xref: /illumos-gate/usr/src/uts/common/exec/elf/elf.c (revision 7d1eae8c55720848a7a807e8b76f4b8c7e339af3)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
24  */
25 
26 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
27 /*	  All Rights Reserved  	*/
28 /*
29  * Copyright (c) 2018, Joyent, Inc.
30  */
31 
32 #include <sys/types.h>
33 #include <sys/param.h>
34 #include <sys/thread.h>
35 #include <sys/sysmacros.h>
36 #include <sys/signal.h>
37 #include <sys/cred.h>
38 #include <sys/user.h>
39 #include <sys/errno.h>
40 #include <sys/vnode.h>
41 #include <sys/mman.h>
42 #include <sys/kmem.h>
43 #include <sys/proc.h>
44 #include <sys/pathname.h>
45 #include <sys/policy.h>
46 #include <sys/cmn_err.h>
47 #include <sys/systm.h>
48 #include <sys/elf.h>
49 #include <sys/vmsystm.h>
50 #include <sys/debug.h>
51 #include <sys/auxv.h>
52 #include <sys/exec.h>
53 #include <sys/prsystm.h>
54 #include <vm/as.h>
55 #include <vm/rm.h>
56 #include <vm/seg.h>
57 #include <vm/seg_vn.h>
58 #include <sys/modctl.h>
59 #include <sys/systeminfo.h>
60 #include <sys/vmparam.h>
61 #include <sys/machelf.h>
62 #include <sys/shm_impl.h>
63 #include <sys/archsystm.h>
64 #include <sys/fasttrap.h>
65 #include <sys/brand.h>
66 #include "elf_impl.h"
67 #include <sys/sdt.h>
68 #include <sys/siginfo.h>
69 #include <sys/random.h>
70 
71 #if defined(__x86)
72 #include <sys/comm_page_util.h>
73 #include <sys/fp.h>
74 #endif /* defined(__x86) */
75 
76 
77 extern int at_flags;
78 extern volatile size_t aslr_max_brk_skew;
79 
80 #define	ORIGIN_STR	"ORIGIN"
81 #define	ORIGIN_STR_SIZE	6
82 
83 static int getelfhead(vnode_t *, cred_t *, Ehdr *, int *, int *, int *);
84 static int getelfphdr(vnode_t *, cred_t *, const Ehdr *, int, caddr_t *,
85     ssize_t *);
86 static int getelfshdr(vnode_t *, cred_t *, const Ehdr *, int, int, caddr_t *,
87     ssize_t *, caddr_t *, ssize_t *);
88 static size_t elfsize(Ehdr *, int, caddr_t, uintptr_t *);
89 static int mapelfexec(vnode_t *, Ehdr *, int, caddr_t,
90     Phdr **, Phdr **, Phdr **, Phdr **, Phdr *,
91     caddr_t *, caddr_t *, intptr_t *, intptr_t *, size_t, long *, size_t *);
92 
93 typedef enum {
94 	STR_CTF,
95 	STR_SYMTAB,
96 	STR_DYNSYM,
97 	STR_STRTAB,
98 	STR_DYNSTR,
99 	STR_SHSTRTAB,
100 	STR_NUM
101 } shstrtype_t;
102 
103 static const char *shstrtab_data[] = {
104 	".SUNW_ctf",
105 	".symtab",
106 	".dynsym",
107 	".strtab",
108 	".dynstr",
109 	".shstrtab"
110 };
111 
112 typedef struct shstrtab {
113 	int	sst_ndx[STR_NUM];
114 	int	sst_cur;
115 } shstrtab_t;
116 
117 static void
118 shstrtab_init(shstrtab_t *s)
119 {
120 	bzero(&s->sst_ndx, sizeof (s->sst_ndx));
121 	s->sst_cur = 1;
122 }
123 
124 static int
125 shstrtab_ndx(shstrtab_t *s, shstrtype_t type)
126 {
127 	int ret;
128 
129 	if ((ret = s->sst_ndx[type]) != 0)
130 		return (ret);
131 
132 	ret = s->sst_ndx[type] = s->sst_cur;
133 	s->sst_cur += strlen(shstrtab_data[type]) + 1;
134 
135 	return (ret);
136 }
137 
138 static size_t
139 shstrtab_size(const shstrtab_t *s)
140 {
141 	return (s->sst_cur);
142 }
143 
144 static void
145 shstrtab_dump(const shstrtab_t *s, char *buf)
146 {
147 	int i, ndx;
148 
149 	*buf = '\0';
150 	for (i = 0; i < STR_NUM; i++) {
151 		if ((ndx = s->sst_ndx[i]) != 0)
152 			(void) strcpy(buf + ndx, shstrtab_data[i]);
153 	}
154 }
155 
156 static int
157 dtrace_safe_phdr(Phdr *phdrp, struct uarg *args, uintptr_t base)
158 {
159 	ASSERT(phdrp->p_type == PT_SUNWDTRACE);
160 
161 	/*
162 	 * See the comment in fasttrap.h for information on how to safely
163 	 * update this program header.
164 	 */
165 	if (phdrp->p_memsz < PT_SUNWDTRACE_SIZE ||
166 	    (phdrp->p_flags & (PF_R | PF_W | PF_X)) != (PF_R | PF_W | PF_X))
167 		return (-1);
168 
169 	args->thrptr = phdrp->p_vaddr + base;
170 
171 	return (0);
172 }
173 
174 static int
175 handle_secflag_dt(proc_t *p, uint_t dt, uint_t val)
176 {
177 	uint_t flag;
178 
179 	switch (dt) {
180 	case DT_SUNW_ASLR:
181 		flag = PROC_SEC_ASLR;
182 		break;
183 	default:
184 		return (EINVAL);
185 	}
186 
187 	if (val == 0) {
188 		if (secflag_isset(p->p_secflags.psf_lower, flag))
189 			return (EPERM);
190 		if ((secpolicy_psecflags(CRED(), p, p) != 0) &&
191 		    secflag_isset(p->p_secflags.psf_inherit, flag))
192 			return (EPERM);
193 
194 		secflag_clear(&p->p_secflags.psf_effective, flag);
195 	} else {
196 		if (!secflag_isset(p->p_secflags.psf_upper, flag))
197 			return (EPERM);
198 
199 		if ((secpolicy_psecflags(CRED(), p, p) != 0) &&
200 		    !secflag_isset(p->p_secflags.psf_inherit, flag))
201 			return (EPERM);
202 
203 		secflag_set(&p->p_secflags.psf_effective, flag);
204 	}
205 
206 	return (0);
207 }
208 
209 /*
210  * Map in the executable pointed to by vp. Returns 0 on success.
211  */
212 int
213 mapexec_brand(vnode_t *vp, uarg_t *args, Ehdr *ehdr, Addr *uphdr_vaddr,
214     intptr_t *voffset, caddr_t exec_file, int *interp, caddr_t *bssbase,
215     caddr_t *brkbase, size_t *brksize, uintptr_t *lddatap)
216 {
217 	size_t		len;
218 	struct vattr	vat;
219 	caddr_t		phdrbase = NULL;
220 	ssize_t		phdrsize;
221 	int		nshdrs, shstrndx, nphdrs;
222 	int		error = 0;
223 	Phdr		*uphdr = NULL;
224 	Phdr		*junk = NULL;
225 	Phdr		*dynphdr = NULL;
226 	Phdr		*dtrphdr = NULL;
227 	uintptr_t	lddata;
228 	long		execsz;
229 	intptr_t	minaddr;
230 
231 	if (lddatap != NULL)
232 		*lddatap = NULL;
233 
234 	if (error = execpermissions(vp, &vat, args)) {
235 		uprintf("%s: Cannot execute %s\n", exec_file, args->pathname);
236 		return (error);
237 	}
238 
239 	if ((error = getelfhead(vp, CRED(), ehdr, &nshdrs, &shstrndx,
240 	    &nphdrs)) != 0 ||
241 	    (error = getelfphdr(vp, CRED(), ehdr, nphdrs, &phdrbase,
242 	    &phdrsize)) != 0) {
243 		uprintf("%s: Cannot read %s\n", exec_file, args->pathname);
244 		return (error);
245 	}
246 
247 	if ((len = elfsize(ehdr, nphdrs, phdrbase, &lddata)) == 0) {
248 		uprintf("%s: Nothing to load in %s", exec_file, args->pathname);
249 		kmem_free(phdrbase, phdrsize);
250 		return (ENOEXEC);
251 	}
252 	if (lddatap != NULL)
253 		*lddatap = lddata;
254 
255 	if (error = mapelfexec(vp, ehdr, nphdrs, phdrbase, &uphdr, &dynphdr,
256 	    &junk, &dtrphdr, NULL, bssbase, brkbase, voffset, &minaddr,
257 	    len, &execsz, brksize)) {
258 		uprintf("%s: Cannot map %s\n", exec_file, args->pathname);
259 		kmem_free(phdrbase, phdrsize);
260 		return (error);
261 	}
262 
263 	/*
264 	 * Inform our caller if the executable needs an interpreter.
265 	 */
266 	*interp = (dynphdr == NULL) ? 0 : 1;
267 
268 	/*
269 	 * If this is a statically linked executable, voffset should indicate
270 	 * the address of the executable itself (it normally holds the address
271 	 * of the interpreter).
272 	 */
273 	if (ehdr->e_type == ET_EXEC && *interp == 0)
274 		*voffset = minaddr;
275 
276 	if (uphdr != NULL) {
277 		*uphdr_vaddr = uphdr->p_vaddr;
278 	} else {
279 		*uphdr_vaddr = (Addr)-1;
280 	}
281 
282 	kmem_free(phdrbase, phdrsize);
283 	return (error);
284 }
285 
286 /*ARGSUSED*/
287 int
288 elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
289     int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred,
290     int brand_action)
291 {
292 	caddr_t		phdrbase = NULL;
293 	caddr_t		bssbase = 0;
294 	caddr_t		brkbase = 0;
295 	size_t		brksize = 0;
296 	ssize_t		dlnsize;
297 	aux_entry_t	*aux;
298 	int		error;
299 	ssize_t		resid;
300 	int		fd = -1;
301 	intptr_t	voffset;
302 	Phdr		*intphdr = NULL;
303 	Phdr		*dynamicphdr = NULL;
304 	Phdr		*stphdr = NULL;
305 	Phdr		*uphdr = NULL;
306 	Phdr		*junk = NULL;
307 	size_t		len;
308 	ssize_t		phdrsize;
309 	int		postfixsize = 0;
310 	int		i, hsize;
311 	Phdr		*phdrp;
312 	Phdr		*dataphdrp = NULL;
313 	Phdr		*dtrphdr;
314 	Phdr		*capphdr = NULL;
315 	Cap		*cap = NULL;
316 	ssize_t		capsize;
317 	Dyn		*dyn = NULL;
318 	int		hasu = 0;
319 	int		hasauxv = 0;
320 	int		hasintp = 0;
321 	int		branded = 0;
322 
323 	struct proc *p = ttoproc(curthread);
324 	struct user *up = PTOU(p);
325 	struct bigwad {
326 		Ehdr	ehdr;
327 		aux_entry_t	elfargs[__KERN_NAUXV_IMPL];
328 		char		dl_name[MAXPATHLEN];
329 		char		pathbuf[MAXPATHLEN];
330 		struct vattr	vattr;
331 		struct execenv	exenv;
332 	} *bigwad;	/* kmem_alloc this behemoth so we don't blow stack */
333 	Ehdr		*ehdrp;
334 	int		nshdrs, shstrndx, nphdrs;
335 	char		*dlnp;
336 	char		*pathbufp;
337 	rlim64_t	limit;
338 	rlim64_t	roundlimit;
339 
340 	ASSERT(p->p_model == DATAMODEL_ILP32 || p->p_model == DATAMODEL_LP64);
341 
342 	bigwad = kmem_alloc(sizeof (struct bigwad), KM_SLEEP);
343 	ehdrp = &bigwad->ehdr;
344 	dlnp = bigwad->dl_name;
345 	pathbufp = bigwad->pathbuf;
346 
347 	/*
348 	 * Obtain ELF and program header information.
