1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved. 24 */ 25 26 /* Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */ 27 /* All Rights Reserved */ 28 /* 29 * Copyright (c) 2012, Joyent, Inc. All rights reserved. 30 */ 31 32 #include <sys/types.h> 33 #include <sys/param.h> 34 #include <sys/thread.h> 35 #include <sys/sysmacros.h> 36 #include <sys/signal.h> 37 #include <sys/cred.h> 38 #include <sys/user.h> 39 #include <sys/errno.h> 40 #include <sys/vnode.h> 41 #include <sys/mman.h> 42 #include <sys/kmem.h> 43 #include <sys/proc.h> 44 #include <sys/pathname.h> 45 #include <sys/cmn_err.h> 46 #include <sys/systm.h> 47 #include <sys/elf.h> 48 #include <sys/vmsystm.h> 49 #include <sys/debug.h> 50 #include <sys/auxv.h> 51 #include <sys/exec.h> 52 #include <sys/prsystm.h> 53 #include <vm/as.h> 54 #include <vm/rm.h> 55 #include <vm/seg.h> 56 #include <vm/seg_vn.h> 57 #include <sys/modctl.h> 58 #include <sys/systeminfo.h> 59 #include <sys/vmparam.h> 60 #include <sys/machelf.h> 61 #include <sys/shm_impl.h> 62 #include <sys/archsystm.h> 63 #include <sys/fasttrap.h> 64 #include <sys/brand.h> 65 #include "elf_impl.h" 66 #include <sys/sdt.h> 67 68 extern int at_flags; 69 70 #define ORIGIN_STR "ORIGIN" 71 #define ORIGIN_STR_SIZE 6 72 73 static int getelfhead(vnode_t *, cred_t *, Ehdr *, int *, int *, int *); 74 static int getelfphdr(vnode_t *, cred_t *, const Ehdr *, int, caddr_t *, 75 ssize_t *); 76 static int getelfshdr(vnode_t *, cred_t *, const Ehdr *, int, int, caddr_t *, 77 ssize_t *, caddr_t *, ssize_t *); 78 static size_t elfsize(Ehdr *, int, caddr_t, uintptr_t *); 79 static int mapelfexec(vnode_t *, Ehdr *, int, caddr_t, 80 Phdr **, Phdr **, Phdr **, Phdr **, Phdr *, 81 caddr_t *, caddr_t *, intptr_t *, intptr_t *, size_t, long *, size_t *); 82 83 typedef enum { 84 STR_CTF, 85 STR_SYMTAB, 86 STR_DYNSYM, 87 STR_STRTAB, 88 STR_DYNSTR, 89 STR_SHSTRTAB, 90 STR_NUM 91 } shstrtype_t; 92 93 static const char *shstrtab_data[] = { 94 ".SUNW_ctf", 95 ".symtab", 96 ".dynsym", 97 ".strtab", 98 ".dynstr", 99 ".shstrtab" 100 }; 101 102 typedef struct shstrtab { 103 int sst_ndx[STR_NUM]; 104 int sst_cur; 105 } shstrtab_t; 106 107 static void 108 shstrtab_init(shstrtab_t *s) 109 { 110 bzero(&s->sst_ndx, sizeof (s->sst_ndx)); 111 s->sst_cur = 1; 112 } 113 114 static int 115 shstrtab_ndx(shstrtab_t *s, shstrtype_t type) 116 { 117 int ret; 118 119 if ((ret = s->sst_ndx[type]) != 0) 120 return (ret); 121 122 ret = s->sst_ndx[type] = s->sst_cur; 123 s->sst_cur += strlen(shstrtab_data[type]) + 1; 124 125 return (ret); 126 } 127 128 static size_t 129 shstrtab_size(const shstrtab_t *s) 130 { 131 return (s->sst_cur); 132 } 133 134 static void 135 shstrtab_dump(const shstrtab_t *s, char *buf) 136 { 137 int i, ndx; 138 139 *buf = '\0'; 140 for (i = 0; i < STR_NUM; i++) { 141 if ((ndx = s->sst_ndx[i]) != 0) 142 (void) strcpy(buf + ndx, shstrtab_data[i]); 143 } 144 } 145 146 static int 147 dtrace_safe_phdr(Phdr *phdrp, struct uarg *args, uintptr_t base) 148 { 149 ASSERT(phdrp->p_type == PT_SUNWDTRACE); 150 151 /* 152 * See the comment in fasttrap.h for information on how to safely 153 * update this program header. 