1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved. 24 */ 25 26 /* Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */ 27 /* All Rights Reserved */ 28 /* 29 * Copyright (c) 2019, Joyent, Inc. 30 * Copyright 2021 Oxide Computer Company 31 */ 32 33 #include <sys/types.h> 34 #include <sys/param.h> 35 #include <sys/thread.h> 36 #include <sys/sysmacros.h> 37 #include <sys/signal.h> 38 #include <sys/cred.h> 39 #include <sys/user.h> 40 #include <sys/errno.h> 41 #include <sys/vnode.h> 42 #include <sys/mman.h> 43 #include <sys/kmem.h> 44 #include <sys/proc.h> 45 #include <sys/pathname.h> 46 #include <sys/policy.h> 47 #include <sys/cmn_err.h> 48 #include <sys/systm.h> 49 #include <sys/elf.h> 50 #include <sys/vmsystm.h> 51 #include <sys/debug.h> 52 #include <sys/auxv.h> 53 #include <sys/exec.h> 54 #include <sys/prsystm.h> 55 #include <vm/as.h> 56 #include <vm/rm.h> 57 #include <vm/seg.h> 58 #include <vm/seg_vn.h> 59 #include <sys/modctl.h> 60 #include <sys/systeminfo.h> 61 #include <sys/vmparam.h> 62 #include <sys/machelf.h> 63 #include <sys/shm_impl.h> 64 #include <sys/archsystm.h> 65 #include <sys/fasttrap.h> 66 #include <sys/brand.h> 67 #include "elf_impl.h" 68 #include <sys/sdt.h> 69 #include <sys/siginfo.h> 70 #include <sys/random.h> 71 72 #if defined(__x86) 73 #include <sys/comm_page_util.h> 74 #include <sys/fp.h> 75 #endif /* defined(__x86) */ 76 77 78 extern int at_flags; 79 extern volatile size_t aslr_max_brk_skew; 80 81 #define ORIGIN_STR "ORIGIN" 82 #define ORIGIN_STR_SIZE 6 83 84 static int getelfhead(vnode_t *, cred_t *, Ehdr *, int *, int *, int *); 85 static int getelfphdr(vnode_t *, cred_t *, const Ehdr *, int, caddr_t *, 86 ssize_t *); 87 static int getelfshdr(vnode_t *, cred_t *, const Ehdr *, int, int, caddr_t *, 88 ssize_t *, caddr_t *, ssize_t *); 89 static size_t elfsize(Ehdr *, int, caddr_t, uintptr_t *); 90 static int mapelfexec(vnode_t *, Ehdr *, int, caddr_t, 91 Phdr **, Phdr **, Phdr **, Phdr **, Phdr *, 92 caddr_t *, caddr_t *, intptr_t *, intptr_t *, size_t, long *, size_t *); 93 94 typedef enum { 95 STR_CTF, 96 STR_SYMTAB, 97 STR_DYNSYM, 98 STR_STRTAB, 99 STR_DYNSTR, 100 STR_SHSTRTAB, 101 STR_NUM 102 } shstrtype_t; 103 104 static const char *shstrtab_data[] = { 105 ".SUNW_ctf", 106 ".symtab", 107 ".dynsym", 108 ".strtab", 109 ".dynstr", 110 ".shstrtab" 111 }; 112 113 typedef struct shstrtab { 114 int sst_ndx[STR_NUM]; 115 int sst_cur; 116 } shstrtab_t; 117 118 static void 119 shstrtab_init(shstrtab_t *s) 120 { 121 bzero(&s->sst_ndx, sizeof (s->sst_ndx)); 122 s->sst_cur = 1; 123 } 124 125 static int 126 shstrtab_ndx(shstrtab_t *s, shstrtype_t type) 127 { 128 int ret; 129 130 if ((ret = s->sst_ndx[type]) != 0) 131 return (ret); 132 133 ret = s->sst_ndx[type] = s->sst_cur; 134 s->sst_cur += strlen(shstrtab_data[type]) + 1; 135 136 return (ret); 137 } 138 139 static size_t 140 shstrtab_size(const shstrtab_t *s) 141 { 142 return (s->sst_cur); 143 } 144 145 static void 146 shstrtab_dump(const shstrtab_t *s, char *buf) 147 { 148 int i, ndx; 149 150 *buf = '\0'; 151 for (i = 0; i < STR_NUM; i++) { 152 if ((ndx = s->sst_ndx[i]) != 0) 153 (void) strcpy(buf + ndx, shstrtab_data[i]); 154 } 155 } 156 157 static int 158 dtrace_safe_phdr(Phdr *phdrp, struct uarg *args, uintptr_t base) 159 { 160 ASSERT(phdrp->p_type == PT_SUNWDTRACE); 161 162 /* 163 * See the comment in fasttrap.h for information on how to safely 164 * update this program header. 165 */ 166 if (phdrp->p_memsz < PT_SUNWDTRACE_SIZE || 167 (phdrp->p_flags & (PF_R | PF_W | PF_X)) != (PF_R | PF_W | PF_X)) 168 return (-1); 169 170 args->thrptr = phdrp->p_vaddr + base; 171 172 return (0); 173 } 174 175 static int 176 handle_secflag_dt(proc_t *p, uint_t dt, uint_t val) 177 { 178 uint_t flag; 179 180 switch (dt) { 181 case DT_SUNW_ASLR: 182 flag = PROC_SEC_ASLR; 183 break; 184 default: 185 return (EINVAL); 186 } 187 188 if (val == 0) { 189 if (secflag_isset(p->p_secflags.psf_lower, flag)) 190 return (EPERM); 191 if ((secpolicy_psecflags(CRED(), p, p) != 0) && 192 secflag_isset(p->p_secflags.psf_inherit, flag)) 193 return (EPERM); 194 195 secflag_clear(&p->p_secflags.psf_effective, flag); 196 } else { 197 if (!secflag_isset(p->p_secflags.psf_upper, flag)) 198 return (EPERM); 199 200 if ((secpolicy_psecflags(CRED(), p, p) != 0) && 201 !secflag_isset(p->p_secflags.psf_inherit, flag)) 202 return (EPERM); 203 204 secflag_set(&p->p_secflags.psf_effective, flag); 205 } 206 207 return (0); 208 } 209 210 /* 211 * Map in the executable pointed to by vp. Returns 0 on success. 212 */ 213 int 214 mapexec_brand(vnode_t *vp, uarg_t *args, Ehdr *ehdr, Addr *uphdr_vaddr, 215 intptr_t *voffset, caddr_t exec_file, int *interp, caddr_t *bssbase, 216 caddr_t *brkbase, size_t *brksize, uintptr_t *lddatap) 217 { 218 size_t len; 219 struct vattr vat; 220 caddr_t phdrbase = NULL; 221 ssize_t phdrsize; 222 int nshdrs, shstrndx, nphdrs; 223 int error = 0; 224 Phdr *uphdr = NULL; 225 Phdr *junk = NULL; 226 Phdr *dynphdr = NULL; 227 Phdr *dtrphdr = NULL; 228 uintptr_t lddata; 229 long execsz; 230 intptr_t minaddr; 231 232 if (lddatap != NULL) 233 *lddatap = 0; 234 235 if (error = execpermissions(vp, &vat, args)) { 236 uprintf("%s: Cannot execute %s\n", exec_file, args->pathname); 237 return (error); 238 } 239 240 if ((error = getelfhead(vp, CRED(), ehdr, &nshdrs, &shstrndx, 241 &nphdrs)) != 0 || 242 (error = getelfphdr(vp, CRED(), ehdr, nphdrs, &phdrbase, 243 &phdrsize)) != 0) { 244 uprintf("%s: Cannot read %s\n", exec_file, args->pathname); 245 return (error); 246 } 247 248 if ((len = elfsize(ehdr, nphdrs, phdrbase, &lddata)) == 0) { 249 uprintf("%s: Nothing to load in %s", exec_file, args->pathname); 250 kmem_free(phdrbase, phdrsize); 251 return (ENOEXEC); 252 } 253 if (lddatap != NULL) 254 *lddatap = lddata; 255 256 if (error = mapelfexec(vp, ehdr, nphdrs, phdrbase, &uphdr, &dynphdr, 257 &junk, &dtrphdr, NULL, bssbase, brkbase, voffset, &minaddr, 258 len, &execsz, brksize)) { 259 uprintf("%s: Cannot map %s\n", exec_file, args->pathname); 260 kmem_free(phdrbase, phdrsize); 261 return (error); 262 } 263 264 /* 265 * Inform our caller if the executable needs an interpreter. 266 */ 267 *interp = (dynphdr == NULL) ? 0 : 1; 268 269 /* 270 * If this is a statically linked executable, voffset should indicate 271 * the address of the executable itself (it normally holds the address 272 * of the interpreter). 273 */ 274 if (ehdr->e_type == ET_EXEC && *interp == 0) 275 *voffset = minaddr; 276 277 if (uphdr != NULL) { 278 *uphdr_vaddr = uphdr->p_vaddr; 279 } else { 280 *uphdr_vaddr = (Addr)-1; 281 } 282 283 kmem_free(phdrbase, phdrsize); 284 return (error); 285 } 286 287 /*ARGSUSED*/ 288 int 289 elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap, 290 int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred, 291 int brand_action) 292 { 293 caddr_t phdrbase = NULL; 294 caddr_t bssbase = 0; 295 caddr_t brkbase = 0; 296 size_t brksize = 0; 297 ssize_t dlnsize; 298 aux_entry_t *aux; 299 int error; 300 ssize_t resid; 301 int fd = -1; 302 intptr_t voffset; 303 Phdr *intphdr = NULL; 304 Phdr *dynamicphdr = NULL; 305 Phdr *stphdr = NULL; 306 Phdr *uphdr = NULL; 307 Phdr *junk = NULL; 308 size_t len; 309 size_t i; 310 ssize_t phdrsize; 311 int postfixsize = 0; 312 int hsize; 313 Phdr *phdrp; 314 Phdr *dataphdrp = NULL; 315 Phdr *dtrphdr; 316 Phdr *capphdr = NULL; 317 Cap *cap = NULL; 318 ssize_t capsize; 319 int hasu = 0; 320 int hasauxv = 0; 321 int hasintp = 0; 322 int branded = 0; 323 324 struct proc *p = ttoproc(curthread); 325 struct user *up = PTOU(p); 326 struct bigwad { 327 Ehdr ehdr; 328 aux_entry_t elfargs[__KERN_NAUXV_IMPL]; 329 char dl_name[MAXPATHLEN]; 330 char pathbuf[MAXPATHLEN]; 331 struct vattr vattr; 332 struct execenv exenv; 333 } *bigwad; /* kmem_alloc this behemoth so we don't blow stack */ 334 Ehdr *ehdrp; 335 int nshdrs, shstrndx, nphdrs; 336 char *dlnp; 337 char *pathbufp; 338 rlim64_t limit; 339 rlim64_t roundlimit; 340 341 ASSERT(p->p_model == DATAMODEL_ILP32 || p->p_model == DATAMODEL_LP64); 342 343 bigwad = kmem_alloc(sizeof (struct bigwad), KM_SLEEP); 344 ehdrp = &bigwad->ehdr; 345 dlnp = bigwad->dl_name; 346 pathbufp = bigwad->pathbuf; 347 348 /* 349 * Obtain ELF and program header information. 350 */ 351 if ((error = getelfhead(vp, CRED(), ehdrp, &nshdrs, &shstrndx, 352 &nphdrs)) != 0 || 353 (error = getelfphdr(vp, CRED(), ehdrp, nphdrs, &phdrbase, 354 &phdrsize)) != 0) 355 goto out; 356 357 /* 358 * Prevent executing an ELF file that has no entry point. 