161
2162 if (nshdrs > 1) {
2163 AS_LOCK_ENTER(as, RW_WRITER);
2164 if ((error = process_scns(content, p, credp, vp,
2165 &bigwad->shdr[0], nshdrs, rlimit, &doffset,
2166 NULL)) != 0) {
2167 AS_LOCK_EXIT(as);
2168 goto done;
2169 }
2170 AS_LOCK_EXIT(as);
2171 }
2172
2173 if ((error = core_write(vp, UIO_SYSSPACE, soffset,
2174 &bigwad->shdr[0], shdrsz, rlimit, credp)) != 0)
2175 goto done;
2176 }
2177
2178 done:
2179 kmem_free(bigwad, bigsize);
2180 return (error);
2181 }
2182
2183 #ifndef _ELF32_COMPAT
2184
2185 static struct execsw esw = {
2186 #ifdef _LP64
2187 elf64magicstr,
2188 #else /* _LP64 */
2189 elf32magicstr,
2190 #endif /* _LP64 */
2191 0,
2192 5,
2193 elfexec,
2194 elfcore
2195 };
2196
2197 static struct modlexec modlexec = {
2198 &mod_execops, "exec module for elf", &esw
2199 };
2200
2201 #ifdef _LP64
2202 extern int elf32exec(vnode_t *vp, execa_t *uap, uarg_t *args,
2203 intpdata_t *idatap, int level, long *execsz,
2204 int setid, caddr_t exec_file, cred_t *cred,
2205 int brand_action);
2206 extern int elf32core(vnode_t *vp, proc_t *p, cred_t *credp,
2207 rlim64_t rlimit, int sig, core_content_t content);
2208
2209 static struct execsw esw32 = {
2210 elf32magicstr,
2211 0,
2212 5,
2213 elf32exec,
2214 elf32core
2215 };
2216
2217 static struct modlexec modlexec32 = {
2218 &mod_execops, "32-bit exec module for elf", &esw32
2219 };
2220 #endif /* _LP64 */
2221
2222 static struct modlinkage modlinkage = {
2223 MODREV_1,
2224 (void *)&modlexec,
2225 #ifdef _LP64
2226 (void *)&modlexec32,
2227 #endif /* _LP64 */
2228 NULL
2229 };
2230
2231 int
_init(void)2232 _init(void)
2233 {
2234 return (mod_install(&modlinkage));
2235 }
2236
2237 int
_fini(void)2238 _fini(void)
2239 {
2240 return (mod_remove(&modlinkage));
2241 }
2242
2243 int
_info(struct modinfo * modinfop)2244 _info(struct modinfo *modinfop)
2245 {
2246 return (mod_info(&modlinkage, modinfop));
2247 }
2248
2249 #endif /* !_ELF32_COMPAT */
2250