349 	 */
350 	if ((error = getelfhead(vp, CRED(), ehdrp, &nshdrs, &shstrndx,
351 	    &nphdrs)) != 0 ||
352 	    (error = getelfphdr(vp, CRED(), ehdrp, nphdrs, &phdrbase,
353 	    &phdrsize)) != 0)
354 		goto out;
355 
356 	/*
357 	 * Prevent executing an ELF file that has no entry point.
358 	 */
359 	if (ehdrp->e_entry == 0) {
360 		uprintf("%s: Bad entry point\n", exec_file);
361 		goto bad;
362 	}
363 
364 	/*
365 	 * Put data model that we're exec-ing to into the args passed to
366 	 * exec_args(), so it will know what it is copying to on new stack.
367 	 * Now that we know whether we are exec-ing a 32-bit or 64-bit
368 	 * executable, we can set execsz with the appropriate NCARGS.
369 	 */
370 #ifdef	_LP64
371 	if (ehdrp->e_ident[EI_CLASS] == ELFCLASS32) {
372 		args->to_model = DATAMODEL_ILP32;
373 		*execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS32-1);
374 	} else {
375 		args->to_model = DATAMODEL_LP64;
376 		args->stk_prot &= ~PROT_EXEC;
377 #if defined(__i386) || defined(__amd64)
378 		args->dat_prot &= ~PROT_EXEC;
379 #endif
380 		*execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS64-1);
381 	}
382 #else	/* _LP64 */
383 	args->to_model = DATAMODEL_ILP32;
384 	*execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS-1);
385 #endif	/* _LP64 */
386 
387 	/*
388 	 * We delay invoking the brand callback until we've figured out
389 	 * what kind of elf binary we're trying to run, 32-bit or 64-bit.
390 	 * We do this because now the brand library can just check
391 	 * args->to_model to see if the target is 32-bit or 64-bit without
392 	 * having do duplicate all the code above.
393 	 *
394 	 * The level checks associated with brand handling below are used to
395 	 * prevent a loop since the brand elfexec function typically comes back
396 	 * through this function. We must check <= here since the nested
397 	 * handling in the #! interpreter code will increment the level before
398 	 * calling gexec to run the final elfexec interpreter.
399 	 */
400 	if ((level <= INTP_MAXDEPTH) &&
401 	    (brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
402 		error = BROP(p)->b_elfexec(vp, uap, args,
403 		    idatap, level + 1, execsz, setid, exec_file, cred,
404 		    brand_action);
405 		goto out;
406 	}
407 
408 	/*
409 	 * Determine aux size now so that stack can be built
410 	 * in one shot (except actual copyout of aux image),
411 	 * determine any non-default stack protections,
412 	 * and still have this code be machine independent.
413 	 */
414 	hsize = ehdrp->e_phentsize;
415 	phdrp = (Phdr *)phdrbase;
416 	for (i = nphdrs; i > 0; i--) {
417 		switch (phdrp->p_type) {
418 		case PT_INTERP:
419 			hasauxv = hasintp = 1;
420 			break;
421 		case PT_PHDR:
422 			hasu = 1;
423 			break;
424 		case PT_SUNWSTACK:
425 			args->stk_prot = PROT_USER;
426 			if (phdrp->p_flags & PF_R)
427 				args->stk_prot |= PROT_READ;
428 			if (phdrp->p_flags & PF_W)
429 				args->stk_prot |= PROT_WRITE;
430 			if (phdrp->p_flags & PF_X)
431 				args->stk_prot |= PROT_EXEC;
432 			break;
433 		case PT_LOAD:
434 			dataphdrp = phdrp;
435 			break;
436 		case PT_SUNWCAP:
437 			capphdr = phdrp;
438 			break;
439 		case PT_DYNAMIC:
440 			dynamicphdr = phdrp;
441 			break;
442 		}
443 		phdrp = (Phdr *)((caddr_t)phdrp + hsize);
444 	}
445 
446 	if (ehdrp->e_type != ET_EXEC) {
447 		dataphdrp = NULL;
448 		hasauxv = 1;
449 	}
450 
451 	/* Copy BSS permissions to args->dat_prot */
452 	if (dataphdrp != NULL) {
453 		args->dat_prot = PROT_USER;
454 		if (dataphdrp->p_flags & PF_R)
455 			args->dat_prot |= PROT_READ;
456 		if (dataphdrp->p_flags & PF_W)
457 			args->dat_prot |= PROT_WRITE;
458 		if (dataphdrp->p_flags & PF_X)
459 			args->dat_prot |= PROT_EXEC;
460 	}
461 
462 	/*
463 	 * If a auxvector will be required - reserve the space for
464 	 * it now.  This may be increased by exec_args if there are
465 	 * ISA-specific types (included in __KERN_NAUXV_IMPL).
466 	 */
467 	if (hasauxv) {
468 		/*
469 		 * If a AUX vector is being built - the base AUX
470 		 * entries are:
471 		 *
472 		 *	AT_BASE
473 		 *	AT_FLAGS
474 		 *	AT_PAGESZ
475 		 *	AT_SUN_AUXFLAGS
476 		 *	AT_SUN_HWCAP
477 		 *	AT_SUN_HWCAP2
478 		 *	AT_SUN_PLATFORM (added in stk_copyout)
479 		 *	AT_SUN_EXECNAME (added in stk_copyout)
480 		 *	AT_NULL
481 		 *
482 		 * total == 9
483 		 */
484 		if (hasintp && hasu) {
485 			/*
486 			 * Has PT_INTERP & PT_PHDR - the auxvectors that
487 			 * will be built are:
488 			 *
489 			 *	AT_PHDR
490 			 *	AT_PHENT
491 			 *	AT_PHNUM
492 			 *	AT_ENTRY
493 			 *	AT_LDDATA
494 			 *
495 			 * total = 5
496 			 */
497 			args->auxsize = (9 + 5) * sizeof (aux_entry_t);
498 		} else if (hasintp) {
499 			/*
500 			 * Has PT_INTERP but no PT_PHDR
501 			 *
502 			 *	AT_EXECFD
503 			 *	AT_LDDATA
504 			 *
505 			 * total = 2
506 			 */
507 			args->auxsize = (9 + 2) * sizeof (aux_entry_t);
508 		} else {
509 			args->auxsize = 9 * sizeof (aux_entry_t);
510 		}
511 	} else {
512 		args->auxsize = 0;
513 	}
514 
515 	/*
516 	 * If this binary is using an emulator, we need to add an
517 	 * AT_SUN_EMULATOR aux entry.
518 	 */
519 	if (args->emulator != NULL)
520 		args->auxsize += sizeof (aux_entry_t);
521 
522 	/*
523 	 * On supported kernels (x86_64) make room in the auxv for the
524 	 * AT_SUN_COMMPAGE entry.  This will go unpopulated on i86xpv systems
525 	 * which do not provide such functionality.
526 	 *
527 	 * Additionally cover the floating point information AT_SUN_FPSIZE and
528 	 * AT_SUN_FPTYPE.
529 	 */
530 #if defined(__amd64)
531 	args->auxsize += 3 * sizeof (aux_entry_t);
532 #endif /* defined(__amd64) */
533 
534 	if ((brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
535 		branded = 1;
536 		/*
537 		 * We will be adding 4 entries to the aux vectors.  One for
538 		 * the the brandname and 3 for the brand specific aux vectors.
539 		 */
540 		args->auxsize += 4 * sizeof (aux_entry_t);
541 	}
542 
543 	/* If the binary has an explicit ASLR flag, it must be honoured */
544 	if ((dynamicphdr != NULL) &&
545 	    (dynamicphdr->p_filesz > 0)) {
546 		Dyn *dp;
547 		off_t i = 0;
548 
549 #define	DYN_STRIDE	100
550 		for (i = 0; i < dynamicphdr->p_filesz;
551 		    i += sizeof (*dyn) * DYN_STRIDE) {
552 			int ndyns = (dynamicphdr->p_filesz - i) / sizeof (*dyn);
553 			size_t dynsize;
554 
555 			ndyns = MIN(DYN_STRIDE, ndyns);
556 			dynsize = ndyns * sizeof (*dyn);
557 
558 			dyn = kmem_alloc(dynsize, KM_SLEEP);
559 
560 			if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)dyn,
561 			    dynsize, (offset_t)(dynamicphdr->p_offset + i),
562 			    UIO_SYSSPACE, 0, (rlim64_t)0,
563 			    CRED(), &resid)) != 0) {
564 				uprintf("%s: cannot read .dynamic section\n",
565 				    exec_file);
566 				goto out;
567 			}
568 
569 			for (dp = dyn; dp < (dyn + ndyns); dp++) {
570 				if (dp->d_tag == DT_SUNW_ASLR) {
571 					if ((error = handle_secflag_dt(p,
572 					    DT_SUNW_ASLR,
573 					    dp->d_un.d_val)) != 0) {
574 						uprintf("%s: error setting "
575 						    "security-flag from "
576 						    "DT_SUNW_ASLR: %d\n",
577 						    exec_file, error);
578 						goto out;
579 					}
580 				}
581 			}
582 
583 			kmem_free(dyn, dynsize);
584 		}
585 	}
586 
587 	/* Hardware/Software capabilities */
588 	if (capphdr != NULL &&
589 	    (capsize = capphdr->p_filesz) > 0 &&
590 	    capsize <= 16 * sizeof (*cap)) {
591 		int ncaps = capsize / sizeof (*cap);
592 		Cap *cp;
593 
594 		cap = kmem_alloc(capsize, KM_SLEEP);
595 		if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)cap,
596 		    capsize, (offset_t)capphdr->p_offset,
597 		    UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid)) != 0) {
598 			uprintf("%s: Cannot read capabilities section\n",
599 			    exec_file);
600 			goto out;
601 		}
602 		for (cp = cap; cp < cap + ncaps; cp++) {
603 			if (cp->c_tag == CA_SUNW_SF_1 &&
604 			    (cp->c_un.c_val & SF1_SUNW_ADDR32)) {
605 				if (args->to_model == DATAMODEL_LP64)
606 					args->addr32 = 1;
607 				break;
608 			}
609 		}
610 	}
611 
612 	aux = bigwad->elfargs;
613 	/*
614 	 * Move args to the user's stack.
615 	 * This can fill in the AT_SUN_PLATFORM and AT_SUN_EXECNAME aux entries.
616 	 */
617 	if ((error = exec_args(uap, args, idatap, (void **)&aux)) != 0) {
618 		if (error == -1) {
619 			error = ENOEXEC;
620 			goto bad;
621 		}
622 		goto out;
623 	}
624 	/* we're single threaded after this point */
625 
626 	/*
627 	 * If this is an ET_DYN executable (shared object),
628 	 * determine its memory size so that mapelfexec() can load it.
629 	 */
630 	if (ehdrp->e_type == ET_DYN)
631 		len = elfsize(ehdrp, nphdrs, phdrbase, NULL);
632 	else
633 		len = 0;
634 
635 	dtrphdr = NULL;
636 
637 	if ((error = mapelfexec(vp, ehdrp, nphdrs, phdrbase, &uphdr, &intphdr,
638 	    &stphdr, &dtrphdr, dataphdrp, &bssbase, &brkbase, &voffset, NULL,
639 	    len, execsz, &brksize)) != 0)
640 		goto bad;
641 
642 	if (uphdr != NULL && intphdr == NULL)
643 		goto bad;
644 
645 	if (dtrphdr != NULL && dtrace_safe_phdr(dtrphdr, args, voffset) != 0) {
646 		uprintf("%s: Bad DTrace phdr in %s\n", exec_file, exec_file);
647 		goto bad;
648 	}
649 
650 	if (intphdr != NULL) {
651 		size_t		len;
652 		uintptr_t	lddata;
653 		char		*p;
654 		struct vnode	*nvp;
655 
656 		dlnsize = intphdr->p_filesz;
657 
658 		if (dlnsize > MAXPATHLEN || dlnsize <= 0)
659 			goto bad;
660 
661 		/*
662 		 * Read in "interpreter" pathname.