359 */ 360 if (ehdrp->e_entry == 0) { 361 uprintf("%s: Bad entry point\n", exec_file); 362 goto bad; 363 } 364 365 /* 366 * Put data model that we're exec-ing to into the args passed to 367 * exec_args(), so it will know what it is copying to on new stack. 368 * Now that we know whether we are exec-ing a 32-bit or 64-bit 369 * executable, we can set execsz with the appropriate NCARGS. 370 */ 371 #ifdef _LP64 372 if (ehdrp->e_ident[EI_CLASS] == ELFCLASS32) { 373 args->to_model = DATAMODEL_ILP32; 374 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS32-1); 375 } else { 376 args->to_model = DATAMODEL_LP64; 377 args->stk_prot &= ~PROT_EXEC; 378 #if defined(__x86) 379 args->dat_prot &= ~PROT_EXEC; 380 #endif 381 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS64-1); 382 } 383 #else /* _LP64 */ 384 args->to_model = DATAMODEL_ILP32; 385 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS-1); 386 #endif /* _LP64 */ 387 388 /* 389 * We delay invoking the brand callback until we've figured out 390 * what kind of elf binary we're trying to run, 32-bit or 64-bit. 391 * We do this because now the brand library can just check 392 * args->to_model to see if the target is 32-bit or 64-bit without 393 * having do duplicate all the code above. 394 * 395 * The level checks associated with brand handling below are used to 396 * prevent a loop since the brand elfexec function typically comes back 397 * through this function. We must check <= here since the nested 398 * handling in the #! interpreter code will increment the level before 399 * calling gexec to run the final elfexec interpreter. 400 */ 401 if ((level <= INTP_MAXDEPTH) && 402 (brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) { 403 error = BROP(p)->b_elfexec(vp, uap, args, 404 idatap, level + 1, execsz, setid, exec_file, cred, 405 brand_action); 406 goto out; 407 } 408 409 /* 410 * Determine aux size now so that stack can be built 411 * in one shot (except actual copyout of aux image), 412 * determine any non-default stack protections, 413 * and still have this code be machine independent. 414 */ 415 hsize = ehdrp->e_phentsize; 416 phdrp = (Phdr *)phdrbase; 417 for (i = nphdrs; i > 0; i--) { 418 switch (phdrp->p_type) { 419 case PT_INTERP: 420 hasauxv = hasintp = 1; 421 break; 422 case PT_PHDR: 423 hasu = 1; 424 break; 425 case PT_SUNWSTACK: 426 args->stk_prot = PROT_USER; 427 if (phdrp->p_flags & PF_R) 428 args->stk_prot |= PROT_READ; 429 if (phdrp->p_flags & PF_W) 430 args->stk_prot |= PROT_WRITE; 431 if (phdrp->p_flags & PF_X) 432 args->stk_prot |= PROT_EXEC; 433 break; 434 case PT_LOAD: 435 dataphdrp = phdrp; 436 break; 437 case PT_SUNWCAP: 438 capphdr = phdrp; 439 break; 440 case PT_DYNAMIC: 441 dynamicphdr = phdrp; 442 break; 443 } 444 phdrp = (Phdr *)((caddr_t)phdrp + hsize); 445 } 446 447 if (ehdrp->e_type != ET_EXEC) { 448 dataphdrp = NULL; 449 hasauxv = 1; 450 } 451 452 /* Copy BSS permissions to args->dat_prot */ 453 if (dataphdrp != NULL) { 454 args->dat_prot = PROT_USER; 455 if (dataphdrp->p_flags & PF_R) 456 args->dat_prot |= PROT_READ; 457 if (dataphdrp->p_flags & PF_W) 458 args->dat_prot |= PROT_WRITE; 459 if (dataphdrp->p_flags & PF_X) 460 args->dat_prot |= PROT_EXEC; 461 } 462 463 /* 464 * If a auxvector will be required - reserve the space for 465 * it now. This may be increased by exec_args if there are 466 * ISA-specific types (included in __KERN_NAUXV_IMPL). 467 */ 468 if (hasauxv) { 469 /* 470 * If a AUX vector is being built - the base AUX 471 * entries are: 472 * 473 * AT_BASE 474 * AT_FLAGS 475 * AT_PAGESZ 476 * AT_SUN_AUXFLAGS 477 * AT_SUN_HWCAP 478 * AT_SUN_HWCAP2 479 * AT_SUN_PLATFORM (added in stk_copyout) 480 * AT_SUN_EXECNAME (added in stk_copyout) 481 * AT_NULL 482 * 483 * total == 9 484 */ 485 if (hasintp && hasu) { 486 /* 487 * Has PT_INTERP & PT_PHDR - the auxvectors that 488 * will be built are: 489 * 490 * AT_PHDR 491 * AT_PHENT 492 * AT_PHNUM 493 * AT_ENTRY 494 * AT_LDDATA 495 * 496 * total = 5 497 */ 498 args->auxsize = (9 + 5) * sizeof (aux_entry_t); 499 } else if (hasintp) { 500 /* 501 * Has PT_INTERP but no PT_PHDR 502 * 503 * AT_EXECFD 504 * AT_LDDATA 505 * 506 * total = 2 507 */ 508 args->auxsize = (9 + 2) * sizeof (aux_entry_t); 509 } else { 510 args->auxsize = 9 * sizeof (aux_entry_t); 511 } 512 } else { 513 args->auxsize = 0; 514 } 515 516 /* 517 * If this binary is using an emulator, we need to add an 518 * AT_SUN_EMULATOR aux entry. 519 */ 520 if (args->emulator != NULL) 521 args->auxsize += sizeof (aux_entry_t); 522 523 /* 524 * On supported kernels (x86_64) make room in the auxv for the 525 * AT_SUN_COMMPAGE entry. This will go unpopulated on i86xpv systems 526 * which do not provide such functionality. 527 * 528 * Additionally cover the floating point information AT_SUN_FPSIZE and 529 * AT_SUN_FPTYPE. 530 */ 531 #if defined(__amd64) 532 args->auxsize += 3 * sizeof (aux_entry_t); 533 #endif /* defined(__amd64) */ 534 535 if ((brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) { 536 branded = 1; 537 /* 538 * We will be adding 4 entries to the aux vectors. One for 539 * the the brandname and 3 for the brand specific aux vectors. 540 */ 541 args->auxsize += 4 * sizeof (aux_entry_t); 542 } 543 544 /* If the binary has an explicit ASLR flag, it must be honoured */ 545 if ((dynamicphdr != NULL) && (dynamicphdr->p_filesz > 0)) { 546 const size_t dynfilesz = dynamicphdr->p_filesz; 547 const size_t dynoffset = dynamicphdr->p_offset; 548 Dyn *dyn, *dp; 549 550 if (dynoffset > MAXOFFSET_T || 551 dynfilesz > MAXOFFSET_T || 552 dynoffset + dynfilesz > MAXOFFSET_T) { 553 uprintf("%s: cannot read full .dynamic section\n", 554 exec_file); 555 error = EINVAL; 556 goto out; 557 } 558 559 #define DYN_STRIDE 100 560 for (i = 0; i < dynfilesz; i += sizeof (*dyn) * DYN_STRIDE) { 561 const size_t remdyns = (dynfilesz - i) / sizeof (*dyn); 562 const size_t ndyns = MIN(DYN_STRIDE, remdyns); 563 const size_t dynsize = ndyns * sizeof (*dyn); 564 565 dyn = kmem_alloc(dynsize, KM_SLEEP); 566 567 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)dyn, 568 (ssize_t)dynsize, (offset_t)(dynoffset + i), 569 UIO_SYSSPACE, 0, (rlim64_t)0, 570 CRED(), &resid)) != 0) { 571 uprintf("%s: cannot read .dynamic section\n", 572 exec_file); 573 goto out; 574 } 575 576 for (dp = dyn; dp < (dyn + ndyns); dp++) { 577 if (dp->d_tag == DT_SUNW_ASLR) { 578 if ((error = handle_secflag_dt(p, 579 DT_SUNW_ASLR, 580 dp->d_un.d_val)) != 0) { 581 uprintf("%s: error setting " 582 "security-flag from " 583 "DT_SUNW_ASLR: %d\n", 584 exec_file, error); 585 goto out; 586 } 587 } 588 } 589 590 kmem_free(dyn, dynsize); 591 } 592 } 593 594 /* Hardware/Software capabilities */ 595 if (capphdr != NULL && 596 (capsize = capphdr->p_filesz) > 0 && 597 capsize <= 16 * sizeof (*cap)) { 598 int ncaps = capsize / sizeof (*cap); 599 Cap *cp; 600 601 cap = kmem_alloc(capsize, KM_SLEEP); 602 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)cap, 603 capsize, (offset_t)capphdr->p_offset, 604 UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid)) != 0) { 605 uprintf("%s: Cannot read capabilities section\n", 606 exec_file); 607 goto out; 608 } 609 for (cp = cap; cp < cap + ncaps; cp++) { 610 if (cp->c_tag == CA_SUNW_SF_1 && 611 (cp->c_un.c_val & SF1_SUNW_ADDR32)) { 612 if (args->to_model == DATAMODEL_LP64) 613 args->addr32 = 1; 614 break; 615 } 616 } 617 } 618 619 aux = bigwad->elfargs; 620 /* 621 * Move args to the user's stack. 622 * This can fill in the AT_SUN_PLATFORM and AT_SUN_EXECNAME aux entries. 623 */ 624 if ((error = exec_args(uap, args, idatap, (void **)&aux)) != 0) { 625 if (error == -1) { 626 error = ENOEXEC; 627 goto bad; 628 } 629 goto out; 630 } 631 /* we're single threaded after this point */ 632 633 /* 634 * If this is an ET_DYN executable (shared object), 635 * determine its memory size so that mapelfexec() can load it. 636 */ 637 if (ehdrp->e_type == ET_DYN) 638 len = elfsize(ehdrp, nphdrs, phdrbase, NULL); 639 else 640 len = 0; 641 642 dtrphdr = NULL; 643 644 if ((error = mapelfexec(vp, ehdrp, nphdrs, phdrbase, &uphdr, &intphdr, 645 &stphdr, &dtrphdr, dataphdrp, &bssbase, &brkbase, &voffset, NULL, 646 len, execsz, &brksize)) != 0) 647 goto bad; 648 649 if (uphdr != NULL && intphdr == NULL) 650 goto bad; 651 652 if (dtrphdr != NULL && dtrace_safe_phdr(dtrphdr, args, voffset) != 0) { 653 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, exec_file); 654 goto bad; 655 } 656 657 if (intphdr != NULL) { 658 size_t len; 659 uintptr_t lddata; 660 char *p; 661 struct vnode *nvp; 662 663 dlnsize = intphdr->p_filesz; 664 665 if (dlnsize > MAXPATHLEN || dlnsize <= 0) 666 goto bad; 667 668 /* 669 * Read in "interpreter" pathname. 