xref: /illumos-gate/usr/src/uts/common/exec/elf/elf.c (revision 8654d0253136055bd4cc2423d87378e8a37f2eb5)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
28 /*	  All Rights Reserved  	*/
29 
30 
31 #pragma ident	"%Z%%M%	%I%	%E% SMI"
32 
33 #include <sys/types.h>
34 #include <sys/param.h>
35 #include <sys/thread.h>
36 #include <sys/sysmacros.h>
37 #include <sys/signal.h>
38 #include <sys/cred.h>
39 #include <sys/user.h>
40 #include <sys/errno.h>
41 #include <sys/vnode.h>
42 #include <sys/mman.h>
43 #include <sys/kmem.h>
44 #include <sys/proc.h>
45 #include <sys/pathname.h>
46 #include <sys/cmn_err.h>
47 #include <sys/systm.h>
48 #include <sys/elf.h>
49 #include <sys/vmsystm.h>
50 #include <sys/debug.h>
51 #include <sys/auxv.h>
52 #include <sys/exec.h>
53 #include <sys/prsystm.h>
54 #include <vm/as.h>
55 #include <vm/rm.h>
56 #include <vm/seg.h>
57 #include <vm/seg_vn.h>
58 #include <sys/modctl.h>
59 #include <sys/systeminfo.h>
60 #include <sys/vmparam.h>
61 #include <sys/machelf.h>
62 #include <sys/shm_impl.h>
63 #include <sys/archsystm.h>
64 #include <sys/fasttrap.h>
65 #include <sys/brand.h>
66 #include "elf_impl.h"
67 
68 #include <sys/sdt.h>
69 
70 extern int at_flags;
71 
72 #define	ORIGIN_STR	"ORIGIN"
73 #define	ORIGIN_STR_SIZE	6
74 
75 static int getelfhead(vnode_t *, cred_t *, Ehdr *, int *, int *, int *);
76 static int getelfphdr(vnode_t *, cred_t *, const Ehdr *, int, caddr_t *,
77     ssize_t *);
78 static int getelfshdr(vnode_t *, cred_t *, const Ehdr *, int, int, caddr_t *,
79     ssize_t *, caddr_t *, ssize_t *);
80 static size_t elfsize(Ehdr *, int, caddr_t, uintptr_t *);
81 static int mapelfexec(vnode_t *, Ehdr *, int, caddr_t,
82     Phdr **, Phdr **, Phdr **, Phdr **, Phdr *,
83     caddr_t *, caddr_t *, intptr_t *, intptr_t *, size_t, long *, size_t *);
84 
85 typedef enum {
86 	STR_CTF,
87 	STR_SYMTAB,
88 	STR_DYNSYM,
89 	STR_STRTAB,
90 	STR_DYNSTR,
91 	STR_SHSTRTAB,
92 	STR_NUM
93 } shstrtype_t;
94 
95 static const char *shstrtab_data[] = {
96 	".SUNW_ctf",
97 	".symtab",
98 	".dynsym",
99 	".strtab",
100 	".dynstr",
101 	".shstrtab"
102 };
103 
104 typedef struct shstrtab {
105 	int	sst_ndx[STR_NUM];
106 	int	sst_cur;
107 } shstrtab_t;
108 
109 static void
110 shstrtab_init(shstrtab_t *s)
111 {
112 	bzero(&s->sst_ndx, sizeof (s->sst_ndx));
113 	s->sst_cur = 1;
114 }
115 
116 static int
117 shstrtab_ndx(shstrtab_t *s, shstrtype_t type)
118 {
119 	int ret;
120 
121 	if ((ret = s->sst_ndx[type]) != 0)
122 		return (ret);
123 
124 	ret = s->sst_ndx[type] = s->sst_cur;
125 	s->sst_cur += strlen(shstrtab_data[type]) + 1;
126 
127 	return (ret);
128 }
129 
130 static size_t
131 shstrtab_size(const shstrtab_t *s)
132 {
133 	return (s->sst_cur);
134 }
135 
136 static void
137 shstrtab_dump(const shstrtab_t *s, char *buf)
138 {
139 	int i, ndx;
140 
141 	*buf = '\0';
142 	for (i = 0; i < STR_NUM; i++) {
143 		if ((ndx = s->sst_ndx[i]) != 0)
144 			(void) strcpy(buf + ndx, shstrtab_data[i]);
145 	}
146 }
147 
148 static int
149 dtrace_safe_phdr(Phdr *phdrp, struct uarg *args, uintptr_t base)
150 {
151 	ASSERT(phdrp->p_type == PT_SUNWDTRACE);
152 
153 	/*
154 	 * See the comment in fasttrap.h for information on how to safely
155 	 * update this program header.
156 	 */
157 	if (phdrp->p_memsz < PT_SUNWDTRACE_SIZE ||
158 	    (phdrp->p_flags & (PF_R | PF_W | PF_X)) != (PF_R | PF_W | PF_X))
159 		return (-1);
160 
161 	args->thrptr = phdrp->p_vaddr + base;
162 
163 	return (0);
164 }
165 
166 /*
167  * Map in the executable pointed to by vp. Returns 0 on success.
168  */
169 int
170 mapexec_brand(vnode_t *vp, uarg_t *args, Ehdr *ehdr, Addr *uphdr_vaddr,
171     intptr_t *voffset, caddr_t exec_file, int *interp, caddr_t *bssbase,
172     caddr_t *brkbase, size_t *brksize)
173 {
174 	size_t		len;
175 	struct vattr	vat;
176 	caddr_t		phdrbase = NULL;
177 	ssize_t		phdrsize;
178 	int		nshdrs, shstrndx, nphdrs;
179 	int		error = 0;
180 	Phdr		*uphdr = NULL;
181 	Phdr		*junk = NULL;
182 	Phdr		*dynphdr = NULL;
183 	Phdr		*dtrphdr = NULL;
184 	uintptr_t	lddata;
185 	long		execsz;
186 	intptr_t	minaddr;
187 
188 	if (error = execpermissions(vp, &vat, args)) {
189 		uprintf("%s: Cannot execute %s\n", exec_file, args->pathname);
190 		return (error);
191 	}
192 
193 	if ((error = getelfhead(vp, CRED(), ehdr, &nshdrs, &shstrndx,
194 	    &nphdrs)) != 0 ||
195 	    (error = getelfphdr(vp, CRED(), ehdr, nphdrs, &phdrbase,
196 	    &phdrsize)) != 0) {
197 		uprintf("%s: Cannot read %s\n", exec_file, args->pathname);
198 		return (error);
199 	}
200 
201 	if ((len = elfsize(ehdr, nphdrs, phdrbase, &lddata)) == 0) {
202 		uprintf("%s: Nothing to load in %s", exec_file, args->pathname);
203 		kmem_free(phdrbase, phdrsize);
204 		return (ENOEXEC);
205 	}
206 
207 	if (error = mapelfexec(vp, ehdr, nphdrs, phdrbase, &uphdr, &dynphdr,
208 	    &junk, &dtrphdr, NULL, bssbase, brkbase, voffset, &minaddr,
209 	    len, &execsz, brksize)) {
210 		uprintf("%s: Cannot map %s\n", exec_file, args->pathname);
211 		kmem_free(phdrbase, phdrsize);
212 		return (error);
213 	}
214 
215 	/*
216 	 * Inform our caller if the executable needs an interpreter.
217 	 */
218 	*interp = (dynphdr == NULL) ? 0 : 1;
219 
220 	/*
221 	 * If this is a statically linked executable, voffset should indicate
222 	 * the address of the executable itself (it normally holds the address
223 	 * of the interpreter).
224 	 */
225 	if (ehdr->e_type == ET_EXEC && *interp == 0)
226 		*voffset = minaddr;
227 
228 	if (uphdr != NULL) {
229 		*uphdr_vaddr = uphdr->p_vaddr;
230 	} else {
231 		*uphdr_vaddr = (Addr)-1;
232 	}
233 
234 	kmem_free(phdrbase, phdrsize);
235 	return (error);
236 }
237 
238 /*ARGSUSED*/
239 int
240 elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
241     int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred,
242     int brand_action)
243 {
244 	caddr_t		phdrbase = NULL;
245 	caddr_t 	bssbase = 0;
246 	caddr_t 	brkbase = 0;
247 	size_t		brksize = 0;
248 	ssize_t		dlnsize;
249 	aux_entry_t	*aux;
250 	int		error;
251 	ssize_t		resid;
252 	int		fd = -1;
253 	intptr_t	voffset;
254 	Phdr		*dyphdr = NULL;
255 	Phdr		*stphdr = NULL;
256 	Phdr		*uphdr = NULL;
257 	Phdr		*junk = NULL;
258 	size_t		len;
259 	ssize_t		phdrsize;
260 	int		postfixsize = 0;
261 	int		i, hsize;
262 	Phdr		*phdrp;
263 	Phdr		*dataphdrp = NULL;
264 	Phdr		*dtrphdr;
265 	int		hasu = 0;
266 	int		hasauxv = 0;
267 	int		hasdy = 0;
268 	int		branded = 0;
269 
270 	struct proc *p = ttoproc(curthread);
271 	struct user *up = PTOU(p);
272 	struct bigwad {
273 		Ehdr	ehdr;
274 		aux_entry_t	elfargs[__KERN_NAUXV_IMPL];
275 		char		dl_name[MAXPATHLEN];
276 		char		pathbuf[MAXPATHLEN];
277 		struct vattr	vattr;
278 		struct execenv	exenv;
279 	} *bigwad;	/* kmem_alloc this behemoth so we don't blow stack */
280 	Ehdr		*ehdrp;
281 	int		nshdrs, shstrndx, nphdrs;
282 	char		*dlnp;
283 	char		*pathbufp;
284 	rlim64_t	limit;
285 	rlim64_t	roundlimit;
286 
287 	ASSERT(p->p_model == DATAMODEL_ILP32 || p->p_model == DATAMODEL_LP64);
288 
289 	bigwad = kmem_alloc(sizeof (struct bigwad), KM_SLEEP);
290 	ehdrp = &bigwad->ehdr;
291 	dlnp = bigwad->dl_name;
292 	pathbufp = bigwad->pathbuf;
293 
294 	/*
295 	 * Obtain ELF and program header information.