154 */ 155 if (phdrp->p_memsz < PT_SUNWDTRACE_SIZE || 156 (phdrp->p_flags & (PF_R | PF_W | PF_X)) != (PF_R | PF_W | PF_X)) 157 return (-1); 158 159 args->thrptr = phdrp->p_vaddr + base; 160 161 return (0); 162 } 163 164 /* 165 * Map in the executable pointed to by vp. Returns 0 on success. 166 */ 167 int 168 mapexec_brand(vnode_t *vp, uarg_t *args, Ehdr *ehdr, Addr *uphdr_vaddr, 169 intptr_t *voffset, caddr_t exec_file, int *interp, caddr_t *bssbase, 170 caddr_t *brkbase, size_t *brksize, uintptr_t *lddatap) 171 { 172 size_t len; 173 struct vattr vat; 174 caddr_t phdrbase = NULL; 175 ssize_t phdrsize; 176 int nshdrs, shstrndx, nphdrs; 177 int error = 0; 178 Phdr *uphdr = NULL; 179 Phdr *junk = NULL; 180 Phdr *dynphdr = NULL; 181 Phdr *dtrphdr = NULL; 182 uintptr_t lddata; 183 long execsz; 184 intptr_t minaddr; 185 186 if (lddatap != NULL) 187 *lddatap = NULL; 188 189 if (error = execpermissions(vp, &vat, args)) { 190 uprintf("%s: Cannot execute %s\n", exec_file, args->pathname); 191 return (error); 192 } 193 194 if ((error = getelfhead(vp, CRED(), ehdr, &nshdrs, &shstrndx, 195 &nphdrs)) != 0 || 196 (error = getelfphdr(vp, CRED(), ehdr, nphdrs, &phdrbase, 197 &phdrsize)) != 0) { 198 uprintf("%s: Cannot read %s\n", exec_file, args->pathname); 199 return (error); 200 } 201 202 if ((len = elfsize(ehdr, nphdrs, phdrbase, &lddata)) == 0) { 203 uprintf("%s: Nothing to load in %s", exec_file, args->pathname); 204 kmem_free(phdrbase, phdrsize); 205 return (ENOEXEC); 206 } 207 if (lddatap != NULL) 208 *lddatap = lddata; 209 210 if (error = mapelfexec(vp, ehdr, nphdrs, phdrbase, &uphdr, &dynphdr, 211 &junk, &dtrphdr, NULL, bssbase, brkbase, voffset, &minaddr, 212 len, &execsz, brksize)) { 213 uprintf("%s: Cannot map %s\n", exec_file, args->pathname); 214 kmem_free(phdrbase, phdrsize); 215 return (error); 216 } 217 218 /* 219 * Inform our caller if the executable needs an interpreter. 220 */ 221 *interp = (dynphdr == NULL) ? 0 : 1; 222 223 /* 224 * If this is a statically linked executable, voffset should indicate 225 * the address of the executable itself (it normally holds the address 226 * of the interpreter). 227 */ 228 if (ehdr->e_type == ET_EXEC && *interp == 0) 229 *voffset = minaddr; 230 231 if (uphdr != NULL) { 232 *uphdr_vaddr = uphdr->p_vaddr; 233 } else { 234 *uphdr_vaddr = (Addr)-1; 235 } 236 237 kmem_free(phdrbase, phdrsize); 238 return (error); 239 } 240 241 /*ARGSUSED*/ 242 int 243 elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap, 244 int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred, 245 int brand_action) 246 { 247 caddr_t phdrbase = NULL; 248 caddr_t bssbase = 0; 249 caddr_t brkbase = 0; 250 size_t brksize = 0; 251 ssize_t dlnsize; 252 aux_entry_t *aux; 253 int error; 254 ssize_t resid; 255 int fd = -1; 256 intptr_t voffset; 257 Phdr *dyphdr = NULL; 258 Phdr *stphdr = NULL; 259 Phdr *uphdr = NULL; 260 Phdr *junk = NULL; 261 size_t len; 262 ssize_t phdrsize; 263 int postfixsize = 0; 264 int i, hsize; 265 Phdr *phdrp; 266 Phdr *dataphdrp = NULL; 267 Phdr *dtrphdr; 268 Phdr *capphdr = NULL; 269 Cap *cap = NULL; 270 ssize_t capsize; 271 int hasu = 0; 272 int hasauxv = 0; 273 int hasdy = 0; 274 int branded = 0; 275 276 struct proc *p = ttoproc(curthread); 277 struct user *up = PTOU(p); 278 struct bigwad { 279 Ehdr ehdr; 280 aux_entry_t elfargs[__KERN_NAUXV_IMPL]; 281 char dl_name[MAXPATHLEN]; 282 char pathbuf[MAXPATHLEN]; 283 struct