663 		 */
664 		if ((error = vn_rdwr(UIO_READ, vp, dlnp, intphdr->p_filesz,
665 		    (offset_t)intphdr->p_offset, UIO_SYSSPACE, 0, (rlim64_t)0,
666 		    CRED(), &resid)) != 0) {
667 			uprintf("%s: Cannot obtain interpreter pathname\n",
668 			    exec_file);
669 			goto bad;
670 		}
671 
672 		if (resid != 0 || dlnp[dlnsize - 1] != '\0')
673 			goto bad;
674 
675 		/*
676 		 * Search for '$ORIGIN' token in interpreter path.
677 		 * If found, expand it.
678 		 */
679 		for (p = dlnp; p = strchr(p, '$'); ) {
680 			uint_t	len, curlen;
681 			char	*_ptr;
682 
683 			if (strncmp(++p, ORIGIN_STR, ORIGIN_STR_SIZE))
684 				continue;
685 
686 			/*
687 			 * We don't support $ORIGIN on setid programs to close
688 			 * a potential attack vector.
689 			 */
690 			if ((setid & EXECSETID_SETID) != 0) {
691 				error = ENOEXEC;
692 				goto bad;
693 			}
694 
695 			curlen = 0;
696 			len = p - dlnp - 1;
697 			if (len) {
698 				bcopy(dlnp, pathbufp, len);
699 				curlen += len;
700 			}
701 			if (_ptr = strrchr(args->pathname, '/')) {
702 				len = _ptr - args->pathname;
703 				if ((curlen + len) > MAXPATHLEN)
704 					break;
705 
706 				bcopy(args->pathname, &pathbufp[curlen], len);
707 				curlen += len;
708 			} else {
709 				/*
710 				 * executable is a basename found in the
711 				 * current directory.  So - just substitue
712 				 * '.' for ORIGIN.
713 				 */
714 				pathbufp[curlen] = '.';
715 				curlen++;
716 			}
717 			p += ORIGIN_STR_SIZE;
718 			len = strlen(p);
719 
720 			if ((curlen + len) > MAXPATHLEN)
721 				break;
722 			bcopy(p, &pathbufp[curlen], len);
723 			curlen += len;
724 			pathbufp[curlen++] = '\0';
725 			bcopy(pathbufp, dlnp, curlen);
726 		}
727 
728 		/*
729 		 * /usr/lib/ld.so.1 is known to be a symlink to /lib/ld.so.1
730 		 * (and /usr/lib/64/ld.so.1 is a symlink to /lib/64/ld.so.1).
731 		 * Just in case /usr is not mounted, change it now.
732 		 */
733 		if (strcmp(dlnp, USR_LIB_RTLD) == 0)
734 			dlnp += 4;
735 		error = lookupname(dlnp, UIO_SYSSPACE, FOLLOW, NULLVPP, &nvp);
736 		if (error && dlnp != bigwad->dl_name) {
737 			/* new kernel, old user-level */
738 			error = lookupname(dlnp -= 4, UIO_SYSSPACE, FOLLOW,
739 			    NULLVPP, &nvp);
740 		}
741 		if (error) {
742 			uprintf("%s: Cannot find %s\n", exec_file, dlnp);
743 			goto bad;
744 		}
745 
746 		/*
747 		 * Setup the "aux" vector.
748 		 */
749 		if (uphdr) {
750 			if (ehdrp->e_type == ET_DYN) {
751 				/* don't use the first page */
752 				bigwad->exenv.ex_brkbase = (caddr_t)PAGESIZE;
753 				bigwad->exenv.ex_bssbase = (caddr_t)PAGESIZE;
754 			} else {
755 				bigwad->exenv.ex_bssbase = bssbase;
756 				bigwad->exenv.ex_brkbase = brkbase;
757 			}
758 			bigwad->exenv.ex_brksize = brksize;
759 			bigwad->exenv.ex_magic = elfmagic;
760 			bigwad->exenv.ex_vp = vp;
761 			setexecenv(&bigwad->exenv);
762 
763 			ADDAUX(aux, AT_PHDR, uphdr->p_vaddr + voffset)
764 			ADDAUX(aux, AT_PHENT, ehdrp->e_phentsize)
765 			ADDAUX(aux, AT_PHNUM, nphdrs)
766 			ADDAUX(aux, AT_ENTRY, ehdrp->e_entry + voffset)
767 		} else {
768 			if ((error = execopen(&vp, &fd)) != 0) {
769 				VN_RELE(nvp);
770 				goto bad;
771 			}
772 
773 			ADDAUX(aux, AT_EXECFD, fd)
774 		}
775 
776 		if ((error = execpermissions(nvp, &bigwad->vattr, args)) != 0) {
777 			VN_RELE(nvp);
778 			uprintf("%s: Cannot execute %s\n", exec_file, dlnp);
779 			goto bad;
780 		}
781 
782 		/*
783 		 * Now obtain the ELF header along with the entire program
784 		 * header contained in "nvp".
785 		 */
786 		kmem_free(phdrbase, phdrsize);
787 		phdrbase = NULL;
788 		if ((error = getelfhead(nvp, CRED(), ehdrp, &nshdrs,
789 		    &shstrndx, &nphdrs)) != 0 ||
790 		    (error = getelfphdr(nvp, CRED(), ehdrp, nphdrs, &phdrbase,
791 		    &phdrsize)) != 0) {
792 			VN_RELE(nvp);
793 			uprintf("%s: Cannot read %s\n", exec_file, dlnp);
794 			goto bad;
795 		}
796 
797 		/*
798 		 * Determine memory size of the "interpreter's" loadable
799 		 * sections.  This size is then used to obtain the virtual
800 		 * address of a hole, in the user's address space, large
801 		 * enough to map the "interpreter".
802 		 */
803 		if ((len = elfsize(ehdrp, nphdrs, phdrbase, &lddata)) == 0) {
804 			VN_RELE(nvp);
805 			uprintf("%s: Nothing to load in %s\n", exec_file, dlnp);
806 			goto bad;
807 		}
808 
809 		dtrphdr = NULL;
810 
811 		error = mapelfexec(nvp, ehdrp, nphdrs, phdrbase, &junk, &junk,
812 		    &junk, &dtrphdr, NULL, NULL, NULL, &voffset, NULL, len,
813 		    execsz, NULL);
814 		if (error || junk != NULL) {
815 			VN_RELE(nvp);
816 			uprintf("%s: Cannot map %s\n", exec_file, dlnp);
817 			goto bad;
818 		}
819 
820 		/*
821 		 * We use the DTrace program header to initialize the
822 		 * architecture-specific user per-LWP location. The dtrace
823 		 * fasttrap provider requires ready access to per-LWP scratch
824 		 * space. We assume that there is only one such program header
825 		 * in the interpreter.
826 		 */
827 		if (dtrphdr != NULL &&
828 		    dtrace_safe_phdr(dtrphdr, args, voffset) != 0) {
829 			VN_RELE(nvp);
830 			uprintf("%s: Bad DTrace phdr in %s\n", exec_file, dlnp);
831 			goto bad;
832 		}
833 
834 		VN_RELE(nvp);
835 		ADDAUX(aux, AT_SUN_LDDATA, voffset + lddata)
836 	}
837 
838 	if (hasauxv) {
839 		int auxf = AF_SUN_HWCAPVERIFY;
840 		size_t fpsize;
841 		int fptype;
842 
843 		/*
844 		 * Note: AT_SUN_PLATFORM and AT_SUN_EXECNAME were filled in via
845 		 * exec_args()
846 		 */
847 		ADDAUX(aux, AT_BASE, voffset)
848 		ADDAUX(aux, AT_FLAGS, at_flags)
849 		ADDAUX(aux, AT_PAGESZ, PAGESIZE)
850 		/*
851 		 * Linker flags. (security)
852 		 * p_flag not yet set at this time.
853 		 * We rely on gexec() to provide us with the information.
854 		 * If the application is set-uid but this is not reflected
855 		 * in a mismatch between real/effective uids/gids, then
856 		 * don't treat this as a set-uid exec.  So we care about
857 		 * the EXECSETID_UGIDS flag but not the ...SETID flag.
858 		 */
859 		if ((setid &= ~EXECSETID_SETID) != 0)
860 			auxf |= AF_SUN_SETUGID;
861 
862 		/*
863 		 * If we're running a native process from within a branded
864 		 * zone under pfexec then we clear the AF_SUN_SETUGID flag so
865 		 * that the native ld.so.1 is able to link with the native
866 		 * libraries instead of using the brand libraries that are
867 		 * installed in the zone.  We only do this for processes
868 		 * which we trust because we see they are already running
869 		 * under pfexec (where uid != euid).  This prevents a
870 		 * malicious user within the zone from crafting a wrapper to
871 		 * run native suid commands with unsecure libraries interposed.
872 		 */
873 		if ((brand_action == EBA_NATIVE) && (PROC_IS_BRANDED(p) &&
874 		    (setid &= ~EXECSETID_SETID) != 0))
875 			auxf &= ~AF_SUN_SETUGID;
876 
877 		/*
878 		 * Record the user addr of the auxflags aux vector entry
879 		 * since brands may optionally want to manipulate this field.
880 		 */
881 		args->auxp_auxflags =
882 		    (char *)((char *)args->stackend +
883 		    ((char *)&aux->a_type -
884 		    (char *)bigwad->elfargs));
885 		ADDAUX(aux, AT_SUN_AUXFLAGS, auxf);
886 
887 		/*
888 		 * Hardware capability flag word (performance hints)
889 		 * Used for choosing faster library routines.
890 		 * (Potentially different between 32-bit and 64-bit ABIs)
891 		 */
892 #if defined(_LP64)
893 		if (args->to_model == DATAMODEL_NATIVE) {
894 			ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap)
895 			ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2)
896 		} else {
897 			ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap32)
898 			ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap32_2)
899 		}
900 #else
901 		ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap)
902 		ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2)
903 #endif
904 		if (branded) {
905 			/*
906 			 * Reserve space for the brand-private aux vectors,
907 			 * and record the user addr of that space.
908 			 */
909 			args->auxp_brand =
910 			    (char *)((char *)args->stackend +
911 			    ((char *)&aux->a_type -
912 			    (char *)bigwad->elfargs));
913 			ADDAUX(aux, AT_SUN_BRAND_AUX1, 0)
914 			ADDAUX(aux, AT_SUN_BRAND_AUX2, 0)
915 			ADDAUX(aux, AT_SUN_BRAND_AUX3, 0)
916 		}
917 
918 		/*
919 		 * Add the comm page auxv entry, mapping it in if needed. Also
920 		 * take care of the FPU entries.
921 		 */
922 #if defined(__amd64)
923 		if (args->commpage != NULL ||
924 		    (args->commpage = (uintptr_t)comm_page_mapin()) != NULL) {
925 			ADDAUX(aux, AT_SUN_COMMPAGE, args->commpage)
926 		} else {
927 			/*
928 			 * If the comm page cannot be mapped, pad out the auxv
929 			 * to satisfy later size checks.