670 */ 671 if ((error = vn_rdwr(UIO_READ, vp, dlnp, intphdr->p_filesz, 672 (offset_t)intphdr->p_offset, UIO_SYSSPACE, 0, (rlim64_t)0, 673 CRED(), &resid)) != 0) { 674 uprintf("%s: Cannot obtain interpreter pathname\n", 675 exec_file); 676 goto bad; 677 } 678 679 if (resid != 0 || dlnp[dlnsize - 1] != '\0') 680 goto bad; 681 682 /* 683 * Search for '$ORIGIN' token in interpreter path. 684 * If found, expand it. 685 */ 686 for (p = dlnp; p = strchr(p, '$'); ) { 687 uint_t len, curlen; 688 char *_ptr; 689 690 if (strncmp(++p, ORIGIN_STR, ORIGIN_STR_SIZE)) 691 continue; 692 693 /* 694 * We don't support $ORIGIN on setid programs to close 695 * a potential attack vector. 696 */ 697 if ((setid & EXECSETID_SETID) != 0) { 698 error = ENOEXEC; 699 goto bad; 700 } 701 702 curlen = 0; 703 len = p - dlnp - 1; 704 if (len) { 705 bcopy(dlnp, pathbufp, len); 706 curlen += len; 707 } 708 if (_ptr = strrchr(args->pathname, '/')) { 709 len = _ptr - args->pathname; 710 if ((curlen + len) > MAXPATHLEN) 711 break; 712 713 bcopy(args->pathname, &pathbufp[curlen], len); 714 curlen += len; 715 } else { 716 /* 717 * executable is a basename found in the 718 * current directory. So - just substitue 719 * '.' for ORIGIN. 720 */ 721 pathbufp[curlen] = '.'; 722 curlen++; 723 } 724 p += ORIGIN_STR_SIZE; 725 len = strlen(p); 726 727 if ((curlen + len) > MAXPATHLEN) 728 break; 729 bcopy(p, &pathbufp[curlen], len); 730 curlen += len; 731 pathbufp[curlen++] = '\0'; 732 bcopy(pathbufp, dlnp, curlen); 733 } 734 735 /* 736 * /usr/lib/ld.so.1 is known to be a symlink to /lib/ld.so.1 737 * (and /usr/lib/64/ld.so.1 is a symlink to /lib/64/ld.so.1). 738 * Just in case /usr is not mounted, change it now. 739 */ 740 if (strcmp(dlnp, USR_LIB_RTLD) == 0) 741 dlnp += 4; 742 error = lookupname(dlnp, UIO_SYSSPACE, FOLLOW, NULLVPP, &nvp); 743 if (error && dlnp != bigwad->dl_name) { 744 /* new kernel, old user-level */ 745 error = lookupname(dlnp -= 4, UIO_SYSSPACE, FOLLOW, 746 NULLVPP, &nvp); 747 } 748 if (error) { 749 uprintf("%s: Cannot find %s\n", exec_file, dlnp); 750 goto bad; 751 } 752 753 /* 754 * Setup the "aux" vector. 755 */ 756 if (uphdr) { 757 if (ehdrp->e_type == ET_DYN) { 758 /* don't use the first page */ 759 bigwad->exenv.ex_brkbase = (caddr_t)PAGESIZE; 760 bigwad->exenv.ex_bssbase = (caddr_t)PAGESIZE; 761 } else { 762 bigwad->exenv.ex_bssbase = bssbase; 763 bigwad->exenv.ex_brkbase = brkbase; 764 } 765 bigwad->exenv.ex_brksize = brksize; 766 bigwad->exenv.ex_magic = elfmagic; 767 bigwad->exenv.ex_vp = vp; 768 setexecenv(&bigwad->exenv); 769 770 ADDAUX(aux, AT_PHDR, uphdr->p_vaddr + voffset) 771 ADDAUX(aux, AT_PHENT, ehdrp->e_phentsize) 772 ADDAUX(aux, AT_PHNUM, nphdrs) 773 ADDAUX(aux, AT_ENTRY, ehdrp->e_entry + voffset) 774 } else { 775 if ((error = execopen(&vp, &fd)) != 0) { 776 VN_RELE(nvp); 777 goto bad; 778 } 779 780 ADDAUX(aux, AT_EXECFD, fd) 781 } 782 783 if ((error = execpermissions(nvp, &bigwad->vattr, args)) != 0) { 784 VN_RELE(nvp); 785 uprintf("%s: Cannot execute %s\n", exec_file, dlnp); 786 goto bad; 787 } 788 789 /* 790 * Now obtain the ELF header along with the entire program 791 * header contained in "nvp". 792 */ 793 kmem_free(phdrbase, phdrsize); 794 phdrbase = NULL; 795 if ((error = getelfhead(nvp, CRED(), ehdrp, &nshdrs, 796 &shstrndx, &nphdrs)) != 0 || 797 (error = getelfphdr(nvp, CRED(), ehdrp, nphdrs, &phdrbase, 798 &phdrsize)) != 0) { 799 VN_RELE(nvp); 800 uprintf("%s: Cannot read %s\n", exec_file, dlnp); 801 goto bad; 802 } 803 804 /* 805 * Determine memory size of the "interpreter's" loadable 806 * sections. This size is then used to obtain the virtual 807 * address of a hole, in the user's address space, large 808 * enough to map the "interpreter". 809 */ 810 if ((len = elfsize(ehdrp, nphdrs, phdrbase, &lddata)) == 0) { 811 VN_RELE(nvp); 812 uprintf("%s: Nothing to load in %s\n", exec_file, dlnp); 813 goto bad; 814 } 815 816 dtrphdr = NULL; 817 818 error = mapelfexec(nvp, ehdrp, nphdrs, phdrbase, &junk, &junk, 819 &junk, &dtrphdr, NULL, NULL, NULL, &voffset, NULL, len, 820 execsz, NULL); 821 if (error || junk != NULL) { 822 VN_RELE(nvp); 823 uprintf("%s: Cannot map %s\n", exec_file, dlnp); 824 goto bad; 825 } 826 827 /* 828 * We use the DTrace program header to initialize the 829 * architecture-specific user per-LWP location. The dtrace 830 * fasttrap provider requires ready access to per-LWP scratch 831 * space. We assume that there is only one such program header 832 * in the interpreter. 833 */ 834 if (dtrphdr != NULL && 835 dtrace_safe_phdr(dtrphdr, args, voffset) != 0) { 836 VN_RELE(nvp); 837 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, dlnp); 838 goto bad; 839 } 840 841 VN_RELE(nvp); 842 ADDAUX(aux, AT_SUN_LDDATA, voffset + lddata) 843 } 844 845 if (hasauxv) { 846 int auxf = AF_SUN_HWCAPVERIFY; 847 #if defined(__amd64) 848 size_t fpsize; 849 int fptype; 850 #endif /* defined(__amd64) */ 851 852 /* 853 * Note: AT_SUN_PLATFORM and AT_SUN_EXECNAME were filled in via 854 * exec_args() 855 */ 856 ADDAUX(aux, AT_BASE, voffset) 857 ADDAUX(aux, AT_FLAGS, at_flags) 858 ADDAUX(aux, AT_PAGESZ, PAGESIZE) 859 /* 860 * Linker flags. (security) 861 * p_flag not yet set at this time. 862 * We rely on gexec() to provide us with the information. 863 * If the application is set-uid but this is not reflected 864 * in a mismatch between real/effective uids/gids, then 865 * don't treat this as a set-uid exec. So we care about 866 * the EXECSETID_UGIDS flag but not the ...SETID flag. 867 */ 868 if ((setid &= ~EXECSETID_SETID) != 0) 869 auxf |= AF_SUN_SETUGID; 870 871 /* 872 * If we're running a native process from within a branded 873 * zone under pfexec then we clear the AF_SUN_SETUGID flag so 874 * that the native ld.so.1 is able to link with the native 875 * libraries instead of using the brand libraries that are 876 * installed in the zone. We only do this for processes 877 * which we trust because we see they are already running 878 * under pfexec (where uid != euid). This prevents a 879 * malicious user within the zone from crafting a wrapper to 880 * run native suid commands with unsecure libraries interposed. 881 */ 882 if ((brand_action == EBA_NATIVE) && (PROC_IS_BRANDED(p) && 883 (setid &= ~EXECSETID_SETID) != 0)) 884 auxf &= ~AF_SUN_SETUGID; 885 886 /* 887 * Record the user addr of the auxflags aux vector entry 888 * since brands may optionally want to manipulate this field. 889 */ 890 args->auxp_auxflags = 891 (char *)((char *)args->stackend + 892 ((char *)&aux->a_type - 893 (char *)bigwad->elfargs)); 894 ADDAUX(aux, AT_SUN_AUXFLAGS, auxf); 895 896 /* 897 * Hardware capability flag word (performance hints) 898 * Used for choosing faster library routines. 899 * (Potentially different between 32-bit and 64-bit ABIs) 900 */ 901 #if defined(_LP64) 902 if (args->to_model == DATAMODEL_NATIVE) { 903 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap) 904 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2) 905 } else { 906 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap32) 907 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap32_2) 908 } 909 #else 910 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap) 911 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2) 912 #endif 913 if (branded) { 914 /* 915 * Reserve space for the brand-private aux vectors, 916 * and record the user addr of that space. 917 */ 918 args->auxp_brand = 919 (char *)((char *)args->stackend + 920 ((char *)&aux->a_type - 921 (char *)bigwad->elfargs)); 922 ADDAUX(aux, AT_SUN_BRAND_AUX1, 0) 923 ADDAUX(aux, AT_SUN_BRAND_AUX2, 0) 924 ADDAUX(aux, AT_SUN_BRAND_AUX3, 0) 925 } 926 927 /* 928 * Add the comm page auxv entry, mapping it in if needed. Also 929 * take care of the FPU entries. 930 */ 931 #if defined(__amd64) 932 if (args->commpage != (uintptr_t)NULL || 933 (args->commpage = (uintptr_t)comm_page_mapin()) != 934 (uintptr_t)NULL) { 935 ADDAUX(aux, AT_SUN_COMMPAGE, args->commpage) 936 } else { 937 /* 938 * If the comm page cannot be mapped, pad out the auxv 939 * to satisfy later size checks. 