vattr vattr; 284 struct execenv exenv; 285 } *bigwad; /* kmem_alloc this behemoth so we don't blow stack */ 286 Ehdr *ehdrp; 287 int nshdrs, shstrndx, nphdrs; 288 char *dlnp; 289 char *pathbufp; 290 rlim64_t limit; 291 rlim64_t roundlimit; 292 293 ASSERT(p->p_model == DATAMODEL_ILP32 || p->p_model == DATAMODEL_LP64); 294 295 bigwad = kmem_alloc(sizeof (struct bigwad), KM_SLEEP); 296 ehdrp = &bigwad->ehdr; 297 dlnp = bigwad->dl_name; 298 pathbufp = bigwad->pathbuf; 299 300 /* 301 * Obtain ELF and program header information. 302 */ 303 if ((error = getelfhead(vp, CRED(), ehdrp, &nshdrs, &shstrndx, 304 &nphdrs)) != 0 || 305 (error = getelfphdr(vp, CRED(), ehdrp, nphdrs, &phdrbase, 306 &phdrsize)) != 0) 307 goto out; 308 309 /* 310 * Prevent executing an ELF file that has no entry point. 311 */ 312 if (ehdrp->e_entry == 0) { 313 uprintf("%s: Bad entry point\n", exec_file); 314 goto bad; 315 } 316 317 /* 318 * Put data model that we're exec-ing to into the args passed to 319 * exec_args(), so it will know what it is copying to on new stack. 320 * Now that we know whether we are exec-ing a 32-bit or 64-bit 321 * executable, we can set execsz with the appropriate NCARGS. 322 */ 323 #ifdef _LP64 324 if (ehdrp->e_ident[EI_CLASS] == ELFCLASS32) { 325 args->to_model = DATAMODEL_ILP32; 326 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS32-1); 327 } else { 328 args->to_model = DATAMODEL_LP64; 329 args->stk_prot &= ~PROT_EXEC; 330 #if defined(__i386) || defined(__amd64) 331 args->dat_prot &= ~PROT_EXEC; 332 #endif 333 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS64-1); 334 } 335 #else /* _LP64 */ 336 args->to_model = DATAMODEL_ILP32; 337 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS-1); 338 #endif /* _LP64 */ 339 340 /* 341 * We delay invoking the brand callback until we've figured out 342 * what kind of elf binary we're trying to run, 32-bit or 64-bit. 343 * We do this because now the brand library can just check 344 * args->to_model to see if the target is 32-bit or 64-bit without 345 * having do duplicate all the code above. 346 */ 347 if ((level < 2) && 348 (brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) { 349 error = BROP(p)->b_elfexec(vp, uap, args, 350 idatap, level + 1, execsz, setid, exec_file, cred, 351 brand_action); 352 goto out; 353 } 354 355 /* 356 * Determine aux size now so that stack can be built 357 * in one shot (except actual copyout of aux image), 358 * determine any non-default stack protections, 359 * and still have this code be machine independent. 360 */ 361 hsize = ehdrp->e_phentsize; 362 phdrp = (Phdr *)phdrbase; 363 for (i = nphdrs; i > 0; i--) { 364 switch (phdrp->p_type) { 365 case PT_INTERP: 366 hasauxv = hasdy = 1; 367 break; 368 case PT_PHDR: 369 hasu = 1; 370 break; 371 case PT_SUNWSTACK: 372 args->stk_prot = PROT_USER; 373 if (phdrp->p_flags & PF_R) 374 args->stk_prot |= PROT_READ; 375 if (phdrp->p_flags & PF_W) 376 args->stk_prot |= PROT_WRITE; 377 if (phdrp->p_flags & PF_X) 378 args->stk_prot |= PROT_EXEC; 379 break; 380 case PT_LOAD: 381 dataphdrp = phdrp; 382 break; 383 case PT_SUNWCAP: 384 capphdr = phdrp; 385 break; 386 } 387 phdrp = (Phdr *)((caddr_t)phdrp + hsize); 388 } 389 390 if (ehdrp->e_type != ET_EXEC) { 391 dataphdrp = NULL; 392 hasauxv = 1; 393 } 394 