296 	 */
297 	if ((error = getelfhead(vp, CRED(), ehdrp, &nshdrs, &shstrndx,
298 	    &nphdrs)) != 0 ||
299 	    (error = getelfphdr(vp, CRED(), ehdrp, nphdrs, &phdrbase,
300 	    &phdrsize)) != 0)
301 		goto out;
302 
303 	/*
304 	 * Prevent executing an ELF file that has no entry point.
305 	 */
306 	if (ehdrp->e_entry == 0) {
307 		uprintf("%s: Bad entry point\n", exec_file);
308 		goto bad;
309 	}
310 
311 	/*
312 	 * Put data model that we're exec-ing to into the args passed to
313 	 * exec_args(), so it will know what it is copying to on new stack.
314 	 * Now that we know whether we are exec-ing a 32-bit or 64-bit
315 	 * executable, we can set execsz with the appropriate NCARGS.
316 	 */
317 #ifdef	_LP64
318 	if (ehdrp->e_ident[EI_CLASS] == ELFCLASS32) {
319 		args->to_model = DATAMODEL_ILP32;
320 		*execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS32-1);
321 	} else {
322 		args->to_model = DATAMODEL_LP64;
323 		args->stk_prot &= ~PROT_EXEC;
324 #if defined(__i386) || defined(__amd64)
325 		args->dat_prot &= ~PROT_EXEC;
326 #endif
327 		*execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS64-1);
328 	}
329 #else	/* _LP64 */
330 	args->to_model = DATAMODEL_ILP32;
331 	*execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS-1);
332 #endif	/* _LP64 */
333 
334 	/*
335 	 * We delay invoking the brand callback until we've figured out
336 	 * what kind of elf binary we're trying to run, 32-bit or 64-bit.
337 	 * We do this because now the brand library can just check
338 	 * args->to_model to see if the target is 32-bit or 64-bit without
339 	 * having do duplicate all the code above.
340 	 */
341 	if ((level < 2) &&
342 	    (brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
343 		kmem_free(bigwad, sizeof (struct bigwad));
344 		return (BROP(p)->b_elfexec(vp, uap, args,
345 		    idatap, level + 1, execsz, setid, exec_file, cred,
346 		    brand_action));
347 	}
348 
349 	/*
350 	 * Determine aux size now so that stack can be built
351 	 * in one shot (except actual copyout of aux image),
352 	 * determine any non-default stack protections,
353 	 * and still have this code be machine independent.
354 	 */
355 	hsize = ehdrp->e_phentsize;
356 	phdrp = (Phdr *)phdrbase;
357 	for (i = nphdrs; i > 0; i--) {
358 		switch (phdrp->p_type) {
359 		case PT_INTERP:
360 			hasauxv = hasdy = 1;
361 			break;
362 		case PT_PHDR:
363 			hasu = 1;
364 			break;
365 		case PT_SUNWSTACK:
366 			args->stk_prot = PROT_USER;
367 			if (phdrp->p_flags & PF_R)
368 				args->stk_prot |= PROT_READ;
369 			if (phdrp->p_flags & PF_W)
370 				args->stk_prot |= PROT_WRITE;
371 			if (phdrp->p_flags & PF_X)
372 				args->stk_prot |= PROT_EXEC;
373 			break;
374 		case PT_LOAD:
375 			dataphdrp = phdrp;
376 			break;
377 		}
378 		phdrp = (Phdr *)((caddr_t)phdrp + hsize);
379 	}
380 
381 	if (ehdrp->e_type != ET_EXEC) {
382 		dataphdrp = NULL;
383 		hasauxv = 1;
384 	}
385 
386 	/* Copy BSS permissions to args->dat_prot */
387 	if (dataphdrp != NULL) {
388 		args->dat_prot = PROT_USER;
389 		if (dataphdrp->p_flags & PF_R)
390 			args->dat_prot |= PROT_READ;
391 		if (dataphdrp->p_flags & PF_W)
392 			args->dat_prot |= PROT_WRITE;
393 		if (dataphdrp->p_flags & PF_X)
394 			args->dat_prot |= PROT_EXEC;
395 	}
396 
397 	/*
398 	 * If a auxvector will be required - reserve the space for
399 	 * it now.  This may be increased by exec_args if there are
400 	 * ISA-specific types (included in __KERN_NAUXV_IMPL).
401 	 */
402 	if (hasauxv) {
403 		/*
404 		 * If a AUX vector is being built - the base AUX
405 		 * entries are:
406 		 *
407 		 *	AT_BASE
408 		 *	AT_FLAGS
409 		 *	AT_PAGESZ
410 		 *	AT_SUN_LDSECURE
411 		 *	AT_SUN_HWCAP
412 		 *	AT_SUN_PLATFORM
413 		 *	AT_SUN_EXECNAME
414 		 *	AT_NULL
415 		 *
416 		 * total == 8
417 		 */
418 		if (hasdy && hasu) {
419 			/*
420 			 * Has PT_INTERP & PT_PHDR - the auxvectors that
421 			 * will be built are:
422 			 *
423 			 *	AT_PHDR
424 			 *	AT_PHENT
425 			 *	AT_PHNUM
426 			 *	AT_ENTRY
427 			 *	AT_LDDATA
428 			 *
429 			 * total = 5
430 			 */
431 			args->auxsize = (8 + 5) * sizeof (aux_entry_t);
432 		} else if (hasdy) {
433 			/*
434 			 * Has PT_INTERP but no PT_PHDR
435 			 *
436 			 *	AT_EXECFD
437 			 *	AT_LDDATA
438 			 *
439 			 * total = 2
440 			 */
441 			args->auxsize = (8 + 2) * sizeof (aux_entry_t);
442 		} else {
443 			args->auxsize = 8 * sizeof (aux_entry_t);
444 		}
445 	} else
446 		args->auxsize = 0;
447 
448 	/*
449 	 * If this binary is using an emulator, we need to add an
450 	 * AT_SUN_EMULATOR aux entry.
451 	 */
452 	if (args->emulator != NULL)
453 		args->auxsize += sizeof (aux_entry_t);
454 
455 	if ((brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
456 		branded = 1;
457 		/*
458 		 * We will be adding 2 entries to the aux vector.  One for
459 		 * the branded binary's phdr and one for the brandname.
460 		 */
461 		args->auxsize += 2 * sizeof (aux_entry_t);
462 	}
463 
464 	aux = bigwad->elfargs;
465 	/*
466 	 * Move args to the user's stack.
467 	 */
468 	if ((error = exec_args(uap, args, idatap, (void **)&aux)) != 0) {
469 		if (error == -1) {
470 			error = ENOEXEC;
471 			goto bad;
472 		}
473 		goto out;
474 	}
475 	/* we're single threaded after this point */
476 
477 	/*
478 	 * If this is an ET_DYN executable (shared object),
479 	 * determine its memory size so that mapelfexec() can load it.
480 	 */
481 	if (ehdrp->e_type == ET_DYN)
482 		len = elfsize(ehdrp, nphdrs, phdrbase, NULL);
483 	else
484 		len = 0;
485 
486 	dtrphdr = NULL;
487 
488 	if ((error = mapelfexec(vp, ehdrp, nphdrs, phdrbase, &uphdr, &dyphdr,
489 	    &stphdr, &dtrphdr, dataphdrp, &bssbase, &brkbase, &voffset, NULL,
490 	    len, execsz, &brksize)) != 0)
491 		goto bad;
492 
493 	if (uphdr != NULL && dyphdr == NULL)
494 		goto bad;
495 
496 	if (dtrphdr != NULL && dtrace_safe_phdr(dtrphdr, args, voffset) != 0) {
497 		uprintf("%s: Bad DTrace phdr in %s\n", exec_file, exec_file);
498 		goto bad;
499 	}
500 
501 	if (dyphdr != NULL) {
502 		size_t		len;
503 		uintptr_t	lddata;
504 		char		*p;
505 		struct vnode	*nvp;
506 
507 		dlnsize = dyphdr->p_filesz;
508 
509 		if (dlnsize > MAXPATHLEN || dlnsize <= 0)
510 			goto bad;
511 
512 		/*
513 		 * Read in "interpreter" pathname.
514 		 */
515 		if ((error = vn_rdwr(UIO_READ, vp, dlnp, dyphdr->p_filesz,
516 		    (offset_t)dyphdr->p_offset, UIO_SYSSPACE, 0, (rlim64_t)0,
517 		    CRED(), &resid)) != 0) {
518 			uprintf("%s: Cannot obtain interpreter pathname\n",
519 			    exec_file);
520 			goto bad;
521 		}
522 
523 		if (resid != 0 || dlnp[dlnsize - 1] != '\0')
524 			goto bad;
525 
526 		/*
527 		 * Search for '$ORIGIN' token in interpreter path.
528 		 * If found, expand it.
529 		 */
530 		for (p = dlnp; p = strchr(p, '$'); ) {
531 			uint_t	len, curlen;
532 			char	*_ptr;
533 
534 			if (strncmp(++p, ORIGIN_STR, ORIGIN_STR_SIZE))
535 				continue;
536 
537 			curlen = 0;
538 			len = p - dlnp - 1;
539 			if (len) {
540 				bcopy(dlnp, pathbufp, len);
541 				curlen += len;
542 			}
543 			if (_ptr = strrchr(args->pathname, '/')) {
544 				len = _ptr - args->pathname;
545 				if ((curlen + len) > MAXPATHLEN)
546 					break;
547 
548 				bcopy(args->pathname, &pathbufp[curlen], len);
549 				curlen += len;
550 			} else {
551 				/*
552 				 * executable is a basename found in the
553 				 * current directory.  So - just substitue
554 				 * '.' for ORIGIN.