940 */ 941 ADDAUX(aux, AT_NULL, 0) 942 } 943 944 fptype = AT_386_FPINFO_NONE; 945 fpu_auxv_info(&fptype, &fpsize); 946 if (fptype != AT_386_FPINFO_NONE) { 947 ADDAUX(aux, AT_SUN_FPTYPE, fptype) 948 ADDAUX(aux, AT_SUN_FPSIZE, fpsize) 949 } else { 950 ADDAUX(aux, AT_NULL, 0) 951 ADDAUX(aux, AT_NULL, 0) 952 } 953 #endif /* defined(__amd64) */ 954 955 ADDAUX(aux, AT_NULL, 0) 956 postfixsize = (char *)aux - (char *)bigwad->elfargs; 957 958 /* 959 * We make assumptions above when we determine how many aux 960 * vector entries we will be adding. However, if we have an 961 * invalid elf file, it is possible that mapelfexec might 962 * behave differently (but not return an error), in which case 963 * the number of aux entries we actually add will be different. 964 * We detect that now and error out. 965 */ 966 if (postfixsize != args->auxsize) { 967 DTRACE_PROBE2(elfexec_badaux, int, postfixsize, 968 int, args->auxsize); 969 goto bad; 970 } 971 ASSERT(postfixsize <= __KERN_NAUXV_IMPL * sizeof (aux_entry_t)); 972 } 973 974 /* 975 * For the 64-bit kernel, the limit is big enough that rounding it up 976 * to a page can overflow the 64-bit limit, so we check for btopr() 977 * overflowing here by comparing it with the unrounded limit in pages. 978 * If it hasn't overflowed, compare the exec size with the rounded up 979 * limit in pages. Otherwise, just compare with the unrounded limit. 980 */ 981 limit = btop(p->p_vmem_ctl); 982 roundlimit = btopr(p->p_vmem_ctl); 983 if ((roundlimit > limit && *execsz > roundlimit) || 984 (roundlimit < limit && *execsz > limit)) { 985 mutex_enter(&p->p_lock); 986 (void) rctl_action(rctlproc_legacy[RLIMIT_VMEM], p->p_rctls, p, 987 RCA_SAFE); 988 mutex_exit(&p->p_lock); 989 error = ENOMEM; 990 goto bad; 991 } 992 993 bzero(up->u_auxv, sizeof (up->u_auxv)); 994 up->u_commpagep = args->commpage; 995 if (postfixsize) { 996 int num_auxv; 997 998 /* 999 * Copy the aux vector to the user stack. 1000 */ 1001 error = execpoststack(args, bigwad->elfargs, postfixsize); 1002 if (error) 1003 goto bad; 1004 1005 /* 1006 * Copy auxv to the process's user structure for use by /proc. 1007 * If this is a branded process, the brand's exec routine will 1008 * copy it's private entries to the user structure later. It 1009 * relies on the fact that the blank entries are at the end. 1010 */ 1011 num_auxv = postfixsize / sizeof (aux_entry_t); 1012 ASSERT(num_auxv <= sizeof (up->u_auxv) / sizeof (auxv_t)); 1013 aux = bigwad->elfargs; 1014 for (i = 0; i < num_auxv; i++) { 1015 up->u_auxv[i].a_type = aux[i].a_type; 1016 up->u_auxv[i].a_un.a_val = (aux_val_t)aux[i].a_un.a_val; 1017 } 1018 } 1019 1020 /* 1021 * Pass back the starting address so we can set the program counter. 1022 */ 1023 args->entry = (uintptr_t)(ehdrp->e_entry + voffset); 1024 1025 if (!uphdr) { 1026 if (ehdrp->e_type == ET_DYN) { 1027 /* 1028 * If we are executing a shared library which doesn't 1029 * have a interpreter (probably ld.so.1) then 1030 * we don't set the brkbase now. Instead we 1031 * delay it's setting until the first call 1032 * via grow.c::brk(). This permits ld.so.1 to 1033 * initialize brkbase to the tail of the executable it 1034 * loads (which is where it needs to be). 1035 */ 1036 bigwad->exenv.ex_brkbase = (caddr_t)0; 1037 bigwad->exenv.ex_bssbase = (caddr_t)0; 1038 bigwad->exenv.ex_brksize = 0; 1039 } else { 1040 bigwad->exenv.ex_brkbase = brkbase; 1041 bigwad->exenv.ex_bssbase = bssbase; 1042 bigwad->exenv.ex_brksize = brksize; 1043 } 1044 bigwad->exenv.ex_magic = elfmagic; 1045 bigwad->exenv.ex_vp = vp; 1046 setexecenv(&bigwad->exenv); 1047 } 1048 1049 ASSERT(error == 0); 1050 goto out; 1051 1052 bad: 1053 if (fd != -1) /* did we open the a.out yet */ 1054 (void) execclose(fd); 1055 1056 psignal(p, SIGKILL); 1057 1058 if (error == 0) 1059 error = ENOEXEC; 1060 out: 1061 if (phdrbase != NULL) 1062 kmem_free(phdrbase, phdrsize); 1063 if (cap != NULL) 1064 kmem_free(cap, capsize); 1065 kmem_free(bigwad, sizeof (struct bigwad)); 1066 return (error); 1067 } 1068 1069 /* 1070 * Compute the memory size requirement for the ELF file. 1071 */ 1072 static size_t 1073 elfsize(Ehdr *ehdrp, int nphdrs, caddr_t phdrbase, uintptr_t *lddata) 1074 { 1075 size_t len; 1076 Phdr *phdrp = (Phdr *)phdrbase; 1077 int hsize = ehdrp->e_phentsize; 1078 int first = 1; 1079 int dfirst = 1; /* first data segment */ 1080 uintptr_t loaddr = 0; 1081 uintptr_t hiaddr = 0; 1082 uintptr_t lo, hi; 1083 int i; 1084 1085 for (i = nphdrs; i > 0; i--) { 1086 if (phdrp->p_type == PT_LOAD) { 1087 lo = phdrp->p_vaddr; 1088 hi = lo + phdrp->p_memsz; 1089 if (first) { 1090 loaddr = lo; 1091 hiaddr = hi; 1092 first = 0; 1093 } else { 1094 if (loaddr > lo) 1095 loaddr = lo; 1096 if (hiaddr < hi) 1097 hiaddr = hi; 1098 } 1099 1100 /* 1101 * save the address of the first data segment 1102 * of a object - used for the AT_SUNW_LDDATA 1103 * aux entry. 1104 */ 1105 if ((lddata != NULL) && dfirst && 1106 (phdrp->p_flags & PF_W)) { 1107 *lddata = lo; 1108 dfirst = 0; 1109 } 1110 } 1111 phdrp = (Phdr *)((caddr_t)phdrp + hsize); 1112 } 1113 1114 len = hiaddr - (loaddr & PAGEMASK); 1115 len = roundup(len, PAGESIZE); 1116 1117 return (len); 1118 } 1119 1120 /* 1121 * Read in the ELF header and program header table. 1122 * SUSV3 requires: 1123 * ENOEXEC File format is not recognized 1124 * EINVAL Format recognized but execution not supported 1125 */ 1126 static int 1127 getelfhead(vnode_t *vp, cred_t *credp, Ehdr *ehdr, int *nshdrs, int *shstrndx, 1128 int *nphdrs) 1129 { 1130 int error; 1131 ssize_t resid; 1132 1133 /* 1134 * We got here by the first two bytes in ident, 1135 * now read the entire ELF header. 1136 */ 1137 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)ehdr, 1138 sizeof (Ehdr), (offset_t)0, UIO_SYSSPACE, 0, 1139 (rlim64_t)0, credp, &resid)) != 0) 1140 return (error); 1141 1142 /* 1143 * Since a separate version is compiled for handling 32-bit and 1144 * 64-bit ELF executables on a 64-bit kernel, the 64-bit version 1145 * doesn't need to be able to deal with 32-bit ELF files. 1146 */ 1147 if (resid != 0 || 1148 ehdr->e_ident[EI_MAG2] != ELFMAG2 || 1149 ehdr->e_ident[EI_MAG3] != ELFMAG3) 1150 return (ENOEXEC); 1151 1152 if ((ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) || 1153 #if defined(_ILP32) || defined(_ELF32_COMPAT) 1154 ehdr->e_ident[EI_CLASS] != ELFCLASS32 || 1155 #else 1156 ehdr->e_ident[EI_CLASS] != ELFCLASS64 || 1157 #endif 1158 !elfheadcheck(ehdr->e_ident[EI_DATA], ehdr->e_machine, 1159 ehdr->e_flags)) 1160 return (EINVAL); 1161 1162 *nshdrs = ehdr->e_shnum; 1163 *shstrndx = ehdr->e_shstrndx; 1164 *nphdrs = ehdr->e_phnum; 1165 1166 /* 1167 * If e_shnum, e_shstrndx, or e_phnum is its sentinel value, we need 1168 * to read in the section header at index zero to acces the true 1169 * values for those fields. 1170 */ 1171 if ((*nshdrs == 0 && ehdr->e_shoff != 0) || 1172 *shstrndx == SHN_XINDEX || *nphdrs == PN_XNUM) { 1173 Shdr shdr; 1174 1175 if (ehdr->e_shoff == 0) 1176 return (EINVAL); 1177 1178 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)&shdr, 1179 sizeof (shdr), (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, 1180 (rlim64_t)0, credp, &resid)) != 0) 1181 return (error); 1182 1183 if (*nshdrs == 0) 1184 *nshdrs = shdr.sh_size; 1185 if (*shstrndx == SHN_XINDEX) 1186 *shstrndx = shdr.sh_link; 1187 if (*nphdrs == PN_XNUM && shdr.sh_info != 0) 1188 *nphdrs = shdr.sh_info; 1189 } 1190 1191 return (0); 1192 } 1193 1194 #ifdef _ELF32_COMPAT 1195 extern size_t elf_nphdr_max; 1196 #else 1197 size_t elf_nphdr_max = 1000; 1198 #endif 1199 1200 static int 1201 getelfphdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, int nphdrs, 1202 caddr_t *phbasep, ssize_t *phsizep) 1203 { 1204 ssize_t resid, minsize; 1205 int err; 1206 1207 /* 1208 * Since we're going to be using e_phentsize to iterate down the 1209 * array of program headers, it must be 8-byte aligned or else 1210 * a we might cause a misaligned access. We use all members through 1211 * p_flags on 32-bit ELF files and p_memsz on 64-bit ELF files so 1212 * e_phentsize must be at least large enough to include those 1213 * members. 