930 			 */
931 			ADDAUX(aux, AT_NULL, 0)
932 		}
933 
934 		fptype = AT_386_FPINFO_NONE;
935 		fpu_auxv_info(&fptype, &fpsize);
936 		if (fptype != AT_386_FPINFO_NONE) {
937 			ADDAUX(aux, AT_SUN_FPTYPE, fptype)
938 			ADDAUX(aux, AT_SUN_FPSIZE, fpsize)
939 		} else {
940 			ADDAUX(aux, AT_NULL, 0)
941 			ADDAUX(aux, AT_NULL, 0)
942 		}
943 #endif /* defined(__amd64) */
944 
945 		ADDAUX(aux, AT_NULL, 0)
946 		postfixsize = (char *)aux - (char *)bigwad->elfargs;
947 
948 		/*
949 		 * We make assumptions above when we determine how many aux
950 		 * vector entries we will be adding. However, if we have an
951 		 * invalid elf file, it is possible that mapelfexec might
952 		 * behave differently (but not return an error), in which case
953 		 * the number of aux entries we actually add will be different.
954 		 * We detect that now and error out.
955 		 */
956 		if (postfixsize != args->auxsize) {
957 			DTRACE_PROBE2(elfexec_badaux, int, postfixsize,
958 			    int, args->auxsize);
959 			goto bad;
960 		}
961 		ASSERT(postfixsize <= __KERN_NAUXV_IMPL * sizeof (aux_entry_t));
962 	}
963 
964 	/*
965 	 * For the 64-bit kernel, the limit is big enough that rounding it up
966 	 * to a page can overflow the 64-bit limit, so we check for btopr()
967 	 * overflowing here by comparing it with the unrounded limit in pages.
968 	 * If it hasn't overflowed, compare the exec size with the rounded up
969 	 * limit in pages.  Otherwise, just compare with the unrounded limit.
970 	 */
971 	limit = btop(p->p_vmem_ctl);
972 	roundlimit = btopr(p->p_vmem_ctl);
973 	if ((roundlimit > limit && *execsz > roundlimit) ||
974 	    (roundlimit < limit && *execsz > limit)) {
975 		mutex_enter(&p->p_lock);
976 		(void) rctl_action(rctlproc_legacy[RLIMIT_VMEM], p->p_rctls, p,
977 		    RCA_SAFE);
978 		mutex_exit(&p->p_lock);
979 		error = ENOMEM;
980 		goto bad;
981 	}
982 
983 	bzero(up->u_auxv, sizeof (up->u_auxv));
984 	up->u_commpagep = args->commpage;
985 	if (postfixsize) {
986 		int num_auxv;
987 
988 		/*
989 		 * Copy the aux vector to the user stack.
990 		 */
991 		error = execpoststack(args, bigwad->elfargs, postfixsize);
992 		if (error)
993 			goto bad;
994 
995 		/*
996 		 * Copy auxv to the process's user structure for use by /proc.
997 		 * If this is a branded process, the brand's exec routine will
998 		 * copy it's private entries to the user structure later. It
999 		 * relies on the fact that the blank entries are at the end.
1000 		 */
1001 		num_auxv = postfixsize / sizeof (aux_entry_t);
1002 		ASSERT(num_auxv <= sizeof (up->u_auxv) / sizeof (auxv_t));
1003 		aux = bigwad->elfargs;
1004 		for (i = 0; i < num_auxv; i++) {
1005 			up->u_auxv[i].a_type = aux[i].a_type;
1006 			up->u_auxv[i].a_un.a_val = (aux_val_t)aux[i].a_un.a_val;
1007 		}
1008 	}
1009 
1010 	/*
1011 	 * Pass back the starting address so we can set the program counter.
1012 	 */
1013 	args->entry = (uintptr_t)(ehdrp->e_entry + voffset);
1014 
1015 	if (!uphdr) {
1016 		if (ehdrp->e_type == ET_DYN) {
1017 			/*
1018 			 * If we are executing a shared library which doesn't
1019 			 * have a interpreter (probably ld.so.1) then
1020 			 * we don't set the brkbase now.  Instead we
1021 			 * delay it's setting until the first call
1022 			 * via grow.c::brk().  This permits ld.so.1 to
1023 			 * initialize brkbase to the tail of the executable it
1024 			 * loads (which is where it needs to be).
1025 			 */
1026 			bigwad->exenv.ex_brkbase = (caddr_t)0;
1027 			bigwad->exenv.ex_bssbase = (caddr_t)0;
1028 			bigwad->exenv.ex_brksize = 0;
1029 		} else {
1030 			bigwad->exenv.ex_brkbase = brkbase;
1031 			bigwad->exenv.ex_bssbase = bssbase;
1032 			bigwad->exenv.ex_brksize = brksize;
1033 		}
1034 		bigwad->exenv.ex_magic = elfmagic;
1035 		bigwad->exenv.ex_vp = vp;
1036 		setexecenv(&bigwad->exenv);
1037 	}
1038 
1039 	ASSERT(error == 0);
1040 	goto out;
1041 
1042 bad:
1043 	if (fd != -1)		/* did we open the a.out yet */
1044 		(void) execclose(fd);
1045 
1046 	psignal(p, SIGKILL);
1047 
1048 	if (error == 0)
1049 		error = ENOEXEC;
1050 out:
1051 	if (phdrbase != NULL)
1052 		kmem_free(phdrbase, phdrsize);
1053 	if (cap != NULL)
1054 		kmem_free(cap, capsize);
1055 	kmem_free(bigwad, sizeof (struct bigwad));
1056 	return (error);
1057 }
1058 
1059 /*
1060  * Compute the memory size requirement for the ELF file.
1061  */
1062 static size_t
1063 elfsize(Ehdr *ehdrp, int nphdrs, caddr_t phdrbase, uintptr_t *lddata)
1064 {
1065 	size_t	len;
1066 	Phdr	*phdrp = (Phdr *)phdrbase;
1067 	int	hsize = ehdrp->e_phentsize;
1068 	int	first = 1;
1069 	int	dfirst = 1;	/* first data segment */
1070 	uintptr_t loaddr = 0;
1071 	uintptr_t hiaddr = 0;
1072 	uintptr_t lo, hi;
1073 	int	i;
1074 
1075 	for (i = nphdrs; i > 0; i--) {
1076 		if (phdrp->p_type == PT_LOAD) {
1077 			lo = phdrp->p_vaddr;
1078 			hi = lo + phdrp->p_memsz;
1079 			if (first) {
1080 				loaddr = lo;
1081 				hiaddr = hi;
1082 				first = 0;
1083 			} else {
1084 				if (loaddr > lo)
1085 					loaddr = lo;
1086 				if (hiaddr < hi)
1087 					hiaddr = hi;
1088 			}
1089 
1090 			/*
1091 			 * save the address of the first data segment
1092 			 * of a object - used for the AT_SUNW_LDDATA
1093 			 * aux entry.
1094 			 */
1095 			if ((lddata != NULL) && dfirst &&
1096 			    (phdrp->p_flags & PF_W)) {
1097 				*lddata = lo;
1098 				dfirst = 0;
1099 			}
1100 		}
1101 		phdrp = (Phdr *)((caddr_t)phdrp + hsize);
1102 	}
1103 
1104 	len = hiaddr - (loaddr & PAGEMASK);
1105 	len = roundup(len, PAGESIZE);
1106 
1107 	return (len);
1108 }
1109 
1110 /*
1111  * Read in the ELF header and program header table.
1112  * SUSV3 requires:
1113  *	ENOEXEC	File format is not recognized
1114  *	EINVAL	Format recognized but execution not supported
1115  */
1116 static int
1117 getelfhead(vnode_t *vp, cred_t *credp, Ehdr *ehdr, int *nshdrs, int *shstrndx,
1118     int *nphdrs)
1119 {
1120 	int error;
1121 	ssize_t resid;
1122 
1123 	/*
1124 	 * We got here by the first two bytes in ident,
1125 	 * now read the entire ELF header.
1126 	 */
1127 	if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)ehdr,
1128 	    sizeof (Ehdr), (offset_t)0, UIO_SYSSPACE, 0,
1129 	    (rlim64_t)0, credp, &resid)) != 0)
1130 		return (error);
1131 
1132 	/*
1133 	 * Since a separate version is compiled for handling 32-bit and
1134 	 * 64-bit ELF executables on a 64-bit kernel, the 64-bit version
1135 	 * doesn't need to be able to deal with 32-bit ELF files.
1136 	 */
1137 	if (resid != 0 ||
1138 	    ehdr->e_ident[EI_MAG2] != ELFMAG2 ||
1139 	    ehdr->e_ident[EI_MAG3] != ELFMAG3)
1140 		return (ENOEXEC);
1141 
1142 	if ((ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) ||
1143 #if defined(_ILP32) || defined(_ELF32_COMPAT)
1144 	    ehdr->e_ident[EI_CLASS] != ELFCLASS32 ||
1145 #else
1146 	    ehdr->e_ident[EI_CLASS] != ELFCLASS64 ||
1147 #endif
1148 	    !elfheadcheck(ehdr->e_ident[EI_DATA], ehdr->e_machine,
1149 	    ehdr->e_flags))
1150 		return (EINVAL);
1151 
1152 	*nshdrs = ehdr->e_shnum;
1153 	*shstrndx = ehdr->e_shstrndx;
1154 	*nphdrs = ehdr->e_phnum;
1155 
1156 	/*
1157 	 * If e_shnum, e_shstrndx, or e_phnum is its sentinel value, we need
1158 	 * to read in the section header at index zero to acces the true
1159 	 * values for those fields.
1160 	 */
1161 	if ((*nshdrs == 0 && ehdr->e_shoff != 0) ||
1162 	    *shstrndx == SHN_XINDEX || *nphdrs == PN_XNUM) {
1163 		Shdr shdr;
1164 
1165 		if (ehdr->e_shoff == 0)
1166 			return (EINVAL);
1167 
1168 		if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)&shdr,
1169 		    sizeof (shdr), (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0,
1170 		    (rlim64_t)0, credp, &resid)) != 0)
1171 			return (error);
1172 
1173 		if (*nshdrs == 0)
1174 			*nshdrs = shdr.sh_size;
1175 		if (*shstrndx == SHN_XINDEX)
1176 			*shstrndx = shdr.sh_link;
1177 		if (*nphdrs == PN_XNUM && shdr.sh_info != 0)
1178 			*nphdrs = shdr.sh_info;
1179 	}
1180 
1181 	return (0);
1182 }
1183 
1184 #ifdef _ELF32_COMPAT
1185 extern size_t elf_nphdr_max;
1186 #else
1187 size_t elf_nphdr_max = 1000;
1188 #endif
1189 
1190 static int
1191 getelfphdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, int nphdrs,
1192     caddr_t *phbasep, ssize_t *phsizep)
1193 {
1194 	ssize_t resid, minsize;
1195 	int err;
1196 
1197 	/*
1198 	 * Since we're going to be using e_phentsize to iterate down the
1199 	 * array of program headers, it must be 8-byte aligned or else
1200 	 * a we might cause a misaligned access. We use all members through
1201 	 * p_flags on 32-bit ELF files and p_memsz on 64-bit ELF files so
1202 	 * e_phentsize must be at least large enough to include those
1203 	 * members.