555 				 */
556 				pathbufp[curlen] = '.';
557 				curlen++;
558 			}
559 			p += ORIGIN_STR_SIZE;
560 			len = strlen(p);
561 
562 			if ((curlen + len) > MAXPATHLEN)
563 				break;
564 			bcopy(p, &pathbufp[curlen], len);
565 			curlen += len;
566 			pathbufp[curlen++] = '\0';
567 			bcopy(pathbufp, dlnp, curlen);
568 		}
569 
570 		/*
571 		 * /usr/lib/ld.so.1 is known to be a symlink to /lib/ld.so.1
572 		 * (and /usr/lib/64/ld.so.1 is a symlink to /lib/64/ld.so.1).
573 		 * Just in case /usr is not mounted, change it now.
574 		 */
575 		if (strcmp(dlnp, USR_LIB_RTLD) == 0)
576 			dlnp += 4;
577 		error = lookupname(dlnp, UIO_SYSSPACE, FOLLOW, NULLVPP, &nvp);
578 		if (error && dlnp != bigwad->dl_name) {
579 			/* new kernel, old user-level */
580 			error = lookupname(dlnp -= 4, UIO_SYSSPACE, FOLLOW,
581 				NULLVPP, &nvp);
582 		}
583 		if (error) {
584 			uprintf("%s: Cannot find %s\n", exec_file, dlnp);
585 			goto bad;
586 		}
587 
588 		/*
589 		 * Setup the "aux" vector.
590 		 */
591 		if (uphdr) {
592 			if (ehdrp->e_type == ET_DYN) {
593 				/* don't use the first page */
594 				bigwad->exenv.ex_brkbase = (caddr_t)PAGESIZE;
595 				bigwad->exenv.ex_bssbase = (caddr_t)PAGESIZE;
596 			} else {
597 				bigwad->exenv.ex_bssbase = bssbase;
598 				bigwad->exenv.ex_brkbase = brkbase;
599 			}
600 			bigwad->exenv.ex_brksize = brksize;
601 			bigwad->exenv.ex_magic = elfmagic;
602 			bigwad->exenv.ex_vp = vp;
603 			setexecenv(&bigwad->exenv);
604 
605 			ADDAUX(aux, AT_PHDR, uphdr->p_vaddr + voffset)
606 			ADDAUX(aux, AT_PHENT, ehdrp->e_phentsize)
607 			ADDAUX(aux, AT_PHNUM, nphdrs)
608 			ADDAUX(aux, AT_ENTRY, ehdrp->e_entry + voffset)
609 		} else {
610 			if ((error = execopen(&vp, &fd)) != 0) {
611 				VN_RELE(nvp);
612 				goto bad;
613 			}
614 
615 			ADDAUX(aux, AT_EXECFD, fd)
616 		}
617 
618 		if ((error = execpermissions(nvp, &bigwad->vattr, args)) != 0) {
619 			VN_RELE(nvp);
620 			uprintf("%s: Cannot execute %s\n", exec_file, dlnp);
621 			goto bad;
622 		}
623 
624 		/*
625 		 * Now obtain the ELF header along with the entire program
626 		 * header contained in "nvp".
627 		 */
628 		kmem_free(phdrbase, phdrsize);
629 		phdrbase = NULL;
630 		if ((error = getelfhead(nvp, CRED(), ehdrp, &nshdrs,
631 		    &shstrndx, &nphdrs)) != 0 ||
632 		    (error = getelfphdr(nvp, CRED(), ehdrp, nphdrs, &phdrbase,
633 		    &phdrsize)) != 0) {
634 			VN_RELE(nvp);
635 			uprintf("%s: Cannot read %s\n", exec_file, dlnp);
636 			goto bad;
637 		}
638 
639 		/*
640 		 * Determine memory size of the "interpreter's" loadable
641 		 * sections.  This size is then used to obtain the virtual
642 		 * address of a hole, in the user's address space, large
643 		 * enough to map the "interpreter".
644 		 */
645 		if ((len = elfsize(ehdrp, nphdrs, phdrbase, &lddata)) == 0) {
646 			VN_RELE(nvp);
647 			uprintf("%s: Nothing to load in %s\n", exec_file, dlnp);
648 			goto bad;
649 		}
650 
651 		dtrphdr = NULL;
652 
653 		error = mapelfexec(nvp, ehdrp, nphdrs, phdrbase, &junk, &junk,
654 		    &junk, &dtrphdr, NULL, NULL, NULL, &voffset, NULL, len,
655 		    execsz, NULL);
656 		if (error || junk != NULL) {
657 			VN_RELE(nvp);
658 			uprintf("%s: Cannot map %s\n", exec_file, dlnp);
659 			goto bad;
660 		}
661 
662 		/*
663 		 * We use the DTrace program header to initialize the
664 		 * architecture-specific user per-LWP location. The dtrace
665 		 * fasttrap provider requires ready access to per-LWP scratch
666 		 * space. We assume that there is only one such program header
667 		 * in the interpreter.
668 		 */
669 		if (dtrphdr != NULL &&
670 		    dtrace_safe_phdr(dtrphdr, args, voffset) != 0) {
671 			VN_RELE(nvp);
672 			uprintf("%s: Bad DTrace phdr in %s\n", exec_file, dlnp);
673 			goto bad;
674 		}
675 
676 		VN_RELE(nvp);
677 		ADDAUX(aux, AT_SUN_LDDATA, voffset + lddata)
678 	}
679 
680 	if (hasauxv) {
681 		int auxf = AF_SUN_HWCAPVERIFY;
682 		/*
683 		 * Note: AT_SUN_PLATFORM was filled in via exec_args()
684 		 */
685 		ADDAUX(aux, AT_BASE, voffset)
686 		ADDAUX(aux, AT_FLAGS, at_flags)
687 		ADDAUX(aux, AT_PAGESZ, PAGESIZE)
688 		/*
689 		 * Linker flags. (security)
690 		 * p_flag not yet set at this time.
691 		 * We rely on gexec() to provide us with the information.
692 		 * If the application is set-uid but this is not reflected
693 		 * in a mismatch between real/effective uids/gids, then
694 		 * don't treat this as a set-uid exec.  So we care about
695 		 * the EXECSETID_UGIDS flag but not the ...SETID flag.
696 		 */
697 		setid &= ~EXECSETID_SETID;
698 		ADDAUX(aux, AT_SUN_AUXFLAGS,
699 		    setid ? AF_SUN_SETUGID | auxf : auxf);
700 		/*
701 		 * Hardware capability flag word (performance hints)
702 		 * Used for choosing faster library routines.
703 		 * (Potentially different between 32-bit and 64-bit ABIs)
704 		 */
705 #if defined(_LP64)
706 		if (args->to_model == DATAMODEL_NATIVE)
707 			ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap)
708 		else
709 			ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap32)
710 #else
711 		ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap)
712 #endif
713 		if (branded) {
714 			/*
715 			 * Reserve space for the brand-private aux vector entry,
716 			 * and record the user addr of that space.
717 			 */
718 			args->auxp_brand_phdr =
719 			    (char *)((char *)args->stackend +
720 			    ((char *)&aux->a_type -
721 			    (char *)bigwad->elfargs));
722 			ADDAUX(aux, AT_SUN_BRAND_PHDR, 0)
723 		}
724 
725 		ADDAUX(aux, AT_NULL, 0)
726 		postfixsize = (char *)aux - (char *)bigwad->elfargs;
727 		ASSERT(postfixsize == args->auxsize);
728 		ASSERT(postfixsize <= __KERN_NAUXV_IMPL * sizeof (aux_entry_t));
729 	}
730 
731 	/*
732 	 * For the 64-bit kernel, the limit is big enough that rounding it up
733 	 * to a page can overflow the 64-bit limit, so we check for btopr()
734 	 * overflowing here by comparing it with the unrounded limit in pages.
735 	 * If it hasn't overflowed, compare the exec size with the rounded up
736 	 * limit in pages.  Otherwise, just compare with the unrounded limit.
737 	 */
738 	limit = btop(p->p_vmem_ctl);
739 	roundlimit = btopr(p->p_vmem_ctl);
740 	if ((roundlimit > limit && *execsz > roundlimit) ||
741 	    (roundlimit < limit && *execsz > limit)) {
742 		mutex_enter(&p->p_lock);
743 		(void) rctl_action(rctlproc_legacy[RLIMIT_VMEM], p->p_rctls, p,
744 		    RCA_SAFE);
745 		mutex_exit(&p->p_lock);
746 		error = ENOMEM;
747 		goto bad;
748 	}
749 
750 	bzero(up->u_auxv, sizeof (up->u_auxv));
751 	if (postfixsize) {
752 		int num_auxv;
753 
754 		/*
755 		 * Copy the aux vector to the user stack.
756 		 */
757 		error = execpoststack(args, bigwad->elfargs, postfixsize);
758 		if (error)
759 			goto bad;
760 
761 		/*
762 		 * Copy auxv to the process's user structure for use by /proc.
763 		 * If this is a branded process, the brand's exec routine will
764 		 * copy it's private entries to the user structure later. It
765 		 * relies on the fact that the blank entries are at the end.
766 		 */
767 		num_auxv = postfixsize / sizeof (aux_entry_t);
768 		ASSERT(num_auxv <= sizeof (up->u_auxv) / sizeof (auxv_t));
769 		aux = bigwad->elfargs;
770 		for (i = 0; i < num_auxv; i++) {
771 			up->u_auxv[i].a_type = aux[i].a_type;
772 			up->u_auxv[i].a_un.a_val = (aux_val_t)aux[i].a_un.a_val;
773 		}
774 	}
775 
776 	/*
777 	 * Pass back the starting address so we can set the program counter.