395 /* Copy BSS permissions to args->dat_prot */ 396 if (dataphdrp != NULL) { 397 args->dat_prot = PROT_USER; 398 if (dataphdrp->p_flags & PF_R) 399 args->dat_prot |= PROT_READ; 400 if (dataphdrp->p_flags & PF_W) 401 args->dat_prot |= PROT_WRITE; 402 if (dataphdrp->p_flags & PF_X) 403 args->dat_prot |= PROT_EXEC; 404 } 405 406 /* 407 * If a auxvector will be required - reserve the space for 408 * it now. This may be increased by exec_args if there are 409 * ISA-specific types (included in __KERN_NAUXV_IMPL). 410 */ 411 if (hasauxv) { 412 /* 413 * If a AUX vector is being built - the base AUX 414 * entries are: 415 * 416 * AT_BASE 417 * AT_FLAGS 418 * AT_PAGESZ 419 * AT_SUN_LDSECURE 420 * AT_SUN_HWCAP 421 * AT_SUN_HWCAP2 422 * AT_SUN_PLATFORM 423 * AT_SUN_EXECNAME 424 * AT_NULL 425 * 426 * total == 9 427 */ 428 if (hasdy && hasu) { 429 /* 430 * Has PT_INTERP & PT_PHDR - the auxvectors that 431 * will be built are: 432 * 433 * AT_PHDR 434 * AT_PHENT 435 * AT_PHNUM 436 * AT_ENTRY 437 * AT_LDDATA 438 * 439 * total = 5 440 */ 441 args->auxsize = (9 + 5) * sizeof (aux_entry_t); 442 } else if (hasdy) { 443 /* 444 * Has PT_INTERP but no PT_PHDR 445 * 446 * AT_EXECFD 447 * AT_LDDATA 448 * 449 * total = 2 450 */ 451 args->auxsize = (9 + 2) * sizeof (aux_entry_t); 452 } else { 453 args->auxsize = 9 * sizeof (aux_entry_t); 454 } 455 } else { 456 args->auxsize = 0; 457 } 458 459 /* 460 * If this binary is using an emulator, we need to add an 461 * AT_SUN_EMULATOR aux entry. 462 */ 463 if (args->emulator != NULL) 464 args->auxsize += sizeof (aux_entry_t); 465 466 if ((brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) { 467 branded = 1; 468 /* 469 * We will be adding 4 entries to the aux vectors. One for 470 * the the brandname and 3 for the brand specific aux vectors. 471 */ 472 args->auxsize += 4 * sizeof (aux_entry_t); 473 } 474 475 /* Hardware/Software capabilities */ 476 if (capphdr != NULL && 477 (capsize = capphdr->p_filesz) > 0 && 478 capsize <= 16 * sizeof (*cap)) { 479 int ncaps = capsize / sizeof (*cap); 480 Cap *cp; 481 482 cap = kmem_alloc(capsize, KM_SLEEP); 483 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)cap, 484 capsize, (offset_t)capphdr->p_offset, 485 UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid)) != 0) { 486 uprintf("%s: Cannot read capabilities section\n", 487 exec_file); 488 goto out; 489 } 490 for (cp = cap; cp < cap + ncaps; cp++) { 491 if (cp->c_tag == CA_SUNW_SF_1 && 492 (cp->c_un.c_val & SF1_SUNW_ADDR32)) { 493 if (args->to_model == DATAMODEL_LP64) 494 args->addr32 = 1; 495 break; 496 } 497 } 498 } 499 500 aux = bigwad->elfargs; 501 /* 502 * Move args to the user's stack. 503 */ 504 if ((error = exec_args(uap, args, idatap, (void **)&aux)) != 0) { 505 if (error == -1) { 506 error = ENOEXEC; 507 goto bad; 508 } 509 goto out; 510 } 511 /* we're single threaded after this point */ 512 513 /* 514 * If this is an ET_DYN executable (shared object), 515 * determine its memory size so that mapelfexec() can load it. 516 */ 517 if (ehdrp->e_type == ET_DYN) 518 len = elfsize(ehdrp, nphdrs, phdrbase, NULL); 519 else 520 len = 0; 521 522 dtrphdr = NULL; 523 524 if ((error = mapelfexec(vp, ehdrp, nphdrs, phdrbase, &uphdr, &dyphdr, 525 &stphdr, &dtrphdr, dataphdrp, &bssbase, &brkbase, &voffset, NULL, 