1204 	 */
1205 #if !defined(_LP64) || defined(_ELF32_COMPAT)
1206 	minsize = offsetof(Phdr, p_flags) + sizeof (((Phdr *)NULL)->p_flags);
1207 #else
1208 	minsize = offsetof(Phdr, p_memsz) + sizeof (((Phdr *)NULL)->p_memsz);
1209 #endif
1210 	if (ehdr->e_phentsize < minsize || (ehdr->e_phentsize & 3))
1211 		return (EINVAL);
1212 
1213 	*phsizep = nphdrs * ehdr->e_phentsize;
1214 
1215 	if (*phsizep > sizeof (Phdr) * elf_nphdr_max) {
1216 		if ((*phbasep = kmem_alloc(*phsizep, KM_NOSLEEP)) == NULL)
1217 			return (ENOMEM);
1218 	} else {
1219 		*phbasep = kmem_alloc(*phsizep, KM_SLEEP);
1220 	}
1221 
1222 	if ((err = vn_rdwr(UIO_READ, vp, *phbasep, *phsizep,
1223 	    (offset_t)ehdr->e_phoff, UIO_SYSSPACE, 0, (rlim64_t)0,
1224 	    credp, &resid)) != 0) {
1225 		kmem_free(*phbasep, *phsizep);
1226 		*phbasep = NULL;
1227 		return (err);
1228 	}
1229 
1230 	return (0);
1231 }
1232 
1233 #ifdef _ELF32_COMPAT
1234 extern size_t elf_nshdr_max;
1235 extern size_t elf_shstrtab_max;
1236 #else
1237 size_t elf_nshdr_max = 10000;
1238 size_t elf_shstrtab_max = 100 * 1024;
1239 #endif
1240 
1241 
1242 static int
1243 getelfshdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr,
1244     int nshdrs, int shstrndx, caddr_t *shbasep, ssize_t *shsizep,
1245     char **shstrbasep, ssize_t *shstrsizep)
1246 {
1247 	ssize_t resid, minsize;
1248 	int err;
1249 	Shdr *shdr;
1250 
1251 	/*
1252 	 * Since we're going to be using e_shentsize to iterate down the
1253 	 * array of section headers, it must be 8-byte aligned or else
1254 	 * a we might cause a misaligned access. We use all members through
1255 	 * sh_entsize (on both 32- and 64-bit ELF files) so e_shentsize
1256 	 * must be at least large enough to include that member. The index
1257 	 * of the string table section must also be valid.
1258 	 */
1259 	minsize = offsetof(Shdr, sh_entsize) + sizeof (shdr->sh_entsize);
1260 	if (ehdr->e_shentsize < minsize || (ehdr->e_shentsize & 3) ||
1261 	    shstrndx >= nshdrs)
1262 		return (EINVAL);
1263 
1264 	*shsizep = nshdrs * ehdr->e_shentsize;
1265 
1266 	if (*shsizep > sizeof (Shdr) * elf_nshdr_max) {
1267 		if ((*shbasep = kmem_alloc(*shsizep, KM_NOSLEEP)) == NULL)
1268 			return (ENOMEM);
1269 	} else {
1270 		*shbasep = kmem_alloc(*shsizep, KM_SLEEP);
1271 	}
1272 
1273 	if ((err = vn_rdwr(UIO_READ, vp, *shbasep, *shsizep,
1274 	    (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, (rlim64_t)0,
1275 	    credp, &resid)) != 0) {
1276 		kmem_free(*shbasep, *shsizep);
1277 		return (err);
1278 	}
1279 
1280 	/*
1281 	 * Pull the section string table out of the vnode; fail if the size
1282 	 * is zero.
1283 	 */
1284 	shdr = (Shdr *)(*shbasep + shstrndx * ehdr->e_shentsize);
1285 	if ((*shstrsizep = shdr->sh_size) == 0) {
1286 		kmem_free(*shbasep, *shsizep);
1287 		return (EINVAL);
1288 	}
1289 
1290 	if (*shstrsizep > elf_shstrtab_max) {
1291 		if ((*shstrbasep = kmem_alloc(*shstrsizep,
1292 		    KM_NOSLEEP)) == NULL) {
1293 			kmem_free(*shbasep, *shsizep);
1294 			return (ENOMEM);
1295 		}
1296 	} else {
1297 		*shstrbasep = kmem_alloc(*shstrsizep, KM_SLEEP);
1298 	}
1299 
1300 	if ((err = vn_rdwr(UIO_READ, vp, *shstrbasep, *shstrsizep,
1301 	    (offset_t)shdr->sh_offset, UIO_SYSSPACE, 0, (rlim64_t)0,
1302 	    credp, &resid)) != 0) {
1303 		kmem_free(*shbasep, *shsizep);
1304 		kmem_free(*shstrbasep, *shstrsizep);
1305 		return (err);
1306 	}
1307 
1308 	/*
1309 	 * Make sure the strtab is null-terminated to make sure we
1310 	 * don't run off the end of the table.
1311 	 */
1312 	(*shstrbasep)[*shstrsizep - 1] = '\0';
1313 
1314 	return (0);
1315 }
1316 
1317 static int
1318 mapelfexec(
1319 	vnode_t *vp,
1320 	Ehdr *ehdr,
1321 	int nphdrs,
1322 	caddr_t phdrbase,
1323 	Phdr **uphdr,
1324 	Phdr **intphdr,
1325 	Phdr **stphdr,
1326 	Phdr **dtphdr,
1327 	Phdr *dataphdrp,
1328 	caddr_t *bssbase,
1329 	caddr_t *brkbase,
1330 	intptr_t *voffset,
1331 	intptr_t *minaddr,
1332 	size_t len,
1333 	long *execsz,
1334 	size_t *brksize)
1335 {
1336 	Phdr *phdr;
1337 	int i, prot, error;
1338 	caddr_t addr = NULL;
1339 	size_t zfodsz;
1340 	int ptload = 0;
1341 	int page;
1342 	off_t offset;
1343 	int hsize = ehdr->e_phentsize;
1344 	caddr_t mintmp = (caddr_t)-1;
1345 	extern int use_brk_lpg;
1346 
1347 	if (ehdr->e_type == ET_DYN) {
1348 		secflagset_t flags = 0;
1349 		/*
1350 		 * Obtain the virtual address of a hole in the
1351 		 * address space to map the "interpreter".
1352 		 */
1353 		if (secflag_enabled(curproc, PROC_SEC_ASLR))
1354 			flags |= _MAP_RANDOMIZE;
1355 
1356 		map_addr(&addr, len, (offset_t)0, 1, flags);
1357 		if (addr == NULL)
1358 			return (ENOMEM);
1359 		*voffset = (intptr_t)addr;
1360 
1361 		/*
1362 		 * Calculate the minimum vaddr so it can be subtracted out.
1363 		 * According to the ELF specification, since PT_LOAD sections
1364 		 * must be sorted by increasing p_vaddr values, this is
1365 		 * guaranteed to be the first PT_LOAD section.
1366 		 */
1367 		phdr = (Phdr *)phdrbase;
1368 		for (i = nphdrs; i > 0; i--) {
1369 			if (phdr->p_type == PT_LOAD) {
1370 				*voffset -= (uintptr_t)phdr->p_vaddr;
1371 				break;
1372 			}
1373 			phdr = (Phdr *)((caddr_t)phdr + hsize);
1374 		}
1375 
1376 	} else {
1377 		*voffset = 0;
1378 	}
1379 	phdr = (Phdr *)phdrbase;
1380 	for (i = nphdrs; i > 0; i--) {
1381 		switch (phdr->p_type) {
1382 		case PT_LOAD:
1383 			if ((*intphdr != NULL) && (*uphdr == NULL))
1384 				return (0);
1385 
1386 			ptload = 1;
1387 			prot = PROT_USER;
1388 			if (phdr->p_flags & PF_R)
1389 				prot |= PROT_READ;
1390 			if (phdr->p_flags & PF_W)
1391 				prot |= PROT_WRITE;
1392 			if (phdr->p_flags & PF_X)
1393 				prot |= PROT_EXEC;
1394 
1395 			addr = (caddr_t)((uintptr_t)phdr->p_vaddr + *voffset);
1396 
1397 			/*
1398 			 * Keep track of the segment with the lowest starting
1399 			 * address.
1400 			 */
1401 			if (addr < mintmp)
1402 				mintmp = addr;
1403 
1404 			zfodsz = (size_t)phdr->p_memsz - phdr->p_filesz;
1405 
1406 			offset = phdr->p_offset;
1407 			if (((uintptr_t)offset & PAGEOFFSET) ==
1408 			    ((uintptr_t)addr & PAGEOFFSET) &&
1409 			    (!(vp->v_flag & VNOMAP))) {
1410 				page = 1;
1411 			} else {
1412 				page = 0;
1413 			}
1414 
1415 			/*
1416 			 * Set the heap pagesize for OOB when the bss size
1417 			 * is known and use_brk_lpg is not 0.
1418 			 */
1419 			if (brksize != NULL && use_brk_lpg &&
1420 			    zfodsz != 0 && phdr == dataphdrp &&
1421 			    (prot & PROT_WRITE)) {
1422 				size_t tlen = P2NPHASE((uintptr_t)addr +
1423 				    phdr->p_filesz, PAGESIZE);
1424 
1425 				if (zfodsz > tlen) {
1426 					curproc->p_brkpageszc =
1427 					    page_szc(map_pgsz(MAPPGSZ_HEAP,
1428 					    curproc, addr + phdr->p_filesz +
1429 					    tlen, zfodsz - tlen, 0));
1430 				}
1431 			}
1432 
1433 			if (curproc->p_brkpageszc != 0 && phdr == dataphdrp &&
1434 			    (prot & PROT_WRITE)) {
1435 				uint_t	szc = curproc->p_brkpageszc;
1436 				size_t pgsz = page_get_pagesize(szc);
1437 				caddr_t ebss = addr + phdr->p_memsz;
1438 				/*
1439 				 * If we need extra space to keep the BSS an
1440 				 * integral number of pages in size, some of
1441 				 * that space may fall beyond p_brkbase, so we
1442 				 * need to set p_brksize to account for it
1443 				 * being (logically) part of the brk.
1444 				 */
1445 				size_t extra_zfodsz;
1446 
1447 				ASSERT(pgsz > PAGESIZE);
1448 
1449 				extra_zfodsz = P2NPHASE((uintptr_t)ebss, pgsz);
1450 
1451 				if (error = execmap(vp, addr, phdr->p_filesz,
1452 				    zfodsz + extra_zfodsz, phdr->p_offset,
1453 				    prot, page, szc))
1454 					goto bad;
1455 				if (brksize != NULL)
1456 					*brksize = extra_zfodsz;
1457 			} else {
1458 				if (error = execmap(vp, addr, phdr->p_filesz,
1459 				    zfodsz, phdr->p_offset, prot, page, 0))
1460 					goto bad;
1461 			}
1462 
1463 			if (bssbase != NULL && addr >= *bssbase &&
1464 			    phdr == dataphdrp) {
1465 				*bssbase = addr + phdr->p_filesz;
1466 			}
1467 			if (brkbase != NULL && addr >= *brkbase) {
1468 				*brkbase = addr + phdr->p_memsz;
1469 			}
1470 
1471 			*execsz += btopr(phdr->p_memsz);
1472 			break;
1473 
1474 		case PT_INTERP:
1475 			if (ptload)
1476 				goto bad;
1477 			*intphdr = phdr;
1478 			break;
1479 
1480 		case PT_SHLIB:
1481 			*stphdr = phdr;
1482 			break;
1483 
1484 		case PT_PHDR:
1485 			if (ptload)
1486 				goto bad;
1487 			*uphdr = phdr;
1488 			break;
1489 
1490 		case PT_NULL:
1491 		case PT_DYNAMIC:
1492 		case PT_NOTE:
1493 			break;
1494 
1495 		case PT_SUNWDTRACE:
1496 			if (dtphdr != NULL)
1497 				*dtphdr = phdr;
1498 			break;
1499 
1500 		default:
1501 			break;
1502 		}
1503 		phdr = (Phdr *)((caddr_t)phdr + hsize);
1504 	}
1505 
1506 	if (minaddr != NULL) {
1507 		ASSERT(mintmp != (caddr_t)-1);
1508 		*minaddr = (intptr_t)mintmp;
1509 	}
1510 
1511 	if (brkbase != NULL && secflag_enabled(curproc, PROC_SEC_ASLR)) {
1512 		size_t off;
1513 		uintptr_t base = (uintptr_t)*brkbase;
1514 		uintptr_t oend = base + *brksize;
1515 
1516 		ASSERT(ISP2(aslr_max_brk_skew));
1517 
1518 		(void) random_get_pseudo_bytes((uint8_t *)&off, sizeof (off));
1519 		base += P2PHASE(off, aslr_max_brk_skew);
1520 		base = P2ROUNDUP(base, PAGESIZE);
1521 		*brkbase = (caddr_t)base;
1522 		/*
1523 		 * Above, we set *brksize to account for the possibility we
1524 		 * had to grow the 'brk' in padding out the BSS to a page
1525 		 * boundary.