778 	 */
779 	args->entry = (uintptr_t)(ehdrp->e_entry + voffset);
780 
781 	if (!uphdr) {
782 		if (ehdrp->e_type == ET_DYN) {
783 			/*
784 			 * If we are executing a shared library which doesn't
785 			 * have a interpreter (probably ld.so.1) then
786 			 * we don't set the brkbase now.  Instead we
787 			 * delay it's setting until the first call
788 			 * via grow.c::brk().  This permits ld.so.1 to
789 			 * initialize brkbase to the tail of the executable it
790 			 * loads (which is where it needs to be).
791 			 */
792 			bigwad->exenv.ex_brkbase = (caddr_t)0;
793 			bigwad->exenv.ex_bssbase = (caddr_t)0;
794 			bigwad->exenv.ex_brksize = 0;
795 		} else {
796 			bigwad->exenv.ex_brkbase = brkbase;
797 			bigwad->exenv.ex_bssbase = bssbase;
798 			bigwad->exenv.ex_brksize = brksize;
799 		}
800 		bigwad->exenv.ex_magic = elfmagic;
801 		bigwad->exenv.ex_vp = vp;
802 		setexecenv(&bigwad->exenv);
803 	}
804 
805 	ASSERT(error == 0);
806 	goto out;
807 
808 bad:
809 	if (fd != -1)		/* did we open the a.out yet */
810 		(void) execclose(fd);
811 
812 	psignal(p, SIGKILL);
813 
814 	if (error == 0)
815 		error = ENOEXEC;
816 out:
817 	if (phdrbase != NULL)
818 		kmem_free(phdrbase, phdrsize);
819 	kmem_free(bigwad, sizeof (struct bigwad));
820 	return (error);
821 }
822 
823 /*
824  * Compute the memory size requirement for the ELF file.
825  */
826 static size_t
827 elfsize(Ehdr *ehdrp, int nphdrs, caddr_t phdrbase, uintptr_t *lddata)
828 {
829 	size_t	len;
830 	Phdr	*phdrp = (Phdr *)phdrbase;
831 	int	hsize = ehdrp->e_phentsize;
832 	int	first = 1;
833 	int	dfirst = 1;	/* first data segment */
834 	uintptr_t loaddr = 0;
835 	uintptr_t hiaddr = 0;
836 	uintptr_t lo, hi;
837 	int	i;
838 
839 	for (i = nphdrs; i > 0; i--) {
840 		if (phdrp->p_type == PT_LOAD) {
841 			lo = phdrp->p_vaddr;
842 			hi = lo + phdrp->p_memsz;
843 			if (first) {
844 				loaddr = lo;
845 				hiaddr = hi;
846 				first = 0;
847 			} else {
848 				if (loaddr > lo)
849 					loaddr = lo;
850 				if (hiaddr < hi)
851 					hiaddr = hi;
852 			}
853 
854 			/*
855 			 * save the address of the first data segment
856 			 * of a object - used for the AT_SUNW_LDDATA
857 			 * aux entry.
858 			 */
859 			if ((lddata != NULL) && dfirst &&
860 			    (phdrp->p_flags & PF_W)) {
861 				*lddata = lo;
862 				dfirst = 0;
863 			}
864 		}
865 		phdrp = (Phdr *)((caddr_t)phdrp + hsize);
866 	}
867 
868 	len = hiaddr - (loaddr & PAGEMASK);
869 	len = roundup(len, PAGESIZE);
870 
871 	return (len);
872 }
873 
874 /*
875  * Read in the ELF header and program header table.
876  * SUSV3 requires:
877  *	ENOEXEC	File format is not recognized
878  *	EINVAL	Format recognized but execution not supported
879  */
880 static int
881 getelfhead(vnode_t *vp, cred_t *credp, Ehdr *ehdr, int *nshdrs, int *shstrndx,
882     int *nphdrs)
883 {
884 	int error;
885 	ssize_t resid;
886 
887 	/*
888 	 * We got here by the first two bytes in ident,
889 	 * now read the entire ELF header.
890 	 */
891 	if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)ehdr,
892 	    sizeof (Ehdr), (offset_t)0, UIO_SYSSPACE, 0,
893 	    (rlim64_t)0, credp, &resid)) != 0)
894 		return (error);
895 
896 	/*
897 	 * Since a separate version is compiled for handling 32-bit and
898 	 * 64-bit ELF executables on a 64-bit kernel, the 64-bit version
899 	 * doesn't need to be able to deal with 32-bit ELF files.
900 	 */
901 	if (resid != 0 ||
902 	    ehdr->e_ident[EI_MAG2] != ELFMAG2 ||
903 	    ehdr->e_ident[EI_MAG3] != ELFMAG3)
904 		return (ENOEXEC);
905 
906 	if ((ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) ||
907 #if defined(_ILP32) || defined(_ELF32_COMPAT)
908 	    ehdr->e_ident[EI_CLASS] != ELFCLASS32 ||
909 #else
910 	    ehdr->e_ident[EI_CLASS] != ELFCLASS64 ||
911 #endif
912 	    !elfheadcheck(ehdr->e_ident[EI_DATA], ehdr->e_machine,
913 	    ehdr->e_flags))
914 		return (EINVAL);
915 
916 	*nshdrs = ehdr->e_shnum;
917 	*shstrndx = ehdr->e_shstrndx;
918 	*nphdrs = ehdr->e_phnum;
919 
920 	/*
921 	 * If e_shnum, e_shstrndx, or e_phnum is its sentinel value, we need
922 	 * to read in the section header at index zero to acces the true
923 	 * values for those fields.
924 	 */
925 	if ((*nshdrs == 0 && ehdr->e_shoff != 0) ||
926 	    *shstrndx == SHN_XINDEX || *nphdrs == PN_XNUM) {
927 		Shdr shdr;
928 
929 		if (ehdr->e_shoff == 0)
930 			return (EINVAL);
931 
932 		if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)&shdr,
933 		    sizeof (shdr), (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0,
934 		    (rlim64_t)0, credp, &resid)) != 0)
935 			return (error);
936 
937 		if (*nshdrs == 0)
938 			*nshdrs = shdr.sh_size;
939 		if (*shstrndx == SHN_XINDEX)
940 			*shstrndx = shdr.sh_link;
941 		if (*nphdrs == PN_XNUM && shdr.sh_info != 0)
942 			*nphdrs = shdr.sh_info;
943 	}
944 
945 	return (0);
946 }
947 
948 #ifdef _ELF32_COMPAT
949 extern size_t elf_nphdr_max;
950 #else
951 size_t elf_nphdr_max = 1000;
952 #endif
953 
954 static int
955 getelfphdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, int nphdrs,
956     caddr_t *phbasep, ssize_t *phsizep)
957 {
958 	ssize_t resid, minsize;
959 	int err;
960 
961 	/*
962 	 * Since we're going to be using e_phentsize to iterate down the
963 	 * array of program headers, it must be 8-byte aligned or else
964 	 * a we might cause a misaligned access. We use all members through
965 	 * p_flags on 32-bit ELF files and p_memsz on 64-bit ELF files so
966 	 * e_phentsize must be at least large enough to include those
967 	 * members.
968 	 */
969 #if !defined(_LP64) || defined(_ELF32_COMPAT)
970 	minsize = offsetof(Phdr, p_flags) + sizeof (((Phdr *)NULL)->p_flags);
971 #else
972 	minsize = offsetof(Phdr, p_memsz) + sizeof (((Phdr *)NULL)->p_memsz);
973 #endif
974 	if (ehdr->e_phentsize < minsize || (ehdr->e_phentsize & 3))
975 		return (EINVAL);
976 
977 	*phsizep = nphdrs * ehdr->e_phentsize;
978 
979 	if (*phsizep > sizeof (Phdr) * elf_nphdr_max) {
980 		if ((*phbasep = kmem_alloc(*phsizep, KM_NOSLEEP)) == NULL)
981 			return (ENOMEM);
982 	} else {
983 		*phbasep = kmem_alloc(*phsizep, KM_SLEEP);
984 	}
985 
986 	if ((err = vn_rdwr(UIO_READ, vp, *phbasep, *phsizep,
987 	    (offset_t)ehdr->e_phoff, UIO_SYSSPACE, 0, (rlim64_t)0,
988 	    credp, &resid)) != 0) {
989 		kmem_free(*phbasep, *phsizep);
990 		*phbasep = NULL;
991 		return (err);
992 	}
993 
994 	return (0);
995 }
996 
997 #ifdef _ELF32_COMPAT
998 extern size_t elf_nshdr_max;
999 extern size_t elf_shstrtab_max;
1000 #else
1001 size_t elf_nshdr_max = 10000;
1002 size_t elf_shstrtab_max = 100 * 1024;
1003 #endif
1004 
1005 
1006 static int
1007 getelfshdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr,
1008     int nshdrs, int shstrndx, caddr_t *shbasep, ssize_t *shsizep,
1009     char **shstrbasep, ssize_t *shstrsizep)
1010 {
1011 	ssize_t resid, minsize;
1012 	int err;
1013 	Shdr *shdr;
1014 
1015 	/*
1016 	 * Since we're going to be using e_shentsize to iterate down the
1017 	 * array of section headers, it must be 8-byte aligned or else
1018 	 * a we might cause a misaligned access. We use all members through
1019 	 * sh_entsize (on both 32- and 64-bit ELF files) so e_shentsize
1020 	 * must be at least large enough to include that member. The index
1021 	 * of the string table section must also be valid.
1022 	 */
1023 	minsize = offsetof(Shdr, sh_entsize) + sizeof (shdr->sh_entsize);
1024 	if (ehdr->e_shentsize < minsize || (ehdr->e_shentsize & 3) ||
1025 	    shstrndx >= nshdrs)
1026 		return (EINVAL);
1027 
1028 	*shsizep = nshdrs * ehdr->e_shentsize;
1029 
1030 	if (*shsizep > sizeof (Shdr) * elf_nshdr_max) {
1031 		if ((*shbasep = kmem_alloc(*shsizep, KM_NOSLEEP)) == NULL)
1032 			return (ENOMEM);
1033 	} else {
1034 		*shbasep = kmem_alloc(*shsizep, KM_SLEEP);
1035 	}
1036 
1037 	if ((err = vn_rdwr(UIO_READ, vp, *shbasep, *shsizep,
1038 	    (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, (rlim64_t)0,
1039 	    credp, &resid)) != 0) {
1040 		kmem_free(*shbasep, *shsizep);
1041 		return (err);
1042 	}
1043 
1044 	/*
1045 	 * Pull the section string table out of the vnode; fail if the size
1046 	 * is zero.