1214 */ 1215 #if !defined(_LP64) || defined(_ELF32_COMPAT) 1216 minsize = offsetof(Phdr, p_flags) + sizeof (((Phdr *)NULL)->p_flags); 1217 #else 1218 minsize = offsetof(Phdr, p_memsz) + sizeof (((Phdr *)NULL)->p_memsz); 1219 #endif 1220 if (ehdr->e_phentsize < minsize || (ehdr->e_phentsize & 3)) 1221 return (EINVAL); 1222 1223 *phsizep = nphdrs * ehdr->e_phentsize; 1224 1225 if (*phsizep > sizeof (Phdr) * elf_nphdr_max) { 1226 if ((*phbasep = kmem_alloc(*phsizep, KM_NOSLEEP)) == NULL) 1227 return (ENOMEM); 1228 } else { 1229 *phbasep = kmem_alloc(*phsizep, KM_SLEEP); 1230 } 1231 1232 if ((err = vn_rdwr(UIO_READ, vp, *phbasep, *phsizep, 1233 (offset_t)ehdr->e_phoff, UIO_SYSSPACE, 0, (rlim64_t)0, 1234 credp, &resid)) != 0) { 1235 kmem_free(*phbasep, *phsizep); 1236 *phbasep = NULL; 1237 return (err); 1238 } 1239 1240 return (0); 1241 } 1242 1243 #ifdef _ELF32_COMPAT 1244 extern size_t elf_nshdr_max; 1245 extern size_t elf_shstrtab_max; 1246 #else 1247 size_t elf_nshdr_max = 10000; 1248 size_t elf_shstrtab_max = 100 * 1024; 1249 #endif 1250 1251 1252 static int 1253 getelfshdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, 1254 int nshdrs, int shstrndx, caddr_t *shbasep, ssize_t *shsizep, 1255 char **shstrbasep, ssize_t *shstrsizep) 1256 { 1257 ssize_t resid, minsize; 1258 int err; 1259 Shdr *shdr; 1260 1261 /* 1262 * Since we're going to be using e_shentsize to iterate down the 1263 * array of section headers, it must be 8-byte aligned or else 1264 * a we might cause a misaligned access. We use all members through 1265 * sh_entsize (on both 32- and 64-bit ELF files) so e_shentsize 1266 * must be at least large enough to include that member. The index 1267 * of the string table section must also be valid. 1268 */ 1269 minsize = offsetof(Shdr, sh_entsize) + sizeof (shdr->sh_entsize); 1270 if (ehdr->e_shentsize < minsize || (ehdr->e_shentsize & 3) || 1271 shstrndx >= nshdrs) 1272 return (EINVAL); 1273 1274 *shsizep = nshdrs * ehdr->e_shentsize; 1275 1276 if (*shsizep > sizeof (Shdr) * elf_nshdr_max) { 1277 if ((*shbasep = kmem_alloc(*shsizep, KM_NOSLEEP)) == NULL) 1278 return (ENOMEM); 1279 } else { 1280 *shbasep = kmem_alloc(*shsizep, KM_SLEEP); 1281 } 1282 1283 if ((err = vn_rdwr(UIO_READ, vp, *shbasep, *shsizep, 1284 (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, (rlim64_t)0, 1285 credp, &resid)) != 0) { 1286 kmem_free(*shbasep, *shsizep); 1287 return (err); 1288 } 1289 1290 /* 1291 * Pull the section string table out of the vnode; fail if the size 1292 * is zero. 1293 */ 1294 shdr = (Shdr *)(*shbasep + shstrndx * ehdr->e_shentsize); 1295 if ((*shstrsizep = shdr->sh_size) == 0) { 1296 kmem_free(*shbasep, *shsizep); 1297 return (EINVAL); 1298 } 1299 1300 if (*shstrsizep > elf_shstrtab_max) { 1301 if ((*shstrbasep = kmem_alloc(*shstrsizep, 1302 KM_NOSLEEP)) == NULL) { 1303 kmem_free(*shbasep, *shsizep); 1304 return (ENOMEM); 1305 } 1306 } else { 1307 *shstrbasep = kmem_alloc(*shstrsizep, KM_SLEEP); 1308 } 1309 1310 if ((err = vn_rdwr(UIO_READ, vp, *shstrbasep, *shstrsizep, 1311 (offset_t)shdr->sh_offset, UIO_SYSSPACE, 0, (rlim64_t)0, 1312 credp, &resid)) != 0) { 1313 kmem_free(*shbasep, *shsizep); 1314 kmem_free(*shstrbasep, *shstrsizep); 1315 return (err); 1316 } 1317 1318 /* 1319 * Make sure the strtab is null-terminated to make sure we 1320 * don't run off the end of the table. 1321 */ 1322 (*shstrbasep)[*shstrsizep - 1] = '\0'; 1323 1324 return (0); 1325 } 1326 1327 static int 1328 mapelfexec( 1329 vnode_t *vp, 1330 Ehdr *ehdr, 1331 int nphdrs, 1332 caddr_t phdrbase, 1333 Phdr **uphdr, 1334 Phdr **intphdr, 1335 Phdr **stphdr, 1336 Phdr **dtphdr, 1337 Phdr *dataphdrp, 1338 caddr_t *bssbase, 1339 caddr_t *brkbase, 1340 intptr_t *voffset, 1341 intptr_t *minaddr, 1342 size_t len, 1343 long *execsz, 1344 size_t *brksize) 1345 { 1346 Phdr *phdr; 1347 int i, prot, error; 1348 caddr_t addr = NULL; 1349 size_t zfodsz; 1350 int ptload = 0; 1351 int page; 1352 off_t offset; 1353 int hsize = ehdr->e_phentsize; 1354 caddr_t mintmp = (caddr_t)-1; 1355 extern int use_brk_lpg; 1356 1357 if (ehdr->e_type == ET_DYN) { 1358 secflagset_t flags = 0; 1359 /* 1360 * Obtain the virtual address of a hole in the 1361 * address space to map the "interpreter". 1362 */ 1363 if (secflag_enabled(curproc, PROC_SEC_ASLR)) 1364 flags |= _MAP_RANDOMIZE; 1365 1366 map_addr(&addr, len, (offset_t)0, 1, flags); 1367 if (addr == NULL) 1368 return (ENOMEM); 1369 *voffset = (intptr_t)addr; 1370 1371 /* 1372 * Calculate the minimum vaddr so it can be subtracted out. 1373 * According to the ELF specification, since PT_LOAD sections 1374 * must be sorted by increasing p_vaddr values, this is 1375 * guaranteed to be the first PT_LOAD section. 1376 */ 1377 phdr = (Phdr *)phdrbase; 1378 for (i = nphdrs; i > 0; i--) { 1379 if (phdr->p_type == PT_LOAD) { 1380 *voffset -= (uintptr_t)phdr->p_vaddr; 1381 break; 1382 } 1383 phdr = (Phdr *)((caddr_t)phdr + hsize); 1384 } 1385 1386 } else { 1387 *voffset = 0; 1388 } 1389 phdr = (Phdr *)phdrbase; 1390 for (i = nphdrs; i > 0; i--) { 1391 switch (phdr->p_type) { 1392 case PT_LOAD: 1393 if ((*intphdr != NULL) && (*uphdr == NULL)) 1394 return (0); 1395 1396 ptload = 1; 1397 prot = PROT_USER; 1398 if (phdr->p_flags & PF_R) 1399 prot |= PROT_READ; 1400 if (phdr->p_flags & PF_W) 1401 prot |= PROT_WRITE; 1402 if (phdr->p_flags & PF_X) 1403 prot |= PROT_EXEC; 1404 1405 addr = (caddr_t)((uintptr_t)phdr->p_vaddr + *voffset); 1406 1407 /* 1408 * Keep track of the segment with the lowest starting 1409 * address. 1410 */ 1411 if (addr < mintmp) 1412 mintmp = addr; 1413 1414 zfodsz = (size_t)phdr->p_memsz - phdr->p_filesz; 1415 1416 offset = phdr->p_offset; 1417 if (((uintptr_t)offset & PAGEOFFSET) == 1418 ((uintptr_t)addr & PAGEOFFSET) && 1419 (!(vp->v_flag & VNOMAP))) { 1420 page = 1; 1421 } else { 1422 page = 0; 1423 } 1424 1425 /* 1426 * Set the heap pagesize for OOB when the bss size 1427 * is known and use_brk_lpg is not 0. 1428 */ 1429 if (brksize != NULL && use_brk_lpg && 1430 zfodsz != 0 && phdr == dataphdrp && 1431 (prot & PROT_WRITE)) { 1432 size_t tlen = P2NPHASE((uintptr_t)addr + 1433 phdr->p_filesz, PAGESIZE); 1434 1435 if (zfodsz > tlen) { 1436 curproc->p_brkpageszc = 1437 page_szc(map_pgsz(MAPPGSZ_HEAP, 1438 curproc, addr + phdr->p_filesz + 1439 tlen, zfodsz - tlen, 0)); 1440 } 1441 } 1442 1443 if (curproc->p_brkpageszc != 0 && phdr == dataphdrp && 1444 (prot & PROT_WRITE)) { 1445 uint_t szc = curproc->p_brkpageszc; 1446 size_t pgsz = page_get_pagesize(szc); 1447 caddr_t ebss = addr + phdr->p_memsz; 1448 /* 1449 * If we need extra space to keep the BSS an 1450 * integral number of pages in size, some of 1451 * that space may fall beyond p_brkbase, so we 1452 * need to set p_brksize to account for it 1453 * being (logically) part of the brk. 1454 */ 1455 size_t extra_zfodsz; 1456 1457 ASSERT(pgsz > PAGESIZE); 1458 1459 extra_zfodsz = P2NPHASE((uintptr_t)ebss, pgsz); 1460 1461 if (error = execmap(vp, addr, phdr->p_filesz, 1462 zfodsz + extra_zfodsz, phdr->p_offset, 1463 prot, page, szc)) 1464 goto bad; 1465 if (brksize != NULL) 1466 *brksize = extra_zfodsz; 1467 } else { 1468 if (error = execmap(vp, addr, phdr->p_filesz, 1469 zfodsz, phdr->p_offset, prot, page, 0)) 1470 goto bad; 1471 } 1472 1473 if (bssbase != NULL && addr >= *bssbase && 1474 phdr == dataphdrp) { 1475 *bssbase = addr + phdr->p_filesz; 1476 } 1477 if (brkbase != NULL && addr >= *brkbase) { 1478 *brkbase = addr + phdr->p_memsz; 1479 } 1480 1481 *execsz += btopr(phdr->p_memsz); 1482 break; 1483 1484 case PT_INTERP: 1485 if (ptload) 1486 goto bad; 1487 *intphdr = phdr; 1488 break; 1489 1490 case PT_SHLIB: 1491 *stphdr = phdr; 1492 break; 1493 1494 case PT_PHDR: 1495 if (ptload) 1496 goto bad; 1497 *uphdr = phdr; 1498 break; 1499 1500 case PT_NULL: 1501 case PT_DYNAMIC: 1502 case PT_NOTE: 1503 break; 1504 1505 case PT_SUNWDTRACE: 1506 if (dtphdr != NULL) 1507 *dtphdr = phdr; 1508 break; 1509 1510 default: 1511 break; 1512 } 1513 phdr = (Phdr *)((caddr_t)phdr + hsize); 1514 } 1515 1516 if (minaddr != NULL) { 1517 ASSERT(mintmp != (caddr_t)-1); 1518 *minaddr = (intptr_t)mintmp; 1519 } 1520 1521 if (brkbase != NULL && secflag_enabled(curproc, PROC_SEC_ASLR)) { 1522 size_t off; 1523 uintptr_t base = (uintptr_t)*brkbase; 1524 uintptr_t oend = base + *brksize; 1525 1526 ASSERT(ISP2(aslr_max_brk_skew)); 1527 1528 (void) random_get_pseudo_bytes((uint8_t *)&off, sizeof (off)); 1529 base += P2PHASE(off, aslr_max_brk_skew); 1530 base = P2ROUNDUP(base, PAGESIZE); 1531 *brkbase = (caddr_t)base; 1532 /* 1533 * Above, we set *brksize to account for the possibility we 1534 * had to grow the 'brk' in padding out the BSS to a page 1535 * boundary. 