1526 		 *
1527 		 * We now need to adjust that based on where we now are
1528 		 * actually putting the brk.
1529 		 */
1530 		if (oend > base)
1531 			*brksize = oend - base;
1532 		else
1533 			*brksize = 0;
1534 	}
1535 
1536 	return (0);
1537 bad:
1538 	if (error == 0)
1539 		error = EINVAL;
1540 	return (error);
1541 }
1542 
1543 int
1544 elfnote(vnode_t *vp, offset_t *offsetp, int type, int descsz, void *desc,
1545     rlim64_t rlimit, cred_t *credp)
1546 {
1547 	Note note;
1548 	int error;
1549 
1550 	bzero(&note, sizeof (note));
1551 	bcopy("CORE", note.name, 4);
1552 	note.nhdr.n_type = type;
1553 	/*
1554 	 * The System V ABI states that n_namesz must be the length of the
1555 	 * string that follows the Nhdr structure including the terminating
1556 	 * null. The ABI also specifies that sufficient padding should be
1557 	 * included so that the description that follows the name string
1558 	 * begins on a 4- or 8-byte boundary for 32- and 64-bit binaries
1559 	 * respectively. However, since this change was not made correctly
1560 	 * at the time of the 64-bit port, both 32- and 64-bit binaries
1561 	 * descriptions are only guaranteed to begin on a 4-byte boundary.
1562 	 */
1563 	note.nhdr.n_namesz = 5;
1564 	note.nhdr.n_descsz = roundup(descsz, sizeof (Word));
1565 
1566 	if (error = core_write(vp, UIO_SYSSPACE, *offsetp, &note,
1567 	    sizeof (note), rlimit, credp))
1568 		return (error);
1569 
1570 	*offsetp += sizeof (note);
1571 
1572 	if (error = core_write(vp, UIO_SYSSPACE, *offsetp, desc,
1573 	    note.nhdr.n_descsz, rlimit, credp))
1574 		return (error);
1575 
1576 	*offsetp += note.nhdr.n_descsz;
1577 	return (0);
1578 }
1579 
1580 /*
1581  * Copy the section data from one vnode to the section of another vnode.
1582  */
1583 static void
1584 copy_scn(Shdr *src, vnode_t *src_vp, Shdr *dst, vnode_t *dst_vp, Off *doffset,
1585     void *buf, size_t size, cred_t *credp, rlim64_t rlimit)
1586 {
1587 	ssize_t resid;
1588 	size_t len, n = src->sh_size;
1589 	offset_t off = 0;
1590 
1591 	while (n != 0) {
1592 		len = MIN(size, n);
1593 		if (vn_rdwr(UIO_READ, src_vp, buf, len, src->sh_offset + off,
1594 		    UIO_SYSSPACE, 0, (rlim64_t)0, credp, &resid) != 0 ||
1595 		    resid >= len ||
1596 		    core_write(dst_vp, UIO_SYSSPACE, *doffset + off,
1597 		    buf, len - resid, rlimit, credp) != 0) {
1598 			dst->sh_size = 0;
1599 			dst->sh_offset = 0;
1600 			return;
1601 		}
1602 
1603 		ASSERT(n >= len - resid);
1604 
1605 		n -= len - resid;
1606 		off += len - resid;
1607 	}
1608 
1609 	*doffset += src->sh_size;
1610 }
1611 
1612 #ifdef _ELF32_COMPAT
1613 extern size_t elf_datasz_max;
1614 #else
1615 size_t elf_datasz_max = 1 * 1024 * 1024;
1616 #endif
1617 
1618 /*
1619  * This function processes mappings that correspond to load objects to
1620  * examine their respective sections for elfcore(). It's called once with
1621  * v set to NULL to count the number of sections that we're going to need
1622  * and then again with v set to some allocated buffer that we fill in with
1623  * all the section data.
1624  */
1625 static int
1626 process_scns(core_content_t content, proc_t *p, cred_t *credp, vnode_t *vp,
1627     Shdr *v, int nv, rlim64_t rlimit, Off *doffsetp, int *nshdrsp)
1628 {
1629 	vnode_t *lastvp = NULL;
1630 	struct seg *seg;
1631 	int i, j;
1632 	void *data = NULL;
1633 	size_t datasz = 0;
1634 	shstrtab_t shstrtab;
1635 	struct as *as = p->p_as;
1636 	int error = 0;
1637 
1638 	if (v != NULL)
1639 		shstrtab_init(&shstrtab);
1640 
1641 	i = 1;
1642 	for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
1643 		uint_t prot;
1644 		vnode_t *mvp;
1645 		void *tmp = NULL;
1646 		caddr_t saddr = seg->s_base;
1647 		caddr_t naddr;
1648 		caddr_t eaddr;
1649 		size_t segsize;
1650 
1651 		Ehdr ehdr;
1652 		int nshdrs, shstrndx, nphdrs;
1653 		caddr_t shbase;
1654 		ssize_t shsize;
1655 		char *shstrbase;
1656 		ssize_t shstrsize;
1657 
1658 		Shdr *shdr;
1659 		const char *name;
1660 		size_t sz;
1661 		uintptr_t off;
1662 
1663 		int ctf_ndx = 0;
1664 		int symtab_ndx = 0;
1665 
1666 		/*
1667 		 * Since we're just looking for text segments of load
1668 		 * objects, we only care about the protection bits; we don't
1669 		 * care about the actual size of the segment so we use the
1670 		 * reserved size. If the segment's size is zero, there's
1671 		 * something fishy going on so we ignore this segment.
1672 		 */
1673 		if (seg->s_ops != &segvn_ops ||
1674 		    SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 ||
1675 		    mvp == lastvp || mvp == NULL || mvp->v_type != VREG ||
1676 		    (segsize = pr_getsegsize(seg, 1)) == 0)
1677 			continue;
1678 
1679 		eaddr = saddr + segsize;
1680 		prot = pr_getprot(seg, 1, &tmp, &saddr, &naddr, eaddr);
1681 		pr_getprot_done(&tmp);
1682 
1683 		/*
1684 		 * Skip this segment unless the protection bits look like
1685 		 * what we'd expect for a text segment.
1686 		 */
1687 		if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC)
1688 			continue;
1689 
1690 		if (getelfhead(mvp, credp, &ehdr, &nshdrs, &shstrndx,
1691 		    &nphdrs) != 0 ||
1692 		    getelfshdr(mvp, credp, &ehdr, nshdrs, shstrndx,
1693 		    &shbase, &shsize, &shstrbase, &shstrsize) != 0)
1694 			continue;
1695 
1696 		off = ehdr.e_shentsize;
1697 		for (j = 1; j < nshdrs; j++, off += ehdr.e_shentsize) {
1698 			Shdr *symtab = NULL, *strtab;
1699 
1700 			shdr = (Shdr *)(shbase + off);
1701 
1702 			if (shdr->sh_name >= shstrsize)
1703 				continue;
1704 
1705 			name = shstrbase + shdr->sh_name;
1706 
1707 			if (strcmp(name, shstrtab_data[STR_CTF]) == 0) {
1708 				if ((content & CC_CONTENT_CTF) == 0 ||
1709 				    ctf_ndx != 0)
1710 					continue;
1711 
1712 				if (shdr->sh_link > 0 &&
1713 				    shdr->sh_link < nshdrs) {
1714 					symtab = (Shdr *)(shbase +
1715 					    shdr->sh_link * ehdr.e_shentsize);
1716 				}
1717 
1718 				if (v != NULL && i < nv - 1) {
1719 					if (shdr->sh_size > datasz &&
1720 					    shdr->sh_size <= elf_datasz_max) {
1721 						if (data != NULL)
1722 							kmem_free(data, datasz);
1723 
1724 						datasz = shdr->sh_size;
1725 						data = kmem_alloc(datasz,
1726 						    KM_SLEEP);
1727 					}
1728 
1729 					v[i].sh_name = shstrtab_ndx(&shstrtab,
1730 					    STR_CTF);
1731 					v[i].sh_addr = (Addr)(uintptr_t)saddr;
1732 					v[i].sh_type = SHT_PROGBITS;
1733 					v[i].sh_addralign = 4;
1734 					*doffsetp = roundup(*doffsetp,
1735 					    v[i].sh_addralign);
1736 					v[i].sh_offset = *doffsetp;
1737 					v[i].sh_size = shdr->sh_size;
1738 					if (symtab == NULL)  {
1739 						v[i].sh_link = 0;
1740 					} else if (symtab->sh_type ==
1741 					    SHT_SYMTAB &&
1742 					    symtab_ndx != 0) {
1743 						v[i].sh_link =
1744 						    symtab_ndx;
1745 					} else {
1746 						v[i].sh_link = i + 1;
1747 					}
1748 
1749 					copy_scn(shdr, mvp, &v[i], vp,
1750 					    doffsetp, data, datasz, credp,
1751 					    rlimit);
1752 				}
1753 
1754 				ctf_ndx = i++;
1755 
1756 				/*
1757 				 * We've already dumped the symtab.