1047 	 */
1048 	shdr = (Shdr *)(*shbasep + shstrndx * ehdr->e_shentsize);
1049 	if ((*shstrsizep = shdr->sh_size) == 0) {
1050 		kmem_free(*shbasep, *shsizep);
1051 		return (EINVAL);
1052 	}
1053 
1054 	if (*shstrsizep > elf_shstrtab_max) {
1055 		if ((*shstrbasep = kmem_alloc(*shstrsizep,
1056 		    KM_NOSLEEP)) == NULL) {
1057 			kmem_free(*shbasep, *shsizep);
1058 			return (ENOMEM);
1059 		}
1060 	} else {
1061 		*shstrbasep = kmem_alloc(*shstrsizep, KM_SLEEP);
1062 	}
1063 
1064 	if ((err = vn_rdwr(UIO_READ, vp, *shstrbasep, *shstrsizep,
1065 	    (offset_t)shdr->sh_offset, UIO_SYSSPACE, 0, (rlim64_t)0,
1066 	    credp, &resid)) != 0) {
1067 		kmem_free(*shbasep, *shsizep);
1068 		kmem_free(*shstrbasep, *shstrsizep);
1069 		return (err);
1070 	}
1071 
1072 	/*
1073 	 * Make sure the strtab is null-terminated to make sure we
1074 	 * don't run off the end of the table.
1075 	 */
1076 	(*shstrbasep)[*shstrsizep - 1] = '\0';
1077 
1078 	return (0);
1079 }
1080 
1081 static int
1082 mapelfexec(
1083 	vnode_t *vp,
1084 	Ehdr *ehdr,
1085 	int nphdrs,
1086 	caddr_t phdrbase,
1087 	Phdr **uphdr,
1088 	Phdr **dyphdr,
1089 	Phdr **stphdr,
1090 	Phdr **dtphdr,
1091 	Phdr *dataphdrp,
1092 	caddr_t *bssbase,
1093 	caddr_t *brkbase,
1094 	intptr_t *voffset,
1095 	intptr_t *minaddr,
1096 	size_t len,
1097 	long *execsz,
1098 	size_t *brksize)
1099 {
1100 	Phdr *phdr;
1101 	int i, prot, error;
1102 	caddr_t addr;
1103 	size_t zfodsz;
1104 	int ptload = 0;
1105 	int page;
1106 	off_t offset;
1107 	int hsize = ehdr->e_phentsize;
1108 	caddr_t mintmp = (caddr_t)-1;
1109 	extern int use_brk_lpg;
1110 
1111 	if (ehdr->e_type == ET_DYN) {
1112 		/*
1113 		 * Obtain the virtual address of a hole in the
1114 		 * address space to map the "interpreter".
1115 		 */
1116 		map_addr(&addr, len, (offset_t)0, 1, 0);
1117 		if (addr == NULL)
1118 			return (ENOMEM);
1119 		*voffset = (intptr_t)addr;
1120 	} else {
1121 		*voffset = 0;
1122 	}
1123 	phdr = (Phdr *)phdrbase;
1124 	for (i = nphdrs; i > 0; i--) {
1125 		switch (phdr->p_type) {
1126 		case PT_LOAD:
1127 			if ((*dyphdr != NULL) && (*uphdr == NULL))
1128 				return (0);
1129 
1130 			ptload = 1;
1131 			prot = PROT_USER;
1132 			if (phdr->p_flags & PF_R)
1133 				prot |= PROT_READ;
1134 			if (phdr->p_flags & PF_W)
1135 				prot |= PROT_WRITE;
1136 			if (phdr->p_flags & PF_X)
1137 				prot |= PROT_EXEC;
1138 
1139 			addr = (caddr_t)((uintptr_t)phdr->p_vaddr + *voffset);
1140 
1141 			/*
1142 			 * Keep track of the segment with the lowest starting
1143 			 * address.
1144 			 */
1145 			if (addr < mintmp)
1146 				mintmp = addr;
1147 
1148 			zfodsz = (size_t)phdr->p_memsz - phdr->p_filesz;
1149 
1150 			offset = phdr->p_offset;
1151 			if (((uintptr_t)offset & PAGEOFFSET) ==
1152 			    ((uintptr_t)addr & PAGEOFFSET) &&
1153 				(!(vp->v_flag & VNOMAP))) {
1154 				page = 1;
1155 			} else {
1156 				page = 0;
1157 			}
1158 
1159 			/*
1160 			 * Set the heap pagesize for OOB when the bss size
1161 			 * is known and use_brk_lpg is not 0.
1162 			 */
1163 			if (brksize != NULL && use_brk_lpg &&
1164 			    zfodsz != 0 && phdr == dataphdrp &&
1165 			    (prot & PROT_WRITE)) {
1166 				size_t tlen = P2NPHASE((uintptr_t)addr +
1167 				    phdr->p_filesz, PAGESIZE);
1168 
1169 				if (zfodsz > tlen) {
1170 					curproc->p_brkpageszc =
1171 					    page_szc(map_pgsz(MAPPGSZ_HEAP,
1172 						curproc, addr + phdr->p_filesz +
1173 						tlen, zfodsz - tlen, 0));
1174 				}
1175 			}
1176 
1177 			if (curproc->p_brkpageszc != 0 && phdr == dataphdrp &&
1178 			    (prot & PROT_WRITE)) {
1179 				uint_t	szc = curproc->p_brkpageszc;
1180 				size_t pgsz = page_get_pagesize(szc);
1181 				caddr_t ebss = addr + phdr->p_memsz;
1182 				size_t extra_zfodsz;
1183 
1184 				ASSERT(pgsz > PAGESIZE);
1185 
1186 				extra_zfodsz = P2NPHASE((uintptr_t)ebss, pgsz);
1187 
1188 				if (error = execmap(vp, addr, phdr->p_filesz,
1189 				    zfodsz + extra_zfodsz, phdr->p_offset,
1190 				    prot, page, szc))
1191 					goto bad;
1192 				if (brksize != NULL)
1193 					*brksize = extra_zfodsz;
1194 			} else {
1195 				if (error = execmap(vp, addr, phdr->p_filesz,
1196 				    zfodsz, phdr->p_offset, prot, page, 0))
1197 					goto bad;
1198 			}
1199 
1200 			if (bssbase != NULL && addr >= *bssbase &&
1201 			    phdr == dataphdrp) {
1202 				*bssbase = addr + phdr->p_filesz;
1203 			}
1204 			if (brkbase != NULL && addr >= *brkbase) {
1205 				*brkbase = addr + phdr->p_memsz;
1206 			}
1207 
1208 			*execsz += btopr(phdr->p_memsz);
1209 			break;
1210 
1211 		case PT_INTERP:
1212 			if (ptload)
1213 				goto bad;
1214 			*dyphdr = phdr;
1215 			break;
1216 
1217 		case PT_SHLIB:
1218 			*stphdr = phdr;
1219 			break;
1220 
1221 		case PT_PHDR:
1222 			if (ptload)
1223 				goto bad;
1224 			*uphdr = phdr;
1225 			break;
1226 
1227 		case PT_NULL:
1228 		case PT_DYNAMIC:
1229 		case PT_NOTE:
1230 			break;
1231 
1232 		case PT_SUNWDTRACE:
1233 			if (dtphdr != NULL)
1234 				*dtphdr = phdr;
1235 			break;
1236 
1237 		default:
1238 			break;
1239 		}
1240 		phdr = (Phdr *)((caddr_t)phdr + hsize);
1241 	}
1242 
1243 	if (minaddr != NULL) {
1244 		ASSERT(mintmp != (caddr_t)-1);
1245 		*minaddr = (intptr_t)mintmp;
1246 	}
1247 
1248 	return (0);
1249 bad:
1250 	if (error == 0)
1251 		error = EINVAL;
1252 	return (error);
1253 }
1254 
1255 int
1256 elfnote(vnode_t *vp, offset_t *offsetp, int type, int descsz, void *desc,
1257     rlim64_t rlimit, cred_t *credp)
1258 {
1259 	Note note;
1260 	int error;
1261 
1262 	bzero(&note, sizeof (note));
1263 	bcopy("CORE", note.name, 4);
1264 	note.nhdr.n_type = type;
1265 	/*
1266 	 * The System V ABI states that n_namesz must be the length of the
1267 	 * string that follows the Nhdr structure including the terminating
1268 	 * null. The ABI also specifies that sufficient padding should be
1269 	 * included so that the description that follows the name string
1270 	 * begins on a 4- or 8-byte boundary for 32- and 64-bit binaries
1271 	 * respectively. However, since this change was not made correctly
1272 	 * at the time of the 64-bit port, both 32- and 64-bit binaries
1273 	 * descriptions are only guaranteed to begin on a 4-byte boundary.
1274 	 */
1275 	note.nhdr.n_namesz = 5;
1276 	note.nhdr.n_descsz = roundup(descsz, sizeof (Word));
1277 
1278 	if (error = core_write(vp, UIO_SYSSPACE, *offsetp, &note,
1279 	    sizeof (note), rlimit, credp))
1280 		return (error);
1281 
1282 	*offsetp += sizeof (note);
1283 
1284 	if (error = core_write(vp, UIO_SYSSPACE, *offsetp, desc,
1285 	    note.nhdr.n_descsz, rlimit, credp))
1286 		return (error);
1287 
1288 	*offsetp += note.nhdr.n_descsz;
1289 	return (0);
1290 }
1291 
1292 /*
1293  * Copy the section data from one vnode to the section of another vnode.