1536 * 1537 * We now need to adjust that based on where we now are 1538 * actually putting the brk. 1539 */ 1540 if (oend > base) 1541 *brksize = oend - base; 1542 else 1543 *brksize = 0; 1544 } 1545 1546 return (0); 1547 bad: 1548 if (error == 0) 1549 error = EINVAL; 1550 return (error); 1551 } 1552 1553 int 1554 elfnote(vnode_t *vp, offset_t *offsetp, int type, int descsz, void *desc, 1555 rlim64_t rlimit, cred_t *credp) 1556 { 1557 Note note; 1558 int error; 1559 1560 bzero(¬e, sizeof (note)); 1561 bcopy("CORE", note.name, 4); 1562 note.nhdr.n_type = type; 1563 /* 1564 * The System V ABI states that n_namesz must be the length of the 1565 * string that follows the Nhdr structure including the terminating 1566 * null. The ABI also specifies that sufficient padding should be 1567 * included so that the description that follows the name string 1568 * begins on a 4- or 8-byte boundary for 32- and 64-bit binaries 1569 * respectively. However, since this change was not made correctly 1570 * at the time of the 64-bit port, both 32- and 64-bit binaries 1571 * descriptions are only guaranteed to begin on a 4-byte boundary. 1572 */ 1573 note.nhdr.n_namesz = 5; 1574 note.nhdr.n_descsz = roundup(descsz, sizeof (Word)); 1575 1576 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, ¬e, 1577 sizeof (note), rlimit, credp)) 1578 return (error); 1579 1580 *offsetp += sizeof (note); 1581 1582 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, desc, 1583 note.nhdr.n_descsz, rlimit, credp)) 1584 return (error); 1585 1586 *offsetp += note.nhdr.n_descsz; 1587 return (0); 1588 } 1589 1590 /* 1591 * Copy the section data from one vnode to the section of another vnode. 1592 */ 1593 static void 1594 copy_scn(Shdr *src, vnode_t *src_vp, Shdr *dst, vnode_t *dst_vp, Off *doffset, 1595 void *buf, size_t size, cred_t *credp, rlim64_t rlimit) 1596 { 1597 ssize_t resid; 1598 size_t len, n = src->sh_size; 1599 offset_t off = 0; 1600 1601 while (n != 0) { 1602 len = MIN(size, n); 1603 if (vn_rdwr(UIO_READ, src_vp, buf, len, src->sh_offset + off, 1604 UIO_SYSSPACE, 0, (rlim64_t)0, credp, &resid) != 0 || 1605 resid >= len || 1606 core_write(dst_vp, UIO_SYSSPACE, *doffset + off, 1607 buf, len - resid, rlimit, credp) != 0) { 1608 dst->sh_size = 0; 1609 dst->sh_offset = 0; 1610 return; 1611 } 1612 1613 ASSERT(n >= len - resid); 1614 1615 n -= len - resid; 1616 off += len - resid; 1617 } 1618 1619 *doffset += src->sh_size; 1620 } 1621 1622 #ifdef _ELF32_COMPAT 1623 extern size_t elf_datasz_max; 1624 extern size_t elf_zeropg_sz; 1625 #else 1626 size_t elf_datasz_max = 1 * 1024 * 1024; 1627 size_t elf_zeropg_sz = 4 * 1024; 1628 #endif 1629 1630 /* 1631 * This function processes mappings that correspond to load objects to 1632 * examine their respective sections for elfcore(). It's called once with 1633 * v set to NULL to count the number of sections that we're going to need 1634 * and then again with v set to some allocated buffer that we fill in with 1635 * all the section data. 1636 */ 1637 static int 1638 process_scns(core_content_t content, proc_t *p, cred_t *credp, vnode_t *vp, 1639 Shdr *v, int nv, rlim64_t rlimit, Off *doffsetp, int *nshdrsp) 1640 { 1641 vnode_t *lastvp = NULL; 1642 struct seg *seg; 1643 int i, j; 1644 void *data = NULL; 1645 size_t datasz = 0; 1646 shstrtab_t shstrtab; 1647 struct as *as = p->p_as; 1648 int error = 0; 1649 1650 if (v != NULL) 1651 shstrtab_init(&shstrtab); 1652 1653 i = 1; 1654 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) { 1655 uint_t prot; 1656 vnode_t *mvp; 1657 void *tmp = NULL; 1658 caddr_t saddr = seg->s_base; 1659 caddr_t naddr; 1660 caddr_t eaddr; 1661 size_t segsize; 1662 1663 Ehdr ehdr; 1664 int nshdrs, shstrndx, nphdrs; 1665 caddr_t shbase; 1666 ssize_t shsize; 1667 char *shstrbase; 1668 ssize_t shstrsize; 1669 1670 Shdr *shdr; 1671 const char *name; 1672 size_t sz; 1673 uintptr_t off; 1674 1675 int ctf_ndx = 0; 1676 int symtab_ndx = 0; 1677 1678 /* 1679 * Since we're just looking for text segments of load 1680 * objects, we only care about the protection bits; we don't 1681 * care about the actual size of the segment so we use the 1682 * reserved size. If the segment's size is zero, there's 1683 * something fishy going on so we ignore this segment. 1684 */ 1685 if (seg->s_ops != &segvn_ops || 1686 SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 || 1687 mvp == lastvp || mvp == NULL || mvp->v_type != VREG || 1688 (segsize = pr_getsegsize(seg, 1)) == 0) 1689 continue; 1690 1691 eaddr = saddr + segsize; 1692 prot = pr_getprot(seg, 1, &tmp, &saddr, &naddr, eaddr); 1693 pr_getprot_done(&tmp); 1694 1695 /* 1696 * Skip this segment unless the protection bits look like 1697 * what we'd expect for a text segment. 1698 */ 1699 if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC) 1700 continue; 1701 1702 if (getelfhead(mvp, credp, &ehdr, &nshdrs, &shstrndx, 1703 &nphdrs) != 0 || 1704 getelfshdr(mvp, credp, &ehdr, nshdrs, shstrndx, 1705 &shbase, &shsize, &shstrbase, &shstrsize) != 0) 1706 continue; 1707 1708 off = ehdr.e_shentsize; 1709 for (j = 1; j < nshdrs; j++, off += ehdr.e_shentsize) { 1710 Shdr *symtab = NULL, *strtab; 1711 size_t allocsz; 1712 1713 shdr = (Shdr *)(shbase + off); 1714 allocsz = MIN(shdr->sh_size, elf_datasz_max); 1715 1716 if (shdr->sh_name >= shstrsize) 1717 continue; 1718 1719 name = shstrbase + shdr->sh_name; 1720 1721 if (strcmp(name, shstrtab_data[STR_CTF]) == 0) { 1722 if ((content & CC_CONTENT_CTF) == 0 || 1723 ctf_ndx != 0) 1724 continue; 1725 1726 if (shdr->sh_link > 0 && 1727 shdr->sh_link < nshdrs) { 1728 symtab = (Shdr *)(shbase + 1729 shdr->sh_link * ehdr.e_shentsize); 1730 } 1731 1732 if (v != NULL && i < nv - 1) { 1733 if (allocsz > datasz) { 1734 if (data != NULL) 1735 kmem_free(data, datasz); 1736 1737 datasz = allocsz; 1738 data = kmem_alloc(datasz, 1739 KM_SLEEP); 1740 } 1741 1742 v[i].sh_name = shstrtab_ndx(&shstrtab, 1743 STR_CTF); 1744 v[i].sh_addr = (Addr)(uintptr_t)saddr; 1745 v[i].sh_type = SHT_PROGBITS; 1746 v[i].sh_addralign = 4; 1747 *doffsetp = roundup(*doffsetp, 1748 v[i].sh_addralign); 1749 v[i].sh_offset = *doffsetp; 1750 v[i].sh_size = shdr->sh_size; 1751 if (symtab == NULL) { 1752 v[i].sh_link = 0; 1753 } else if (symtab->sh_type == 1754 SHT_SYMTAB && 1755 symtab_ndx != 0) { 1756 v[i].sh_link = 1757 symtab_ndx; 1758 } else { 1759 v[i].sh_link = i + 1; 1760 } 1761 1762 copy_scn(shdr, mvp, &v[i], vp, 1763 doffsetp, data, datasz, credp, 1764 rlimit); 1765 } 1766 1767 ctf_ndx = i++; 1768 1769 /* 1770 * We've already dumped the symtab. 1771 */ 1772 if (symtab != NULL && 1773 symtab->sh_type == SHT_SYMTAB && 1774 symtab_ndx != 0) 1775 continue; 1776 1777 } else if (strcmp(name, 1778 shstrtab_data[STR_SYMTAB]) == 0) { 1779 if ((content & CC_CONTENT_SYMTAB) == 0 || 1780 symtab != 0) 1781 continue; 1782 1783 symtab = shdr; 1784 } 1785 1786 if (symtab != NULL) { 1787 if ((symtab->sh_type != SHT_DYNSYM && 1788 symtab->sh_type != SHT_SYMTAB) || 1789 symtab->sh_link == 0 || 1790 symtab->sh_link >= nshdrs) 1791 continue; 1792 1793 strtab = (Shdr *)(shbase + 1794 symtab->sh_link * ehdr.e_shentsize); 1795 1796 if (strtab->sh_type != SHT_STRTAB) 1797 continue; 1798 1799 if (v != NULL && i < nv - 2) { 1800 sz = MAX(symtab->sh_size, 1801 strtab->sh_size); 1802 allocsz = MIN(sz, elf_datasz_max); 1803 if (allocsz > datasz) { 1804 if (data != NULL) 1805 kmem_free(data, datasz); 1806 1807 datasz = allocsz; 1808 data = kmem_alloc(datasz, 1809 KM_SLEEP); 1810 } 1811 1812 if (symtab->sh_type == SHT_DYNSYM) { 1813 v[i].sh_name = shstrtab_ndx( 1814 &shstrtab, STR_DYNSYM); 1815 v[i + 1].sh_name = shstrtab_ndx( 1816 &shstrtab, STR_DYNSTR); 1817 } else { 1818 v[i].sh_name = shstrtab_ndx( 1819 &shstrtab, STR_SYMTAB); 1820 v[i + 1].sh_name = shstrtab_ndx( 1821 &shstrtab, STR_STRTAB); 1822 } 1823 1824 v[i].sh_type = symtab->sh_type; 1825 v[i].sh_addr = symtab->sh_addr; 1826 if (ehdr.e_type == ET_DYN || 1827 v[i].sh_addr == 0) 1828 v[i].sh_addr += 1829 (Addr)(uintptr_t)saddr; 1830 v[i].sh_addralign = 1831 symtab->sh_addralign; 1832 *doffsetp = roundup(*doffsetp, 1833 v[i].sh_addralign); 1834 v[i].sh_offset = *doffsetp; 1835 v[i].sh_size = symtab->sh_size; 1836 v[i].sh_link = i + 1; 1837 v[i].sh_entsize = symtab->sh_entsize; 1838 v[i].sh_info = symtab->sh_info; 1839 1840 copy_scn(symtab, mvp, &v[i], vp, 1841 doffsetp, data, datasz, credp, 1842 rlimit); 1843 1844 v[i + 1].sh_type = SHT_STRTAB; 1845 v[i + 1].sh_flags = SHF_STRINGS; 1846 v[i + 1].sh_addr = symtab->sh_addr; 1847 if (ehdr.e_type == ET_DYN || 1848 v[i + 1].sh_addr == 0) 1849 v[i + 1].sh_addr += 1850 (Addr)(uintptr_t)saddr; 1851 v[i + 1].sh_addralign = 1852 strtab->sh_addralign; 1853 *doffsetp = roundup(*doffsetp, 1854 v[i + 1].sh_addralign); 1855 v[i + 1].sh_offset = *doffsetp; 1856 v[i + 1].sh_size = strtab->sh_size; 1857 1858 copy_scn(strtab, mvp, &v[i + 1], vp, 1859 doffsetp, data, datasz, credp, 1860 rlimit); 1861 } 1862 1863 if (symtab->sh_type == SHT_SYMTAB) 1864 symtab_ndx = i; 1865 i += 2; 1866 } 1867 } 1868 1869 kmem_free(shstrbase, shstrsize); 1870 kmem_free(shbase, shsize); 1871 1872 lastvp = mvp; 1873 } 1874 1875 if (v == NULL) { 1876 if (i == 1) 1877 *nshdrsp = 0; 1878 else 1879 *nshdrsp = i + 1; 1880 goto done; 1881 } 1882 1883 if (i != nv - 1) { 1884 cmn_err(CE_WARN, "elfcore: core dump failed for " 1885 "process %d; address space is changing", p->p_pid); 1886 error = EIO; 1887 goto done; 1888 } 1889 1890 v[i].sh_name = shstrtab_ndx(&shstrtab, STR_SHSTRTAB); 1891 v[i].sh_size = shstrtab_size(&shstrtab); 1892 v[i].sh_addralign = 1; 1893 *doffsetp = roundup(*doffsetp, v[i].sh_addralign); 1894 v[i].sh_offset = *doffsetp; 1895 v[i].sh_flags = SHF_STRINGS; 1896 v[i].sh_type = SHT_STRTAB; 1897 1898 if (v[i].sh_size > datasz) { 1899 if (data != NULL) 1900 kmem_free(data, datasz); 1901 1902 datasz = v[i].sh_size; 1903 data = kmem_alloc(datasz, 1904 KM_SLEEP); 1905 } 1906 1907 shstrtab_dump(&shstrtab, data); 1908 1909 if ((error = core_write(vp, UIO_SYSSPACE, *doffsetp, 1910 data, v[i].sh_size, rlimit, credp)) != 0) 1911 goto done; 1912 1913 *doffsetp += v[i].sh_size; 1914 1915 done: 1916 if (data != NULL) 1917 kmem_free(data, datasz); 1918 1919 return (error); 1920 } 1921 1922 int 1923 elfcore(vnode_t *vp, proc_t *p, cred_t *credp, rlim64_t rlimit, int sig, 1924 core_content_t content) 1925 { 1926 offset_t poffset, soffset; 1927 Off doffset; 1928 int error, i, nphdrs, nshdrs; 1929 int overflow = 0; 1930 struct seg *seg; 1931 struct as *as = p->p_as; 1932 union { 1933 Ehdr ehdr; 1934 Phdr phdr[1]; 1935 Shdr shdr[1]; 1936 } *bigwad; 1937 size_t bigsize; 1938 size_t phdrsz, shdrsz; 1939 Ehdr *ehdr; 1940 Phdr *v; 1941 void *zeropg = NULL; 1942 caddr_t brkbase; 1943 size_t brksize; 1944 caddr_t stkbase; 1945 size_t stksize; 1946 int ntries = 0; 1947 klwp_t *lwp = ttolwp(curthread); 1948 1949 top: 1950 /* 1951 * Make sure we have everything we need (registers, etc.). 1952 * All other lwps have already stopped and are in an orderly state. 1953 */ 1954 ASSERT(p == ttoproc(curthread)); 1955 prstop(0, 0); 1956 1957 AS_LOCK_ENTER(as, RW_WRITER); 1958 nphdrs = prnsegs(as, 0) + 2; /* two CORE note sections */ 1959 1960 /* 1961 * Count the number of section headers we're going to need. 1962 */ 1963 nshdrs = 0; 1964 if (content & (CC_CONTENT_CTF | CC_CONTENT_SYMTAB)) { 1965 (void) process_scns(content, p, credp, NULL, NULL, 0, 0, 1966 NULL, &nshdrs); 1967 } 1968 AS_LOCK_EXIT(as); 1969 1970 ASSERT(nshdrs == 0 || nshdrs > 1); 1971 1972 /* 1973 * The core file contents may required zero section headers, but if 1974 * we overflow the 16 bits allotted to the program header count in 1975 * the ELF header, we'll need that program header at index zero. 1976 */ 1977 if (nshdrs == 0 && nphdrs >= PN_XNUM) 1978 nshdrs = 1; 1979 1980 phdrsz = nphdrs * sizeof (Phdr); 1981 shdrsz = nshdrs * sizeof (Shdr); 1982 1983 bigsize = MAX(sizeof (*bigwad), MAX(phdrsz, shdrsz)); 1984 bigwad = kmem_alloc(bigsize, KM_SLEEP); 1985 1986 ehdr = &bigwad->ehdr; 1987 bzero(ehdr, sizeof (*ehdr)); 1988 1989 ehdr->e_ident[EI_MAG0] = ELFMAG0; 1990 ehdr->e_ident[EI_MAG1] = ELFMAG1; 1991 ehdr->e_ident[EI_MAG2] = ELFMAG2; 1992 ehdr->e_ident[EI_MAG3] = ELFMAG3; 1993 ehdr->e_ident[EI_CLASS] = ELFCLASS; 1994 ehdr->e_type = ET_CORE; 1995 1996 #if !defined(_LP64) || defined(_ELF32_COMPAT) 1997 1998 #if defined(__sparc) 1999 ehdr->e_ident[EI_DATA] = ELFDATA2MSB; 2000 ehdr->e_machine = EM_SPARC; 2001 #elif defined(__i386_COMPAT) 2002 ehdr->e_ident[EI_DATA] = ELFDATA2LSB; 2003 ehdr->e_machine = EM_386; 2004 #else 2005 #error "no recognized machine type is defined" 2006 #endif 2007 2008 #else /* !defined(_LP64) || defined(_ELF32_COMPAT) */ 2009 2010 #if defined(__sparc) 2011 ehdr->e_ident[EI_DATA] = ELFDATA2MSB; 2012 ehdr->e_machine = EM_SPARCV9; 2013 #elif defined(__amd64) 2014 ehdr->e_ident[EI_DATA] = ELFDATA2LSB; 2015 ehdr->e_machine = EM_AMD64; 2016 #else 2017 #error "no recognized 64-bit machine type is defined" 2018 #endif 2019 2020 #endif /* !defined(_LP64) || defined(_ELF32_COMPAT) */ 2021 2022 /* 2023 * If the count of program headers or section headers or the index 2024 * of the section string table can't fit in the mere 16 bits 2025 * shortsightedly allotted to them in the ELF header, we use the 2026 * extended formats and put the real values in the section header 2027 * as index 0. 2028 */ 2029 ehdr->e_ident[EI_VERSION] = EV_CURRENT; 2030 ehdr->e_version = EV_CURRENT; 2031 ehdr->e_ehsize = sizeof (Ehdr); 2032 2033 if (nphdrs >= PN_XNUM) 2034 ehdr->e_phnum = PN_XNUM; 2035 else 2036 ehdr->e_phnum = (unsigned short)nphdrs; 2037 2038 ehdr->e_phoff = sizeof (Ehdr); 2039 ehdr->e_phentsize = sizeof (Phdr); 2040 2041 if (nshdrs > 0) { 2042 if (nshdrs >= SHN_LORESERVE) 2043 ehdr->e_shnum = 0; 2044 else 2045 ehdr->e_shnum = (unsigned short)nshdrs; 2046 2047 if (nshdrs - 1 >= SHN_LORESERVE) 2048 ehdr->e_shstrndx = SHN_XINDEX; 2049 else 2050 ehdr->e_shstrndx = (unsigned short)(nshdrs - 1); 2051 2052 ehdr->e_shoff = ehdr->e_phoff + ehdr->e_phentsize * nphdrs; 2053 ehdr->e_shentsize = sizeof (Shdr); 2054 } 2055 2056 if (error = core_write(vp, UIO_SYSSPACE, (offset_t)0, ehdr, 2057 sizeof (Ehdr), rlimit, credp)) 2058 goto done; 2059 2060 poffset = sizeof (Ehdr); 2061 soffset = sizeof (Ehdr) + phdrsz; 2062 doffset = sizeof (Ehdr) + phdrsz + shdrsz; 2063 2064 v = &bigwad->phdr[0]; 2065 bzero(v, phdrsz); 2066 2067 setup_old_note_header(&v[0], p); 2068 v[0].p_offset = doffset = roundup(doffset, sizeof (Word)); 2069 doffset += v[0].p_filesz; 2070 2071 setup_note_header(&v[1], p); 2072 v[1].p_offset = doffset = roundup(doffset, sizeof (Word)); 2073 doffset += v[1].p_filesz; 2074 2075 mutex_enter(&p->p_lock); 2076 2077 brkbase = p->p_brkbase; 2078 brksize = p->p_brksize; 2079 2080 stkbase = p->p_usrstack - p->p_stksize; 2081 stksize = p->p_stksize; 2082 2083 mutex_exit(&p->p_lock); 2084 2085 AS_LOCK_ENTER(as, RW_WRITER); 2086 i = 2; 2087 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) { 2088 caddr_t eaddr = seg->s_base + pr_getsegsize(seg, 0); 2089 caddr_t saddr, naddr; 2090 void *tmp = NULL; 2091 extern struct seg_ops segspt_shmops; 2092 2093 if ((seg->s_flags & S_HOLE) != 0) { 2094 continue; 2095 } 2096 2097 for (saddr = seg->s_base; saddr < eaddr; saddr = naddr) { 2098 uint_t prot; 2099 size_t size; 2100 int type; 2101 vnode_t *mvp; 2102 2103 prot = pr_getprot(seg, 0, &tmp, &saddr, &naddr, eaddr); 2104 prot &= PROT_READ | PROT_WRITE | PROT_EXEC; 2105 if ((size = (size_t)(naddr - saddr)) == 0) 2106 continue; 2107 if (i == nphdrs) { 2108 overflow++; 2109 continue; 2110 } 2111 v[i].p_type = PT_LOAD; 2112 v[i].p_vaddr = (Addr)(uintptr_t)saddr; 2113 v[i].p_memsz = size; 2114 if (prot & PROT_READ) 2115 v[i].p_flags |= PF_R; 2116 if (prot & PROT_WRITE) 2117 v[i].p_flags |= PF_W; 2118 if (prot & PROT_EXEC) 2119 v[i].p_flags |= PF_X; 2120 2121 /* 2122 * Figure out which mappings to include in the core. 2123 */ 2124 type = SEGOP_GETTYPE(seg, saddr); 2125 2126 if (saddr == stkbase && size == stksize) { 2127 if (!(content & CC_CONTENT_STACK)) 2128 goto exclude; 2129 2130 } else if (saddr == brkbase && size == brksize) { 2131 if (!(content & CC_CONTENT_HEAP)) 2132 goto exclude; 2133 2134 } else if (seg->s_ops == &segspt_shmops) { 2135 if (type & MAP_NORESERVE) { 2136 if (!(content & CC_CONTENT_DISM)) 2137 goto exclude; 2138 } else { 2139 if (!(content & CC_CONTENT_ISM)) 2140 goto exclude; 2141 } 2142 2143 } else if (seg->s_ops != &segvn_ops) { 2144 goto exclude; 2145 2146 } else if (type & MAP_SHARED) { 2147 if (shmgetid(p, saddr) != SHMID_NONE) { 2148 if (!