1758 				 */
1759 				if (symtab != NULL &&
1760 				    symtab->sh_type == SHT_SYMTAB &&
1761 				    symtab_ndx != 0)
1762 					continue;
1763 
1764 			} else if (strcmp(name,
1765 			    shstrtab_data[STR_SYMTAB]) == 0) {
1766 				if ((content & CC_CONTENT_SYMTAB) == 0 ||
1767 				    symtab != 0)
1768 					continue;
1769 
1770 				symtab = shdr;
1771 			}
1772 
1773 			if (symtab != NULL) {
1774 				if ((symtab->sh_type != SHT_DYNSYM &&
1775 				    symtab->sh_type != SHT_SYMTAB) ||
1776 				    symtab->sh_link == 0 ||
1777 				    symtab->sh_link >= nshdrs)
1778 					continue;
1779 
1780 				strtab = (Shdr *)(shbase +
1781 				    symtab->sh_link * ehdr.e_shentsize);
1782 
1783 				if (strtab->sh_type != SHT_STRTAB)
1784 					continue;
1785 
1786 				if (v != NULL && i < nv - 2) {
1787 					sz = MAX(symtab->sh_size,
1788 					    strtab->sh_size);
1789 					if (sz > datasz &&
1790 					    sz <= elf_datasz_max) {
1791 						if (data != NULL)
1792 							kmem_free(data, datasz);
1793 
1794 						datasz = sz;
1795 						data = kmem_alloc(datasz,
1796 						    KM_SLEEP);
1797 					}
1798 
1799 					if (symtab->sh_type == SHT_DYNSYM) {
1800 						v[i].sh_name = shstrtab_ndx(
1801 						    &shstrtab, STR_DYNSYM);
1802 						v[i + 1].sh_name = shstrtab_ndx(
1803 						    &shstrtab, STR_DYNSTR);
1804 					} else {
1805 						v[i].sh_name = shstrtab_ndx(
1806 						    &shstrtab, STR_SYMTAB);
1807 						v[i + 1].sh_name = shstrtab_ndx(
1808 						    &shstrtab, STR_STRTAB);
1809 					}
1810 
1811 					v[i].sh_type = symtab->sh_type;
1812 					v[i].sh_addr = symtab->sh_addr;
1813 					if (ehdr.e_type == ET_DYN ||
1814 					    v[i].sh_addr == 0)
1815 						v[i].sh_addr +=
1816 						    (Addr)(uintptr_t)saddr;
1817 					v[i].sh_addralign =
1818 					    symtab->sh_addralign;
1819 					*doffsetp = roundup(*doffsetp,
1820 					    v[i].sh_addralign);
1821 					v[i].sh_offset = *doffsetp;
1822 					v[i].sh_size = symtab->sh_size;
1823 					v[i].sh_link = i + 1;
1824 					v[i].sh_entsize = symtab->sh_entsize;
1825 					v[i].sh_info = symtab->sh_info;
1826 
1827 					copy_scn(symtab, mvp, &v[i], vp,
1828 					    doffsetp, data, datasz, credp,
1829 					    rlimit);
1830 
1831 					v[i + 1].sh_type = SHT_STRTAB;
1832 					v[i + 1].sh_flags = SHF_STRINGS;
1833 					v[i + 1].sh_addr = symtab->sh_addr;
1834 					if (ehdr.e_type == ET_DYN ||
1835 					    v[i + 1].sh_addr == 0)
1836 						v[i + 1].sh_addr +=
1837 						    (Addr)(uintptr_t)saddr;
1838 					v[i + 1].sh_addralign =
1839 					    strtab->sh_addralign;
1840 					*doffsetp = roundup(*doffsetp,
1841 					    v[i + 1].sh_addralign);
1842 					v[i + 1].sh_offset = *doffsetp;
1843 					v[i + 1].sh_size = strtab->sh_size;
1844 
1845 					copy_scn(strtab, mvp, &v[i + 1], vp,
1846 					    doffsetp, data, datasz, credp,
1847 					    rlimit);
1848 				}
1849 
1850 				if (symtab->sh_type == SHT_SYMTAB)
1851 					symtab_ndx = i;
1852 				i += 2;
1853 			}
1854 		}
1855 
1856 		kmem_free(shstrbase, shstrsize);
1857 		kmem_free(shbase, shsize);
1858 
1859 		lastvp = mvp;
1860 	}
1861 
1862 	if (v == NULL) {
1863 		if (i == 1)
1864 			*nshdrsp = 0;
1865 		else
1866 			*nshdrsp = i + 1;
1867 		goto done;
1868 	}
1869 
1870 	if (i != nv - 1) {
1871 		cmn_err(CE_WARN, "elfcore: core dump failed for "
1872 		    "process %d; address space is changing", p->p_pid);
1873 		error = EIO;
1874 		goto done;
1875 	}
1876 
1877 	v[i].sh_name = shstrtab_ndx(&shstrtab, STR_SHSTRTAB);
1878 	v[i].sh_size = shstrtab_size(&shstrtab);
1879 	v[i].sh_addralign = 1;
1880 	*doffsetp = roundup(*doffsetp, v[i].sh_addralign);
1881 	v[i].sh_offset = *doffsetp;
1882 	v[i].sh_flags = SHF_STRINGS;
1883 	v[i].sh_type = SHT_STRTAB;
1884 
1885 	if (v[i].sh_size > datasz) {
1886 		if (data != NULL)
1887 			kmem_free(data, datasz);
1888 
1889 		datasz = v[i].sh_size;
1890 		data = kmem_alloc(datasz,
1891 		    KM_SLEEP);
1892 	}
1893 
1894 	shstrtab_dump(&shstrtab, data);
1895 
1896 	if ((error = core_write(vp, UIO_SYSSPACE, *doffsetp,
1897 	    data, v[i].sh_size, rlimit, credp)) != 0)
1898 		goto done;
1899 
1900 	*doffsetp += v[i].sh_size;
1901 
1902 done:
1903 	if (data != NULL)
1904 		kmem_free(data, datasz);
1905 
1906 	return (error);
1907 }
1908 
1909 int
1910 elfcore(vnode_t *vp, proc_t *p, cred_t *credp, rlim64_t rlimit, int sig,
1911     core_content_t content)
1912 {
1913 	offset_t poffset, soffset;
1914 	Off doffset;
1915 	int error, i, nphdrs, nshdrs;
1916 	int overflow = 0;
1917 	struct seg *seg;
1918 	struct as *as = p->p_as;
1919 	union {
1920 		Ehdr ehdr;
1921 		Phdr phdr[1];
1922 		Shdr shdr[1];
1923 	} *bigwad;
1924 	size_t bigsize;
1925 	size_t phdrsz, shdrsz;
1926 	Ehdr *ehdr;
1927 	Phdr *v;
1928 	caddr_t brkbase;
1929 	size_t brksize;
1930 	caddr_t stkbase;
1931 	size_t stksize;
1932 	int ntries = 0;
1933 	klwp_t *lwp = ttolwp(curthread);
1934 
1935 top:
1936 	/*
1937 	 * Make sure we have everything we need (registers, etc.).
1938 	 * All other lwps have already stopped and are in an orderly state.
1939 	 */
1940 	ASSERT(p == ttoproc(curthread));
1941 	prstop(0, 0);
1942 
1943 	AS_LOCK_ENTER(as, RW_WRITER);
1944 	nphdrs = prnsegs(as, 0) + 2;		/* two CORE note sections */
1945 
1946 	/*
1947 	 * Count the number of section headers we're going to need.
1948 	 */
1949 	nshdrs = 0;
1950 	if (content & (CC_CONTENT_CTF | CC_CONTENT_SYMTAB)) {
1951 		(void) process_scns(content, p, credp, NULL, NULL, NULL, 0,
1952 		    NULL, &nshdrs);
1953 	}
1954 	AS_LOCK_EXIT(as);
1955 
1956 	ASSERT(nshdrs == 0 || nshdrs > 1);
1957 
1958 	/*
1959 	 * The core file contents may required zero section headers, but if
1960 	 * we overflow the 16 bits allotted to the program header count in
1961 	 * the ELF header, we'll need that program header at index zero.
1962 	 */
1963 	if (nshdrs == 0 && nphdrs >= PN_XNUM)
1964 		nshdrs = 1;
1965 
1966 	phdrsz = nphdrs * sizeof (Phdr);
1967 	shdrsz = nshdrs * sizeof (Shdr);
1968 
1969 	bigsize = MAX(sizeof (*bigwad), MAX(phdrsz, shdrsz));
1970 	bigwad = kmem_alloc(bigsize, KM_SLEEP);
1971 
1972 	ehdr = &bigwad->ehdr;
1973 	bzero(ehdr, sizeof (*ehdr));
1974 
1975 	ehdr->e_ident[EI_MAG0] = ELFMAG0;
1976 	ehdr->e_ident[EI_MAG1] = ELFMAG1;
1977 	ehdr->e_ident[EI_MAG2] = ELFMAG2;
1978 	ehdr->e_ident[EI_MAG3] = ELFMAG3;
1979 	ehdr->e_ident[EI_CLASS] = ELFCLASS;
1980 	ehdr->e_type = ET_CORE;
1981 
1982 #if !defined(_LP64) || defined(_ELF32_COMPAT)
1983 
1984 #if defined(__sparc)
1985 	ehdr->e_ident[EI_DATA] = ELFDATA2MSB;
1986 	ehdr->e_machine = EM_SPARC;
1987 #elif defined(__i386) || defined(__i386_COMPAT)
1988 	ehdr->e_ident[EI_DATA] = ELFDATA2LSB;
1989 	ehdr->e_machine = EM_386;
1990 #else
1991 #error "no recognized machine type is defined"
1992 #endif
1993 
1994 #else	/* !defined(_LP64) || defined(_ELF32_COMPAT) */
1995 
1996 #if defined(__sparc)
1997 	ehdr->e_ident[EI_DATA] = ELFDATA2MSB;
1998 	ehdr->e_machine = EM_SPARCV9;
1999 #elif defined(__amd64)
2000 	ehdr->e_ident[EI_DATA] = ELFDATA2LSB;
2001 	ehdr->e_machine = EM_AMD64;
2002 #else
2003 #error "no recognized 64-bit machine type is defined"
2004 #endif
2005 
2006 #endif	/* !defined(_LP64) || defined(_ELF32_COMPAT) */
2007 
2008 	/*
2009 	 * If the count of program headers or section headers or the index
2010 	 * of the section string table can't fit in the mere 16 bits
2011 	 * shortsightedly allotted to them in the ELF header, we use the
2012 	 * extended formats and put the real values in the section header
2013 	 * as index 0.
2014 	 */
2015 	ehdr->e_version = EV_CURRENT;
2016 	ehdr->e_ehsize = sizeof (Ehdr);
2017 
2018 	if (nphdrs >= PN_XNUM)
2019 		ehdr->e_phnum = PN_XNUM;
2020 	else
2021 		ehdr->e_phnum = (unsigned short)nphdrs;
2022 
2023 	ehdr->e_phoff = sizeof (Ehdr);
2024 	ehdr->e_phentsize = sizeof (Phdr);
2025 
2026 	if (nshdrs > 0) {
2027 		if (nshdrs >= SHN_LORESERVE)
2028 			ehdr->e_shnum = 0;
2029 		else
2030 			ehdr->e_shnum = (unsigned short)nshdrs;
2031 
2032 		if (nshdrs - 1 >= SHN_LORESERVE)
2033 			ehdr->e_shstrndx = SHN_XINDEX;
2034 		else
2035 			ehdr->e_shstrndx = (unsigned short)(nshdrs - 1);
2036 
2037 		ehdr->e_shoff = ehdr->e_phoff + ehdr->e_phentsize * nphdrs;
2038 		ehdr->e_shentsize = sizeof (Shdr);
2039 	}
2040 
2041 	if (error = core_write(vp, UIO_SYSSPACE, (offset_t)0, ehdr,
2042 	    sizeof (Ehdr), rlimit, credp))
2043 		goto done;
2044 
2045 	poffset = sizeof (Ehdr);
2046 	soffset = sizeof (Ehdr) + phdrsz;
2047 	doffset = sizeof (Ehdr) + phdrsz + shdrsz;
2048 
2049 	v = &bigwad->phdr[0];
2050 	bzero(v, phdrsz);
2051 
2052 	setup_old_note_header(&v[0], p);
2053 	v[0].p_offset = doffset = roundup(doffset, sizeof (Word));
2054 	doffset += v[0].p_filesz;
2055 
2056 	setup_note_header(&v[1], p);
2057 	v[1].p_offset = doffset = roundup(doffset, sizeof (Word));
2058 	doffset += v[1].p_filesz;
2059 
2060 	mutex_enter(&p->p_lock);
2061 
2062 	brkbase = p->p_brkbase;
2063 	brksize = p->p_brksize;
2064 
2065 	stkbase = p->p_usrstack - p->p_stksize;
2066 	stksize = p->p_stksize;
2067 
2068 	mutex_exit(&p->p_lock);
2069 
2070 	AS_LOCK_ENTER(as, RW_WRITER);
2071 	i = 2;
2072 	for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
2073 		caddr_t eaddr = seg->s_base + pr_getsegsize(seg, 0);
2074 		caddr_t saddr, naddr;
2075 		void *tmp = NULL;
2076 		extern struct seg_ops segspt_shmops;
2077 
2078 		if ((seg->s_flags & S_HOLE) != 0) {
2079 			continue;
2080 		}
2081 
2082 		for (saddr = seg->s_base; saddr < eaddr; saddr = naddr) {
2083 			uint_t prot;
2084 			size_t size;
2085 			int type;
2086 			vnode_t *mvp;
2087 
2088 			prot = pr_getprot(seg, 0, &tmp, &saddr, &naddr, eaddr);
2089 			prot &= PROT_READ | PROT_WRITE | PROT_EXEC;
2090 			if ((size = (size_t)(naddr - saddr)) == 0)
2091 				continue;
2092 			if (i == nphdrs) {
2093 				overflow++;
2094 				continue;
2095 			}
2096 			v[i].p_type = PT_LOAD;
2097 			v[i].p_vaddr = (Addr)(uintptr_t)saddr;
2098 			v[i].p_memsz = size;
2099 			if (prot & PROT_READ)
2100 				v[i].p_flags |= PF_R;
2101 			if (prot & PROT_WRITE)
2102 				v[i].p_flags |= PF_W;
2103 			if (prot & PROT_EXEC)
2104 				v[i].p_flags |= PF_X;
2105 
2106 			/*
2107 			 * Figure out which mappings to include in the core.