1294  */
1295 static void
1296 copy_scn(Shdr *src, vnode_t *src_vp, Shdr *dst, vnode_t *dst_vp, Off *doffset,
1297     void *buf, size_t size, cred_t *credp, rlim64_t rlimit)
1298 {
1299 	ssize_t resid;
1300 	size_t len, n = src->sh_size;
1301 	offset_t off = 0;
1302 
1303 	while (n != 0) {
1304 		len = MIN(size, n);
1305 		if (vn_rdwr(UIO_READ, src_vp, buf, len, src->sh_offset + off,
1306 		    UIO_SYSSPACE, 0, (rlim64_t)0, credp, &resid) != 0 ||
1307 		    resid >= len ||
1308 		    core_write(dst_vp, UIO_SYSSPACE, *doffset + off,
1309 		    buf, len - resid, rlimit, credp) != 0) {
1310 			dst->sh_size = 0;
1311 			dst->sh_offset = 0;
1312 			return;
1313 		}
1314 
1315 		ASSERT(n >= len - resid);
1316 
1317 		n -= len - resid;
1318 		off += len - resid;
1319 	}
1320 
1321 	*doffset += src->sh_size;
1322 }
1323 
1324 #ifdef _ELF32_COMPAT
1325 extern size_t elf_datasz_max;
1326 #else
1327 size_t elf_datasz_max = 1 * 1024 * 1024;
1328 #endif
1329 
1330 /*
1331  * This function processes mappings that correspond to load objects to
1332  * examine their respective sections for elfcore(). It's called once with
1333  * v set to NULL to count the number of sections that we're going to need
1334  * and then again with v set to some allocated buffer that we fill in with
1335  * all the section data.
1336  */
1337 static int
1338 process_scns(core_content_t content, proc_t *p, cred_t *credp, vnode_t *vp,
1339     Shdr *v, int nv, rlim64_t rlimit, Off *doffsetp, int *nshdrsp)
1340 {
1341 	vnode_t *lastvp = NULL;
1342 	struct seg *seg;
1343 	int i, j;
1344 	void *data = NULL;
1345 	size_t datasz = 0;
1346 	shstrtab_t shstrtab;
1347 	struct as *as = p->p_as;
1348 	int error = 0;
1349 
1350 	if (v != NULL)
1351 		shstrtab_init(&shstrtab);
1352 
1353 	i = 1;
1354 	for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
1355 		uint_t prot;
1356 		vnode_t *mvp;
1357 		void *tmp = NULL;
1358 		caddr_t saddr = seg->s_base;
1359 		caddr_t naddr;
1360 		caddr_t eaddr;
1361 		size_t segsize;
1362 
1363 		Ehdr ehdr;
1364 		int nshdrs, shstrndx, nphdrs;
1365 		caddr_t shbase;
1366 		ssize_t shsize;
1367 		char *shstrbase;
1368 		ssize_t shstrsize;
1369 
1370 		Shdr *shdr;
1371 		const char *name;
1372 		size_t sz;
1373 		uintptr_t off;
1374 
1375 		int ctf_ndx = 0;
1376 		int symtab_ndx = 0;
1377 
1378 		/*
1379 		 * Since we're just looking for text segments of load
1380 		 * objects, we only care about the protection bits; we don't
1381 		 * care about the actual size of the segment so we use the
1382 		 * reserved size. If the segment's size is zero, there's
1383 		 * something fishy going on so we ignore this segment.
1384 		 */
1385 		if (seg->s_ops != &segvn_ops ||
1386 		    SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 ||
1387 		    mvp == lastvp || mvp == NULL || mvp->v_type != VREG ||
1388 		    (segsize = pr_getsegsize(seg, 1)) == 0)
1389 			continue;
1390 
1391 		eaddr = saddr + segsize;
1392 		prot = pr_getprot(seg, 1, &tmp, &saddr, &naddr, eaddr);
1393 		pr_getprot_done(&tmp);
1394 
1395 		/*
1396 		 * Skip this segment unless the protection bits look like
1397 		 * what we'd expect for a text segment.
1398 		 */
1399 		if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC)
1400 			continue;
1401 
1402 		if (getelfhead(mvp, credp, &ehdr, &nshdrs, &shstrndx,
1403 		    &nphdrs) != 0 ||
1404 		    getelfshdr(mvp, credp, &ehdr, nshdrs, shstrndx,
1405 		    &shbase, &shsize, &shstrbase, &shstrsize) != 0)
1406 			continue;
1407 
1408 		off = ehdr.e_shentsize;
1409 		for (j = 1; j < nshdrs; j++, off += ehdr.e_shentsize) {
1410 			Shdr *symtab = NULL, *strtab;
1411 
1412 			shdr = (Shdr *)(shbase + off);
1413 
1414 			if (shdr->sh_name >= shstrsize)
1415 				continue;
1416 
1417 			name = shstrbase + shdr->sh_name;
1418 
1419 			if (strcmp(name, shstrtab_data[STR_CTF]) == 0) {
1420 				if ((content & CC_CONTENT_CTF) == 0 ||
1421 				    ctf_ndx != 0)
1422 					continue;
1423 
1424 				if (shdr->sh_link > 0 &&
1425 				    shdr->sh_link < nshdrs) {
1426 					symtab = (Shdr *)(shbase +
1427 					    shdr->sh_link * ehdr.e_shentsize);
1428 				}
1429 
1430 				if (v != NULL && i < nv - 1) {
1431 					if (shdr->sh_size > datasz &&
1432 					    shdr->sh_size <= elf_datasz_max) {
1433 						if (data != NULL)
1434 							kmem_free(data, datasz);
1435 
1436 						datasz = shdr->sh_size;
1437 						data = kmem_alloc(datasz,
1438 						    KM_SLEEP);
1439 					}
1440 
1441 					v[i].sh_name = shstrtab_ndx(&shstrtab,
1442 					    STR_CTF);
1443 					v[i].sh_addr = (Addr)(uintptr_t)saddr;
1444 					v[i].sh_type = SHT_PROGBITS;
1445 					v[i].sh_addralign = 4;
1446 					*doffsetp = roundup(*doffsetp,
1447 					    v[i].sh_addralign);
1448 					v[i].sh_offset = *doffsetp;
1449 					v[i].sh_size = shdr->sh_size;
1450 					if (symtab == NULL)  {
1451 						v[i].sh_link = 0;
1452 					} else if (symtab->sh_type ==
1453 					    SHT_SYMTAB &&
1454 					    symtab_ndx != 0) {
1455 						v[i].sh_link =
1456 						    symtab_ndx;
1457 					} else {
1458 						v[i].sh_link = i + 1;
1459 					}
1460 
1461 					copy_scn(shdr, mvp, &v[i], vp,
1462 					    doffsetp, data, datasz, credp,
1463 					    rlimit);
1464 				}
1465 
1466 				ctf_ndx = i++;
1467 
1468 				/*
1469 				 * We've already dumped the symtab.