(content & CC_CONTENT_SHM)) 2149 goto exclude; 2150 2151 } else if (SEGOP_GETVP(seg, seg->s_base, 2152 &mvp) != 0 || mvp == NULL || 2153 mvp->v_type != VREG) { 2154 if (!(content & CC_CONTENT_SHANON)) 2155 goto exclude; 2156 2157 } else { 2158 if (!(content & CC_CONTENT_SHFILE)) 2159 goto exclude; 2160 } 2161 2162 } else if (SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 || 2163 mvp == NULL || mvp->v_type != VREG) { 2164 if (!(content & CC_CONTENT_ANON)) 2165 goto exclude; 2166 2167 } else if (prot == (PROT_READ | PROT_EXEC)) { 2168 if (!(content & CC_CONTENT_TEXT)) 2169 goto exclude; 2170 2171 } else if (prot == PROT_READ) { 2172 if (!(content & CC_CONTENT_RODATA)) 2173 goto exclude; 2174 2175 } else { 2176 if (!(content & CC_CONTENT_DATA)) 2177 goto exclude; 2178 } 2179 2180 doffset = roundup(doffset, sizeof (Word)); 2181 v[i].p_offset = doffset; 2182 v[i].p_filesz = size; 2183 doffset += size; 2184 exclude: 2185 i++; 2186 } 2187 ASSERT(tmp == NULL); 2188 } 2189 AS_LOCK_EXIT(as); 2190 2191 if (overflow || i != nphdrs) { 2192 if (ntries++ == 0) { 2193 kmem_free(bigwad, bigsize); 2194 overflow = 0; 2195 goto top; 2196 } 2197 cmn_err(CE_WARN, "elfcore: core dump failed for " 2198 "process %d; address space is changing", p->p_pid); 2199 error = EIO; 2200 goto done; 2201 } 2202 2203 if ((error = core_write(vp, UIO_SYSSPACE, poffset, 2204 v, phdrsz, rlimit, credp)) != 0) 2205 goto done; 2206 2207 if ((error = write_old_elfnotes(p, sig, vp, v[0].p_offset, rlimit, 2208 credp)) != 0) 2209 goto done; 2210 2211 if ((error = write_elfnotes(p, sig, vp, v[1].p_offset, rlimit, 2212 credp, content)) != 0) 2213 goto done; 2214 2215 for (i = 2; i < nphdrs; i++) { 2216 prkillinfo_t killinfo; 2217 sigqueue_t *sq; 2218 int sig, j; 2219 2220 if (v[i].p_filesz == 0) 2221 continue; 2222 2223 /* 2224 * If we hit a region that was mapped PROT_NONE then we cannot 2225 * continue dumping this normally as the kernel would be unable 2226 * to read from the page and that would result in us failing to 2227 * dump the page. As such, any region mapped PROT_NONE, we dump 2228 * as a zero-filled page such that this is still represented in 2229 * the map. 2230 * 2231 * If dumping out this segment fails, rather than failing 2232 * the core dump entirely, we reset the size of the mapping 2233 * to zero to indicate that the data is absent from the core 2234 * file and or in the PF_SUNW_FAILURE flag to differentiate 2235 * this from mappings that were excluded due to the core file 2236 * content settings. 2237 */ 2238 if ((v[i].p_flags & (PF_R | PF_W | PF_X)) == 0) { 2239 size_t towrite = v[i].p_filesz; 2240 size_t curoff = 0; 2241 2242 if (zeropg == NULL) { 2243 zeropg = kmem_zalloc(elf_zeropg_sz, KM_SLEEP); 2244 } 2245 2246 error = 0; 2247 while (towrite != 0) { 2248 size_t len = MIN(towrite, elf_zeropg_sz); 2249 2250 error = core_write(vp, UIO_SYSSPACE, 2251 v[i].p_offset + curoff, zeropg, len, rlimit, 2252 credp); 2253 if (error != 0) 2254 break; 2255 2256 towrite -= len; 2257 curoff += len; 2258 } 2259 2260 if (error == 0) 2261 continue; 2262 } else { 2263 error = core_seg(p, vp, v[i].p_offset, 2264 (caddr_t)(uintptr_t)v[i].p_vaddr, v[i].p_filesz, 2265 rlimit, credp); 2266 if (error == 0) 2267 continue; 2268 } 2269 2270 if ((sig = lwp->lwp_cursig) == 0) { 2271 /* 2272 * We failed due to something other than a signal. 2273 * Since the space reserved for the segment is now 2274 * unused, we stash the errno in the first four 2275 * bytes. This undocumented interface will let us 2276 * understand the nature of the failure. 2277 */ 2278 (void) core_write(vp, UIO_SYSSPACE, v[i].p_offset, 2279 &error, sizeof (error), rlimit, credp); 2280 2281 v[i].p_filesz = 0; 2282 v[i].p_flags |= PF_SUNW_FAILURE; 2283 if ((error = core_write(vp, UIO_SYSSPACE, 2284 poffset + sizeof (v[i]) * i, &v[i], sizeof (v[i]), 2285 rlimit, credp)) != 0) 2286 goto done; 2287 2288 continue; 2289 } 2290 2291 /* 2292 * We took a signal. We want to abort the dump entirely, but 2293 * we also want to indicate what failed and why. We therefore 2294 * use the space reserved for the first failing segment to 2295 * write our error (which, for purposes of compatability with 2296 * older core dump readers, we set to EINTR) followed by any 2297 * siginfo associated with the signal. 2298 */ 2299 bzero(&killinfo, sizeof (killinfo)); 2300 killinfo.prk_error = EINTR; 2301 2302 sq = sig == SIGKILL ? curproc->p_killsqp : lwp->lwp_curinfo; 2303 2304 if (sq != NULL) { 2305 bcopy(&sq->sq_info, &killinfo.prk_info, 2306 sizeof (sq->sq_info)); 2307 } else { 2308 killinfo.prk_info.si_signo = lwp->lwp_cursig; 2309 killinfo.prk_info.si_code = SI_NOINFO; 2310 } 2311 2312 #if (defined(_SYSCALL32_IMPL) || defined(_LP64)) 2313 /* 2314 * If this is a 32-bit process, we need to translate from the 2315 * native siginfo to the 32-bit variant. (Core readers must 2316 * always have the same data model as their target or must 2317 * be aware of -- and compensate for -- data model differences.) 2318 */ 2319 if (curproc->p_model == DATAMODEL_ILP32) { 2320 siginfo32_t si32; 2321 2322 siginfo_kto32((k_siginfo_t *)&killinfo.prk_info, &si32); 2323 bcopy(&si32, &killinfo.prk_info, sizeof (si32)); 2324 } 2325 #endif 2326 2327 (void) core_write(vp, UIO_SYSSPACE, v[i].p_offset, 2328 &killinfo, sizeof (killinfo), rlimit, credp); 2329 2330 /* 2331 * For the segment on which we took the signal, indicate that 2332 * its data now refers to a siginfo. 2333 */ 2334 v[i].p_filesz = 0; 2335 v[i].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED | 2336 PF_SUNW_SIGINFO; 2337 2338 /* 2339 * And for every other segment, indicate that its absence 2340 * is due to a signal. 2341 */ 2342 for (j = i + 1; j < nphdrs; j++) { 2343 v[j].p_filesz = 0; 2344 v[j].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED; 2345 } 2346 2347 /* 2348 * Finally, write out our modified program headers. 2349 */ 2350 if ((error = core_write(vp, UIO_SYSSPACE, 2351 poffset + sizeof (v[i]) * i, &v[i], 2352 sizeof (v[i]) * (nphdrs - i), rlimit, credp)) != 0) 2353 goto done; 2354 2355 break; 2356 } 2357 2358 if (nshdrs > 0) { 2359 bzero(&bigwad->shdr[0], shdrsz); 2360 2361 if (nshdrs >= SHN_LORESERVE) 2362 bigwad->shdr[0].sh_size = nshdrs; 2363 2364 if (nshdrs - 1 >= SHN_LORESERVE) 2365 bigwad->shdr[0].sh_link = nshdrs - 1; 2366 2367 if (nphdrs >= PN_XNUM) 2368 bigwad->shdr[0].sh_info = nphdrs; 2369 2370 if (nshdrs > 1) { 2371 AS_LOCK_ENTER(as, RW_WRITER); 2372 if ((error = process_scns(content, p, credp, vp, 2373 &bigwad->shdr[0], nshdrs, rlimit, &doffset, 2374 NULL)) != 0) { 2375 AS_LOCK_EXIT(as); 2376 goto done; 2377 } 2378 AS_LOCK_EXIT(as); 2379 } 2380 2381 if ((error = core_write(vp, UIO_SYSSPACE, soffset, 2382 &bigwad->shdr[0], shdrsz, rlimit, credp)) != 0) 2383 goto done; 2384 } 2385 2386 done: 2387 if (zeropg != NULL) { 2388 kmem_free(zeropg, elf_zeropg_sz); 2389 } 2390 kmem_free(bigwad, bigsize); 2391 return (error); 2392 } 2393 2394 #ifndef _ELF32_COMPAT 2395 2396 static struct execsw esw = { 2397 #ifdef _LP64 2398 elf64magicstr, 2399 #else /* _LP64 */ 2400 elf32magicstr, 2401 #endif /* _LP64 */ 2402 0, 2403 5, 2404 elfexec, 2405 elfcore 2406 }; 2407 2408 static struct modlexec modlexec = { 2409 &mod_execops, "exec module for elf", &esw 2410 }; 2411 2412 #ifdef _LP64 2413 extern int elf32exec(vnode_t *vp, execa_t *uap, uarg_t *args, 2414 intpdata_t *idatap, int level, long *execsz, 2415 int setid, caddr_t exec_file, cred_t *cred, 2416 int brand_action); 2417 extern int elf32core(vnode_t *vp, proc_t *p, cred_t *credp, 2418 rlim64_t rlimit, int sig, core_content_t content); 2419 2420 static struct execsw esw32 = { 2421 elf32magicstr, 2422 0, 2423 5, 2424 elf32exec, 2425 elf32core 2426 }; 2427 2428 static struct modlexec modlexec32 = { 2429 &mod_execops, "32-bit exec module for elf", &esw32 2430 }; 2431 #endif /* _LP64 */ 2432 2433 static struct modlinkage modlinkage = { 2434 MODREV_1, 2435 (void *)&modlexec, 2436 #ifdef _LP64 2437 (void *)&modlexec32, 2438 #endif /* _LP64 */ 2439 NULL 2440 }; 2441 2442 int 2443 _init(void) 2444 { 2445 return (mod_install(&modlinkage)); 2446 } 2447 2448 int 2449 _fini(void) 2450 { 2451 return (mod_remove(&modlinkage)); 2452 } 2453 2454 int 2455 _info(struct modinfo *modinfop) 2456 { 2457 return (mod_info(&modlinkage, modinfop)); 2458 } 2459 2460 #endif /* !_ELF32_COMPAT */ 2461