526 len, execsz, &brksize)) != 0) 527 goto bad; 528 529 if (uphdr != NULL && dyphdr == NULL) 530 goto bad; 531 532 if (dtrphdr != NULL && dtrace_safe_phdr(dtrphdr, args, voffset) != 0) { 533 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, exec_file); 534 goto bad; 535 } 536 537 if (dyphdr != NULL) { 538 size_t len; 539 uintptr_t lddata; 540 char *p; 541 struct vnode *nvp; 542 543 dlnsize = dyphdr->p_filesz; 544 545 if (dlnsize > MAXPATHLEN || dlnsize <= 0) 546 goto bad; 547 548 /* 549 * Read in "interpreter" pathname. 550 */ 551 if ((error = vn_rdwr(UIO_READ, vp, dlnp, dyphdr->p_filesz, 552 (offset_t)dyphdr->p_offset, UIO_SYSSPACE, 0, (rlim64_t)0, 553 CRED(), &resid)) != 0) { 554 uprintf("%s: Cannot obtain interpreter pathname\n", 555 exec_file); 556 goto bad; 557 } 558 559 if (resid != 0 || dlnp[dlnsize - 1] != '\0') 560 goto bad; 561 562 /* 563 * Search for '$ORIGIN' token in interpreter path. 564 * If found, expand it. 565 */ 566 for (p = dlnp; p = strchr(p, '$'); ) { 567 uint_t len, curlen; 568 char *_ptr; 569 570 if (strncmp(++p, ORIGIN_STR, ORIGIN_STR_SIZE)) 571 continue; 572 573 curlen = 0; 574 len = p - dlnp - 1; 575 if (len) { 576 bcopy(dlnp, pathbufp, len); 577 curlen += len; 578 } 579 if (_ptr = strrchr(args->pathname, '/')) { 580 len = _ptr - args->pathname; 581 if ((curlen + len) > MAXPATHLEN) 582 break; 583 584 bcopy(args->pathname, &pathbufp[curlen], len); 585 curlen += len; 586 } else { 587 /* 588 * executable is a basename found in the 589 * current directory. So - just substitue 590 * '.' for ORIGIN. 591 */ 592 pathbufp[curlen] = '.'; 593 curlen++; 594 } 595 p += ORIGIN_STR_SIZE; 596 len = strlen(p); 597 598 if ((curlen + len) > MAXPATHLEN) 599 break; 600 bcopy(p, &pathbufp[curlen], len); 601 curlen += len; 602 pathbufp[curlen++] = '\0'; 603 bcopy(pathbufp, dlnp, curlen); 604 } 605 606 /* 607 * /usr/lib/ld.so.1 is known to be a symlink to /lib/ld.so.1 608 * (and /usr/lib/64/ld.so.1 is a symlink to /lib/64/ld.so.1). 609 * Just in case /usr is not mounted, change it now. 610 */ 611 if (strcmp(dlnp, USR_LIB_RTLD) == 0) 612 dlnp += 4; 613 error = lookupname(dlnp, UIO_SYSSPACE, FOLLOW, NULLVPP, &nvp); 614 if (error && dlnp != bigwad->dl_name) { 615 /* new kernel, old user-level */ 616 error = lookupname(dlnp -= 4, UIO_SYSSPACE, FOLLOW, 617 NULLVPP, &nvp); 618 } 619 if (error) { 620 uprintf("%s: Cannot find %s\n", exec_file, dlnp); 621 goto bad; 622 } 623 624 /* 625 * Setup the "aux" vector. 626 */ 627 if (uphdr) { 628 if (ehdrp->e_type == ET_DYN) { 629 /* don't use the first page */ 630 bigwad->exenv.ex_brkbase = (caddr_t)PAGESIZE; 631 bigwad->exenv.ex_bssbase = (caddr_t)PAGESIZE; 632 } else { 633 bigwad->exenv.ex_bssbase = bssbase; 634 bigwad->exenv.ex_brkbase = brkbase; 635 } 636 bigwad->exenv.ex_brksize = brksize; 637 bigwad->exenv.ex_magic = elfmagic; 638 bigwad->exenv.ex_vp = vp; 639 setexecenv(&bigwad->exenv); 640 641 ADDAUX(aux, AT_PHDR, uphdr->p_vaddr + voffset) 642 ADDAUX(aux, AT_PHENT, ehdrp->e_phentsize) 643 ADDAUX(aux, AT_PHNUM, nphdrs) 644 ADDAUX(aux, AT_ENTRY, ehdrp->e_entry + voffset) 645 } else { 646 if ((error = execopen(&vp, &fd)) != 0) { 647 VN_RELE(nvp); 648 goto bad; 649 } 650 651 ADDAUX(aux, AT_EXECFD, fd) 652 } 653 654 if ((error = execpermissions(nvp, &bigwad->vattr, args)) != 0) { 655 VN_RELE(nvp); 656 uprintf("%s: Cannot execute %s\n", exec_file, dlnp); 657 goto bad; 658 } 659 660 /* 661 * Now obtain the ELF header along with the entire program 662 * header contained in "nvp". 