1470 				 */
1471 				if (symtab != NULL &&
1472 				    symtab->sh_type == SHT_SYMTAB &&
1473 				    symtab_ndx != 0)
1474 					continue;
1475 
1476 			} else if (strcmp(name,
1477 			    shstrtab_data[STR_SYMTAB]) == 0) {
1478 				if ((content & CC_CONTENT_SYMTAB) == 0 ||
1479 				    symtab != 0)
1480 					continue;
1481 
1482 				symtab = shdr;
1483 			}
1484 
1485 			if (symtab != NULL) {
1486 				if ((symtab->sh_type != SHT_DYNSYM &&
1487 				    symtab->sh_type != SHT_SYMTAB) ||
1488 				    symtab->sh_link == 0 ||
1489 				    symtab->sh_link >= nshdrs)
1490 					continue;
1491 
1492 				strtab = (Shdr *)(shbase +
1493 				    symtab->sh_link * ehdr.e_shentsize);
1494 
1495 				if (strtab->sh_type != SHT_STRTAB)
1496 					continue;
1497 
1498 				if (v != NULL && i < nv - 2) {
1499 					sz = MAX(symtab->sh_size,
1500 					    strtab->sh_size);
1501 					if (sz > datasz &&
1502 					    sz <= elf_datasz_max) {
1503 						if (data != NULL)
1504 							kmem_free(data, datasz);
1505 
1506 						datasz = sz;
1507 						data = kmem_alloc(datasz,
1508 						    KM_SLEEP);
1509 					}
1510 
1511 					if (symtab->sh_type == SHT_DYNSYM) {
1512 						v[i].sh_name = shstrtab_ndx(
1513 						    &shstrtab, STR_DYNSYM);
1514 						v[i + 1].sh_name = shstrtab_ndx(
1515 						    &shstrtab, STR_DYNSTR);
1516 					} else {
1517 						v[i].sh_name = shstrtab_ndx(
1518 						    &shstrtab, STR_SYMTAB);
1519 						v[i + 1].sh_name = shstrtab_ndx(
1520 						    &shstrtab, STR_STRTAB);
1521 					}
1522 
1523 					v[i].sh_type = symtab->sh_type;
1524 					v[i].sh_addr = symtab->sh_addr;
1525 					if (ehdr.e_type == ET_DYN ||
1526 					    v[i].sh_addr == 0)
1527 						v[i].sh_addr +=
1528 						    (Addr)(uintptr_t)saddr;
1529 					v[i].sh_addralign =
1530 					    symtab->sh_addralign;
1531 					*doffsetp = roundup(*doffsetp,
1532 					    v[i].sh_addralign);
1533 					v[i].sh_offset = *doffsetp;
1534 					v[i].sh_size = symtab->sh_size;
1535 					v[i].sh_link = i + 1;
1536 					v[i].sh_entsize = symtab->sh_entsize;
1537 					v[i].sh_info = symtab->sh_info;
1538 
1539 					copy_scn(symtab, mvp, &v[i], vp,
1540 					    doffsetp, data, datasz, credp,
1541 					    rlimit);
1542 
1543 					v[i + 1].sh_type = SHT_STRTAB;
1544 					v[i + 1].sh_flags = SHF_STRINGS;
1545 					v[i + 1].sh_addr = symtab->sh_addr;
1546 					if (ehdr.e_type == ET_DYN ||
1547 					    v[i + 1].sh_addr == 0)
1548 						v[i + 1].sh_addr +=
1549 						    (Addr)(uintptr_t)saddr;
1550 					v[i + 1].sh_addralign =
1551 					    strtab->sh_addralign;
1552 					*doffsetp = roundup(*doffsetp,
1553 					    v[i + 1].sh_addralign);
1554 					v[i + 1].sh_offset = *doffsetp;
1555 					v[i + 1].sh_size = strtab->sh_size;
1556 
1557 					copy_scn(strtab, mvp, &v[i + 1], vp,
1558 					    doffsetp, data, datasz, credp,
1559 					    rlimit);
1560 				}
1561 
1562 				if (symtab->sh_type == SHT_SYMTAB)
1563 					symtab_ndx = i;
1564 				i += 2;
1565 			}
1566 		}
1567 
1568 		kmem_free(shstrbase, shstrsize);
1569 		kmem_free(shbase, shsize);
1570 
1571 		lastvp = mvp;
1572 	}
1573 
1574 	if (v == NULL) {
1575 		if (i == 1)
1576 			*nshdrsp = 0;
1577 		else
1578 			*nshdrsp = i + 1;
1579 		goto done;
1580 	}
1581 
1582 	if (i != nv - 1) {
1583 		cmn_err(CE_WARN, "elfcore: core dump failed for "
1584 		    "process %d; address space is changing", p->p_pid);
1585 		error = EIO;
1586 		goto done;
1587 	}
1588 
1589 	v[i].sh_name = shstrtab_ndx(&shstrtab, STR_SHSTRTAB);
1590 	v[i].sh_size = shstrtab_size(&shstrtab);
1591 	v[i].sh_addralign = 1;
1592 	*doffsetp = roundup(*doffsetp, v[i].sh_addralign);
1593 	v[i].sh_offset = *doffsetp;
1594 	v[i].sh_flags = SHF_STRINGS;
1595 	v[i].sh_type = SHT_STRTAB;
1596 
1597 	if (v[i].sh_size > datasz) {
1598 		if (data != NULL)
1599 			kmem_free(data, datasz);
1600 
1601 		datasz = v[i].sh_size;
1602 		data = kmem_alloc(datasz,
1603 		    KM_SLEEP);
1604 	}
1605 
1606 	shstrtab_dump(&shstrtab, data);
1607 
1608 	if ((error = core_write(vp, UIO_SYSSPACE, *doffsetp,
1609 	    data, v[i].sh_size, rlimit, credp)) != 0)
1610 		goto done;
1611 
1612 	*doffsetp += v[i].sh_size;
1613 
1614 done:
1615 	if (data != NULL)
1616 		kmem_free(data, datasz);
1617 
1618 	return (error);
1619 }
1620 
1621 int
1622 elfcore(vnode_t *vp, proc_t *p, cred_t *credp, rlim64_t rlimit, int sig,
1623     core_content_t content)
1624 {
1625 	offset_t poffset, soffset;
1626 	Off doffset;
1627 	int error, i, nphdrs, nshdrs;
1628 	int overflow = 0;
1629 	struct seg *seg;
1630 	struct as *as = p->p_as;
1631 	union {
1632 		Ehdr ehdr;
1633 		Phdr phdr[1];
1634 		Shdr shdr[1];
1635 	} *bigwad;
1636 	size_t bigsize;
1637 	size_t phdrsz, shdrsz;
1638 	Ehdr *ehdr;
1639 	Phdr *v;
1640 	caddr_t brkbase;
1641 	size_t brksize;
1642 	caddr_t stkbase;
1643 	size_t stksize;
1644 	int ntries = 0;
1645 
1646 top:
1647 	/*
1648 	 * Make sure we have everything we need (registers, etc.).
1649 	 * All other lwps have already stopped and are in an orderly state.
1650 	 */
1651 	ASSERT(p == ttoproc(curthread));
1652 	prstop(0, 0);
1653 
1654 	AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER);
1655 	nphdrs = prnsegs(as, 0) + 2;		/* two CORE note sections */
1656 
1657 	/*
1658 	 * Count the number of section headers we're going to need.
1659 	 */
1660 	nshdrs = 0;
1661 	if (content & (CC_CONTENT_CTF | CC_CONTENT_SYMTAB)) {
1662 		(void) process_scns(content, p, credp, NULL, NULL, NULL, 0,
1663 		    NULL, &nshdrs);
1664 	}
1665 	AS_LOCK_EXIT(as, &as->a_lock);
1666 
1667 	ASSERT(nshdrs == 0 || nshdrs > 1);
1668 
1669 	/*
1670 	 * The core file contents may required zero section headers, but if
1671 	 * we overflow the 16 bits allotted to the program header count in
1672 	 * the ELF header, we'll need that program header at index zero.
1673 	 */
1674 	if (nshdrs == 0 && nphdrs >= PN_XNUM)
1675 		nshdrs = 1;
1676 
1677 	phdrsz = nphdrs * sizeof (Phdr);
1678 	shdrsz = nshdrs * sizeof (Shdr);
1679 
1680 	bigsize = MAX(sizeof (*bigwad), MAX(phdrsz, shdrsz));
1681 	bigwad = kmem_alloc(bigsize, KM_SLEEP);
1682 
1683 	ehdr = &bigwad->ehdr;
1684 	bzero(ehdr, sizeof (*ehdr));
1685 
1686 	ehdr->e_ident[EI_MAG0] = ELFMAG0;
1687 	ehdr->e_ident[EI_MAG1] = ELFMAG1;
1688 	ehdr->e_ident[EI_MAG2] = ELFMAG2;
1689 	ehdr->e_ident[EI_MAG3] = ELFMAG3;
1690 	ehdr->e_ident[EI_CLASS] = ELFCLASS;
1691 	ehdr->e_type = ET_CORE;
1692 
1693 #if !defined(_LP64) || defined(_ELF32_COMPAT)
1694 
1695 #if defined(__sparc)
1696 	ehdr->e_ident[EI_DATA] = ELFDATA2MSB;
1697 	ehdr->e_machine = EM_SPARC;
1698 #elif defined(__i386) || defined(__i386_COMPAT)
1699 	ehdr->e_ident[EI_DATA] = ELFDATA2LSB;
1700 	ehdr->e_machine = EM_386;
1701 #else
1702 #error "no recognized machine type is defined"
1703 #endif
1704 
1705 #else	/* !defined(_LP64) || defined(_ELF32_COMPAT) */
1706 
1707 #if defined(__sparc)
1708 	ehdr->e_ident[EI_DATA] = ELFDATA2MSB;
1709 	ehdr->e_machine = EM_SPARCV9;
1710 #elif defined(__amd64)
1711 	ehdr->e_ident[EI_DATA] = ELFDATA2LSB;
1712 	ehdr->e_machine = EM_AMD64;
1713 #else
1714 #error "no recognized 64-bit machine type is defined"
1715 #endif
1716 
1717 #endif	/* !defined(_LP64) || defined(_ELF32_COMPAT) */
1718 
1719 	/*
1720 	 * If the count of program headers or section headers or the index
1721 	 * of the section string table can't fit in the mere 16 bits
1722 	 * shortsightedly allotted to them in the ELF header, we use the
1723 	 * extended formats and put the real values in the section header
1724 	 * as index 0.
1725 	 */
1726 	ehdr->e_version = EV_CURRENT;
1727 	ehdr->e_ehsize = sizeof (Ehdr);
1728 
1729 	if (nphdrs >= PN_XNUM)
1730 		ehdr->e_phnum = PN_XNUM;
1731 	else
1732 		ehdr->e_phnum = (unsigned short)nphdrs;
1733 
1734 	ehdr->e_phoff = sizeof (Ehdr);
1735 	ehdr->e_phentsize = sizeof (Phdr);
1736 
1737 	if (nshdrs > 0) {
1738 		if (nshdrs >= SHN_LORESERVE)
1739 			ehdr->e_shnum = 0;
1740 		else
1741 			ehdr->e_shnum = (unsigned short)nshdrs;
1742 
1743 		if (nshdrs - 1 >= SHN_LORESERVE)
1744 			ehdr->e_shstrndx = SHN_XINDEX;
1745 		else
1746 			ehdr->e_shstrndx = (unsigned short)(nshdrs - 1);
1747 
1748 		ehdr->e_shoff = ehdr->e_phoff + ehdr->e_phentsize * nphdrs;
1749 		ehdr->e_shentsize = sizeof (Shdr);
1750 	}
1751 
1752 	if (error = core_write(vp, UIO_SYSSPACE, (offset_t)0, ehdr,
1753 	    sizeof (Ehdr), rlimit, credp))
1754 		goto done;
1755 
1756 	poffset = sizeof (Ehdr);
1757 	soffset = sizeof (Ehdr) + phdrsz;
1758 	doffset = sizeof (Ehdr) + phdrsz + shdrsz;
1759 
1760 	v = &bigwad->phdr[0];
1761 	bzero(v, phdrsz);
1762 
1763 	setup_old_note_header(&v[0], p);
1764 	v[0].p_offset = doffset = roundup(doffset, sizeof (Word));
1765 	doffset += v[0].p_filesz;
1766 
1767 	setup_note_header(&v[1], p);
1768 	v[1].p_offset = doffset = roundup(doffset, sizeof (Word));
1769 	doffset += v[1].p_filesz;
1770 
1771 	mutex_enter(&p->p_lock);
1772 
1773 	brkbase = p->p_brkbase;
1774 	brksize = p->p_brksize;
1775 
1776 	stkbase = p->p_usrstack - p->p_stksize;
1777 	stksize = p->p_stksize;
1778 
1779 	mutex_exit(&p->p_lock);
1780 
1781 	AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER);
1782 	i = 2;
1783 	for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
1784 		caddr_t eaddr = seg->s_base + pr_getsegsize(seg, 0);
1785 		caddr_t saddr, naddr;
1786 		void *tmp = NULL;
1787 		extern struct seg_ops segspt_shmops;
1788 
1789 		for (saddr = seg->s_base; saddr < eaddr; saddr = naddr) {
1790 			uint_t prot;
1791 			size_t size;
1792 			int type;
1793 			vnode_t *mvp;
1794 
1795 			prot = pr_getprot(seg, 0, &tmp, &saddr, &naddr, eaddr);
1796 			prot &= PROT_READ | PROT_WRITE | PROT_EXEC;
1797 			if ((size = (size_t)(naddr - saddr)) == 0)
1798 				continue;
1799 			if (i == nphdrs) {
1800 				overflow++;
1801 				continue;
1802 			}
1803 			v[i].p_type = PT_LOAD;
1804 			v[i].p_vaddr = (Addr)(uintptr_t)saddr;
1805 			v[i].p_memsz = size;
1806 			if (prot & PROT_READ)
1807 				v[i].p_flags |= PF_R;
1808 			if (prot & PROT_WRITE)
1809 				v[i].p_flags |= PF_W;
1810 			if (prot & PROT_EXEC)
1811 				v[i].p_flags |= PF_X;
1812 
1813 			/*
1814 			 * Figure out which mappings to include in the core.