2108 			 */
2109 			type = SEGOP_GETTYPE(seg, saddr);
2110 
2111 			if (saddr == stkbase && size == stksize) {
2112 				if (!(content & CC_CONTENT_STACK))
2113 					goto exclude;
2114 
2115 			} else if (saddr == brkbase && size == brksize) {
2116 				if (!(content & CC_CONTENT_HEAP))
2117 					goto exclude;
2118 
2119 			} else if (seg->s_ops == &segspt_shmops) {
2120 				if (type & MAP_NORESERVE) {
2121 					if (!(content & CC_CONTENT_DISM))
2122 						goto exclude;
2123 				} else {
2124 					if (!(content & CC_CONTENT_ISM))
2125 						goto exclude;
2126 				}
2127 
2128 			} else if (seg->s_ops != &segvn_ops) {
2129 				goto exclude;
2130 
2131 			} else if (type & MAP_SHARED) {
2132 				if (shmgetid(p, saddr) != SHMID_NONE) {
2133 					if (!(content & CC_CONTENT_SHM))
2134 						goto exclude;
2135 
2136 				} else if (SEGOP_GETVP(seg, seg->s_base,
2137 				    &mvp) != 0 || mvp == NULL ||
2138 				    mvp->v_type != VREG) {
2139 					if (!(content & CC_CONTENT_SHANON))
2140 						goto exclude;
2141 
2142 				} else {
2143 					if (!(content & CC_CONTENT_SHFILE))
2144 						goto exclude;
2145 				}
2146 
2147 			} else if (SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 ||
2148 			    mvp == NULL || mvp->v_type != VREG) {
2149 				if (!(content & CC_CONTENT_ANON))
2150 					goto exclude;
2151 
2152 			} else if (prot == (PROT_READ | PROT_EXEC)) {
2153 				if (!(content & CC_CONTENT_TEXT))
2154 					goto exclude;
2155 
2156 			} else if (prot == PROT_READ) {
2157 				if (!(content & CC_CONTENT_RODATA))
2158 					goto exclude;
2159 
2160 			} else {
2161 				if (!(content & CC_CONTENT_DATA))
2162 					goto exclude;
2163 			}
2164 
2165 			doffset = roundup(doffset, sizeof (Word));
2166 			v[i].p_offset = doffset;
2167 			v[i].p_filesz = size;
2168 			doffset += size;
2169 exclude:
2170 			i++;
2171 		}
2172 		ASSERT(tmp == NULL);
2173 	}
2174 	AS_LOCK_EXIT(as);
2175 
2176 	if (overflow || i != nphdrs) {
2177 		if (ntries++ == 0) {
2178 			kmem_free(bigwad, bigsize);
2179 			overflow = 0;
2180 			goto top;
2181 		}
2182 		cmn_err(CE_WARN, "elfcore: core dump failed for "
2183 		    "process %d; address space is changing", p->p_pid);
2184 		error = EIO;
2185 		goto done;
2186 	}
2187 
2188 	if ((error = core_write(vp, UIO_SYSSPACE, poffset,
2189 	    v, phdrsz, rlimit, credp)) != 0)
2190 		goto done;
2191 
2192 	if ((error = write_old_elfnotes(p, sig, vp, v[0].p_offset, rlimit,
2193 	    credp)) != 0)
2194 		goto done;
2195 
2196 	if ((error = write_elfnotes(p, sig, vp, v[1].p_offset, rlimit,
2197 	    credp, content)) != 0)
2198 		goto done;
2199 
2200 	for (i = 2; i < nphdrs; i++) {
2201 		prkillinfo_t killinfo;
2202 		sigqueue_t *sq;
2203 		int sig, j;
2204 
2205 		if (v[i].p_filesz == 0)
2206 			continue;
2207 
2208 		/*
2209 		 * If dumping out this segment fails, rather than failing
2210 		 * the core dump entirely, we reset the size of the mapping
2211 		 * to zero to indicate that the data is absent from the core
2212 		 * file and or in the PF_SUNW_FAILURE flag to differentiate
2213 		 * this from mappings that were excluded due to the core file
2214 		 * content settings.
2215 		 */
2216 		if ((error = core_seg(p, vp, v[i].p_offset,
2217 		    (caddr_t)(uintptr_t)v[i].p_vaddr, v[i].p_filesz,
2218 		    rlimit, credp)) == 0) {
2219 			continue;
2220 		}
2221 
2222 		if ((sig = lwp->lwp_cursig) == 0) {
2223 			/*
2224 			 * We failed due to something other than a signal.
2225 			 * Since the space reserved for the segment is now
2226 			 * unused, we stash the errno in the first four
2227 			 * bytes. This undocumented interface will let us
2228 			 * understand the nature of the failure.
2229 			 */
2230 			(void) core_write(vp, UIO_SYSSPACE, v[i].p_offset,
2231 			    &error, sizeof (error), rlimit, credp);
2232 
2233 			v[i].p_filesz = 0;
2234 			v[i].p_flags |= PF_SUNW_FAILURE;
2235 			if ((error = core_write(vp, UIO_SYSSPACE,
2236 			    poffset + sizeof (v[i]) * i, &v[i], sizeof (v[i]),
2237 			    rlimit, credp)) != 0)
2238 				goto done;
2239 
2240 			continue;
2241 		}
2242 
2243 		/*
2244 		 * We took a signal.  We want to abort the dump entirely, but
2245 		 * we also want to indicate what failed and why.  We therefore
2246 		 * use the space reserved for the first failing segment to
2247 		 * write our error (which, for purposes of compatability with
2248 		 * older core dump readers, we set to EINTR) followed by any
2249 		 * siginfo associated with the signal.
2250 		 */
2251 		bzero(&killinfo, sizeof (killinfo));
2252 		killinfo.prk_error = EINTR;
2253 
2254 		sq = sig == SIGKILL ? curproc->p_killsqp : lwp->lwp_curinfo;
2255 
2256 		if (sq != NULL) {
2257 			bcopy(&sq->sq_info, &killinfo.prk_info,
2258 			    sizeof (sq->sq_info));
2259 		} else {
2260 			killinfo.prk_info.si_signo = lwp->lwp_cursig;
2261 			killinfo.prk_info.si_code = SI_NOINFO;
2262 		}
2263 
2264 #if (defined(_SYSCALL32_IMPL) || defined(_LP64))
2265 		/*
2266 		 * If this is a 32-bit process, we need to translate from the
2267 		 * native siginfo to the 32-bit variant.  (Core readers must
2268 		 * always have the same data model as their target or must
2269 		 * be aware of -- and compensate for -- data model differences.)
2270 		 */
2271 		if (curproc->p_model == DATAMODEL_ILP32) {
2272 			siginfo32_t si32;
2273 
2274 			siginfo_kto32((k_siginfo_t *)&killinfo.prk_info, &si32);
2275 			bcopy(&si32, &killinfo.prk_info, sizeof (si32));
2276 		}
2277 #endif
2278 
2279 		(void) core_write(vp, UIO_SYSSPACE, v[i].p_offset,
2280 		    &killinfo, sizeof (killinfo), rlimit, credp);
2281 
2282 		/*
2283 		 * For the segment on which we took the signal, indicate that
2284 		 * its data now refers to a siginfo.
2285 		 */
2286 		v[i].p_filesz = 0;
2287 		v[i].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED |
2288 		    PF_SUNW_SIGINFO;
2289 
2290 		/*
2291 		 * And for every other segment, indicate that its absence
2292 		 * is due to a signal.
2293 		 */
2294 		for (j = i + 1; j < nphdrs; j++) {
2295 			v[j].p_filesz = 0;
2296 			v[j].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED;
2297 		}
2298 
2299 		/*
2300 		 * Finally, write out our modified program headers.
2301 		 */
2302 		if ((error = core_write(vp, UIO_SYSSPACE,
2303 		    poffset + sizeof (v[i]) * i, &v[i],
2304 		    sizeof (v[i]) * (nphdrs - i), rlimit, credp)) != 0)
2305 			goto done;
2306 
2307 		break;
2308 	}
2309 
2310 	if (nshdrs > 0) {
2311 		bzero(&bigwad->shdr[0], shdrsz);
2312 
2313 		if (nshdrs >= SHN_LORESERVE)
2314 			bigwad->shdr[0].sh_size = nshdrs;
2315 
2316 		if (nshdrs - 1 >= SHN_LORESERVE)
2317 			bigwad->shdr[0].sh_link = nshdrs - 1;
2318 
2319 		if (nphdrs >= PN_XNUM)
2320 			bigwad->shdr[0].sh_info = nphdrs;
2321 
2322 		if (nshdrs > 1) {
2323 			AS_LOCK_ENTER(as, RW_WRITER);
2324 			if ((error = process_scns(content, p, credp, vp,
2325 			    &bigwad->shdr[0], nshdrs, rlimit, &doffset,
2326 			    NULL)) != 0) {
2327 				AS_LOCK_EXIT(as);
2328 				goto done;
2329 			}
2330 			AS_LOCK_EXIT(as);
2331 		}
2332 
2333 		if ((error = core_write(vp, UIO_SYSSPACE, soffset,
2334 		    &bigwad->shdr[0], shdrsz, rlimit, credp)) != 0)
2335 			goto done;
2336 	}
2337 
2338 done:
2339 	kmem_free(bigwad, bigsize);
2340 	return (error);
2341 }
2342 
2343 #ifndef	_ELF32_COMPAT
2344 
2345 static struct execsw esw = {
2346 #ifdef	_LP64
2347 	elf64magicstr,
2348 #else	/* _LP64 */
2349 	elf32magicstr,
2350 #endif	/* _LP64 */
2351 	0,
2352 	5,
2353 	elfexec,
2354 	elfcore
2355 };
2356 
2357 static struct modlexec modlexec = {
2358 	&mod_execops, "exec module for elf", &esw
2359 };
2360 
2361 #ifdef	_LP64
2362 extern int elf32exec(vnode_t *vp, execa_t *uap, uarg_t *args,
2363 			intpdata_t *idatap, int level, long *execsz,
2364 			int setid, caddr_t exec_file, cred_t *cred,
2365 			int brand_action);
2366 extern int elf32core(vnode_t *vp, proc_t *p, cred_t *credp,
2367 			rlim64_t rlimit, int sig, core_content_t content);
2368 
2369 static struct execsw esw32 = {
2370 	elf32magicstr,
2371 	0,
2372 	5,
2373 	elf32exec,
2374 	elf32core
2375 };
2376 
2377 static struct modlexec modlexec32 = {
2378 	&mod_execops, "32-bit exec module for elf", &esw32
2379 };
2380 #endif	/* _LP64 */
2381 
2382 static struct modlinkage modlinkage = {
2383 	MODREV_1,
2384 	(void *)&modlexec,
2385 #ifdef	_LP64
2386 	(void *)&modlexec32,
2387 #endif	/* _LP64 */
2388 	NULL
2389 };
2390 
2391 int
2392 _init(void)
2393 {
2394 	return (mod_install(&modlinkage));
2395 }
2396 
2397 int
2398 _fini(void)
2399 {
2400 	return (mod_remove(&modlinkage));
2401 }
2402 
2403 int
2404 _info(struct modinfo *modinfop)
2405 {
2406 	return (mod_info(&modlinkage, modinfop));
2407 }
2408 
2409 #endif	/* !_ELF32_COMPAT */
2410