663 */ 664 kmem_free(phdrbase, phdrsize); 665 phdrbase = NULL; 666 if ((error = getelfhead(nvp, CRED(), ehdrp, &nshdrs, 667 &shstrndx, &nphdrs)) != 0 || 668 (error = getelfphdr(nvp, CRED(), ehdrp, nphdrs, &phdrbase, 669 &phdrsize)) != 0) { 670 VN_RELE(nvp); 671 uprintf("%s: Cannot read %s\n", exec_file, dlnp); 672 goto bad; 673 } 674 675 /* 676 * Determine memory size of the "interpreter's" loadable 677 * sections. This size is then used to obtain the virtual 678 * address of a hole, in the user's address space, large 679 * enough to map the "interpreter". 680 */ 681 if ((len = elfsize(ehdrp, nphdrs, phdrbase, &lddata)) == 0) { 682 VN_RELE(nvp); 683 uprintf("%s: Nothing to load in %s\n", exec_file, dlnp); 684 goto bad; 685 } 686 687 dtrphdr = NULL; 688 689 error = mapelfexec(nvp, ehdrp, nphdrs, phdrbase, &junk, &junk, 690 &junk, &dtrphdr, NULL, NULL, NULL, &voffset, NULL, len, 691 execsz, NULL); 692 if (error || junk != NULL) { 693 VN_RELE(nvp); 694 uprintf("%s: Cannot map %s\n", exec_file, dlnp); 695 goto bad; 696 } 697 698 /* 699 * We use the DTrace program header to initialize the 700 * architecture-specific user per-LWP location. The dtrace 701 * fasttrap provider requires ready access to per-LWP scratch 702 * space. We assume that there is only one such program header 703 * in the interpreter. 704 */ 705 if (dtrphdr != NULL && 706 dtrace_safe_phdr(dtrphdr, args, voffset) != 0) { 707 VN_RELE(nvp); 708 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, dlnp); 709 goto bad; 710 } 711 712 VN_RELE(nvp); 713 ADDAUX(aux, AT_SUN_LDDATA, voffset + lddata) 714 } 715 716 if (hasauxv) { 717 int auxf = AF_SUN_HWCAPVERIFY; 718 /* 719 * Note: AT_SUN_PLATFORM was filled in via exec_args() 720 */ 721 ADDAUX(aux, AT_BASE, voffset) 722 ADDAUX(aux, AT_FLAGS, at_flags) 723 ADDAUX(aux, AT_PAGESZ, PAGESIZE) 724 /* 725 * Linker flags. (security) 726 * p_flag not yet set at this time. 727 * We rely on gexec() to provide us with the information. 728 * If the application is set-uid but this is not reflected 729 * in a mismatch between real/effective uids/gids, then 730 * don't treat this as a set-uid exec. So we care about 731 * the EXECSETID_UGIDS flag but not the ...SETID flag. 732 */ 733 if ((setid &= ~EXECSETID_SETID) != 0) 734 auxf |= AF_SUN_SETUGID; 735 736 /* 737 * If we're running a native process from within a branded 738 * zone under pfexec then we clear the AF_SUN_SETUGID flag so 739 * that the native ld.so.1 is able to link with the native 740 * libraries instead of using the brand libraries that are 741 * installed in the zone. We only do this for processes 742 * which we trust because we see they are already running 743 * under pfexec (where uid != euid). This prevents a 744 * malicious user within the zone from crafting a wrapper to 745 * run native suid commands with unsecure libraries interposed. 746 */ 747 if ((brand_action == EBA_NATIVE) && (PROC_IS_BRANDED(p) && 748 (setid &= ~EXECSETID_SETID) != 0)) 749 auxf &= ~AF_SUN_SETUGID; 750 751 /* 752 * Record the user addr of the auxflags aux vector entry 753 * since brands may optionally want to manipulate this field. 