1815 			 */
1816 			type = SEGOP_GETTYPE(seg, saddr);
1817 
1818 			if (saddr == stkbase && size == stksize) {
1819 				if (!(content & CC_CONTENT_STACK))
1820 					goto exclude;
1821 
1822 			} else if (saddr == brkbase && size == brksize) {
1823 				if (!(content & CC_CONTENT_HEAP))
1824 					goto exclude;
1825 
1826 			} else if (seg->s_ops == &segspt_shmops) {
1827 				if (type & MAP_NORESERVE) {
1828 					if (!(content & CC_CONTENT_DISM))
1829 						goto exclude;
1830 				} else {
1831 					if (!(content & CC_CONTENT_ISM))
1832 						goto exclude;
1833 				}
1834 
1835 			} else if (seg->s_ops != &segvn_ops) {
1836 				goto exclude;
1837 
1838 			} else if (type & MAP_SHARED) {
1839 				if (shmgetid(p, saddr) != SHMID_NONE) {
1840 					if (!(content & CC_CONTENT_SHM))
1841 						goto exclude;
1842 
1843 				} else if (SEGOP_GETVP(seg, seg->s_base,
1844 				    &mvp) != 0 || mvp == NULL ||
1845 				    mvp->v_type != VREG) {
1846 					if (!(content & CC_CONTENT_SHANON))
1847 						goto exclude;
1848 
1849 				} else {
1850 					if (!(content & CC_CONTENT_SHFILE))
1851 						goto exclude;
1852 				}
1853 
1854 			} else if (SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 ||
1855 			    mvp == NULL || mvp->v_type != VREG) {
1856 				if (!(content & CC_CONTENT_ANON))
1857 					goto exclude;
1858 
1859 			} else if (prot == (PROT_READ | PROT_EXEC)) {
1860 				if (!(content & CC_CONTENT_TEXT))
1861 					goto exclude;
1862 
1863 			} else if (prot == PROT_READ) {
1864 				if (!(content & CC_CONTENT_RODATA))
1865 					goto exclude;
1866 
1867 			} else {
1868 				if (!(content & CC_CONTENT_DATA))
1869 					goto exclude;
1870 			}
1871 
1872 			doffset = roundup(doffset, sizeof (Word));
1873 			v[i].p_offset = doffset;
1874 			v[i].p_filesz = size;
1875 			doffset += size;
1876 exclude:
1877 			i++;
1878 		}
1879 		ASSERT(tmp == NULL);
1880 	}
1881 	AS_LOCK_EXIT(as, &as->a_lock);
1882 
1883 	if (overflow || i != nphdrs) {
1884 		if (ntries++ == 0) {
1885 			kmem_free(bigwad, bigsize);
1886 			goto top;
1887 		}
1888 		cmn_err(CE_WARN, "elfcore: core dump failed for "
1889 		    "process %d; address space is changing", p->p_pid);
1890 		error = EIO;
1891 		goto done;
1892 	}
1893 
1894 	if ((error = core_write(vp, UIO_SYSSPACE, poffset,
1895 	    v, phdrsz, rlimit, credp)) != 0)
1896 		goto done;
1897 
1898 	if ((error = write_old_elfnotes(p, sig, vp, v[0].p_offset, rlimit,
1899 	    credp)) != 0)
1900 		goto done;
1901 
1902 	if ((error = write_elfnotes(p, sig, vp, v[1].p_offset, rlimit,
1903 	    credp, content)) != 0)
1904 		goto done;
1905 
1906 	for (i = 2; i < nphdrs; i++) {
1907 		if (v[i].p_filesz == 0)
1908 			continue;
1909 
1910 		/*
1911 		 * If dumping out this segment fails, rather than failing
1912 		 * the core dump entirely, we reset the size of the mapping
1913 		 * to zero to indicate that the data is absent from the core
1914 		 * file and or in the PF_SUNW_FAILURE flag to differentiate
1915 		 * this from mappings that were excluded due to the core file
1916 		 * content settings.
1917 		 */
1918 		if ((error = core_seg(p, vp, v[i].p_offset,
1919 		    (caddr_t)(uintptr_t)v[i].p_vaddr, v[i].p_filesz,
1920 		    rlimit, credp)) != 0) {
1921 
1922 			/*
1923 			 * Since the space reserved for the segment is now
1924 			 * unused, we stash the errno in the first four
1925 			 * bytes. This undocumented interface will let us
1926 			 * understand the nature of the failure.
1927 			 */
1928 			(void) core_write(vp, UIO_SYSSPACE, v[i].p_offset,
1929 			    &error, sizeof (error), rlimit, credp);
1930 
1931 			v[i].p_filesz = 0;
1932 			v[i].p_flags |= PF_SUNW_FAILURE;
1933 			if ((error = core_write(vp, UIO_SYSSPACE,
1934 			    poffset + sizeof (v[i]) * i, &v[i], sizeof (v[i]),
1935 			    rlimit, credp)) != 0)
1936 				goto done;
1937 		}
1938 	}
1939 
1940 	if (nshdrs > 0) {
1941 		bzero(&bigwad->shdr[0], shdrsz);
1942 
1943 		if (nshdrs >= SHN_LORESERVE)
1944 			bigwad->shdr[0].sh_size = nshdrs;
1945 
1946 		if (nshdrs - 1 >= SHN_LORESERVE)
1947 			bigwad->shdr[0].sh_link = nshdrs - 1;
1948 
1949 		if (nphdrs >= PN_XNUM)
1950 			bigwad->shdr[0].sh_info = nphdrs;
1951 
1952 		if (nshdrs > 1) {
1953 			AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER);
1954 			if ((error = process_scns(content, p, credp, vp,
1955 			    &bigwad->shdr[0], nshdrs, rlimit, &doffset,
1956 			    NULL)) != 0) {
1957 				AS_LOCK_EXIT(as, &as->a_lock);
1958 				goto done;
1959 			}
1960 			AS_LOCK_EXIT(as, &as->a_lock);
1961 		}
1962 
1963 		if ((error = core_write(vp, UIO_SYSSPACE, soffset,
1964 		    &bigwad->shdr[0], shdrsz, rlimit, credp)) != 0)
1965 			goto done;
1966 	}
1967 
1968 done:
1969 	kmem_free(bigwad, bigsize);
1970 	return (error);
1971 }
1972 
1973 #ifndef	_ELF32_COMPAT
1974 
1975 static struct execsw esw = {
1976 #ifdef	_LP64
1977 	elf64magicstr,
1978 #else	/* _LP64 */
1979 	elf32magicstr,
1980 #endif	/* _LP64 */
1981 	0,
1982 	5,
1983 	elfexec,
1984 	elfcore
1985 };
1986 
1987 static struct modlexec modlexec = {
1988 	&mod_execops, "exec module for elf %I%", &esw
1989 };
1990 
1991 #ifdef	_LP64
1992 extern int elf32exec(vnode_t *vp, execa_t *uap, uarg_t *args,
1993 			intpdata_t *idatap, int level, long *execsz,
1994 			int setid, caddr_t exec_file, cred_t *cred,
1995 			int brand_action);
1996 extern int elf32core(vnode_t *vp, proc_t *p, cred_t *credp,
1997 			rlim64_t rlimit, int sig, core_content_t content);
1998 
1999 static struct execsw esw32 = {
2000 	elf32magicstr,
2001 	0,
2002 	5,
2003 	elf32exec,
2004 	elf32core
2005 };
2006 
2007 static struct modlexec modlexec32 = {
2008 	&mod_execops, "32-bit exec module for elf", &esw32
2009 };
2010 #endif	/* _LP64 */
2011 
2012 static struct modlinkage modlinkage = {
2013 	MODREV_1,
2014 	(void *)&modlexec,
2015 #ifdef	_LP64
2016 	(void *)&modlexec32,
2017 #endif	/* _LP64 */
2018 	NULL
2019 };
2020 
2021 int
2022 _init(void)
2023 {
2024 	return (mod_install(&modlinkage));
2025 }
2026 
2027 int
2028 _fini(void)
2029 {
2030 	return (mod_remove(&modlinkage));
2031 }
2032 
2033 int
2034 _info(struct modinfo *modinfop)
2035 {
2036 	return (mod_info(&modlinkage, modinfop));
2037 }
2038 
2039 #endif	/* !_ELF32_COMPAT */
2040