754 */ 755 args->auxp_auxflags = 756 (char *)((char *)args->stackend + 757 ((char *)&aux->a_type - 758 (char *)bigwad->elfargs)); 759 ADDAUX(aux, AT_SUN_AUXFLAGS, auxf); 760 /* 761 * Hardware capability flag word (performance hints) 762 * Used for choosing faster library routines. 763 * (Potentially different between 32-bit and 64-bit ABIs) 764 */ 765 #if defined(_LP64) 766 if (args->to_model == DATAMODEL_NATIVE) { 767 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap) 768 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2) 769 } else { 770 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap32) 771 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap32_2) 772 } 773 #else 774 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap) 775 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2) 776 #endif 777 if (branded) { 778 /* 779 * Reserve space for the brand-private aux vectors, 780 * and record the user addr of that space. 781 */ 782 args->auxp_brand = 783 (char *)((char *)args->stackend + 784 ((char *)&aux->a_type - 785 (char *)bigwad->elfargs)); 786 ADDAUX(aux, AT_SUN_BRAND_AUX1, 0) 787 ADDAUX(aux, AT_SUN_BRAND_AUX2, 0) 788 ADDAUX(aux, AT_SUN_BRAND_AUX3, 0) 789 } 790 791 ADDAUX(aux, AT_NULL, 0) 792 postfixsize = (char *)aux - (char *)bigwad->elfargs; 793 ASSERT(postfixsize == args->auxsize); 794 ASSERT(postfixsize <= __KERN_NAUXV_IMPL * sizeof (aux_entry_t)); 795 } 796 797 /* 798 * For the 64-bit kernel, the limit is big enough that rounding it up 799 * to a page can overflow the 64-bit limit, so we check for btopr() 800 * overflowing here by comparing it with the unrounded limit in pages. 801 * If it hasn't overflowed, compare the exec size with the rounded up 802 * limit in pages. Otherwise, just compare with the unrounded limit. 803 */ 804 limit = btop(p->p_vmem_ctl); 805 roundlimit = btopr(p->p_vmem_ctl); 806 if ((roundlimit > limit && *execsz > roundlimit) || 807 (roundlimit < limit && *execsz > limit)) { 808 mutex_enter(&p->p_lock); 809 (void) rctl_action(rctlproc_legacy[RLIMIT_VMEM], p->p_rctls, p, 810 RCA_SAFE); 811 mutex_exit(&p->p_lock); 812 error = ENOMEM; 813 goto bad; 814 } 815 816 bzero(up->u_auxv, sizeof (up->u_auxv)); 817 if (postfixsize) { 818 int num_auxv; 819 820 /* 821 * Copy the aux vector to the user stack. 822 */ 823 error = execpoststack(args, bigwad->elfargs, postfixsize); 824 if (error) 825 goto bad; 826 827 /* 828 * Copy auxv to the process's user structure for use by /proc. 829 * If this is a branded process, the brand's exec routine will 830 * copy it's private entries to the user structure later. It 831 * relies on the fact that the blank entries are at the end. 832 */ 833 num_auxv = postfixsize / sizeof (aux_entry_t); 834 ASSERT(num_auxv <= sizeof (up->u_auxv) / sizeof (auxv_t)); 835 aux = bigwad->elfargs; 836 for (i = 0; i < num_auxv; i++) { 837 up->u_auxv[i].a_type = aux[i].a_type; 838 up->u_auxv[i].a_un.a_val = (aux_val_t)aux[i].a_un.a_val; 839 } 840 } 841 842 /* 843 * Pass back the starting address so we can set the program counter. 844 */ 845 args->entry = (uintptr_t)(ehdrp->e_entry + voffset); 846 847 if (!uphdr) { 848 if (ehdrp->e_type == ET_DYN) { 849 /* 850 * If we are executing a shared library which doesn't 851 * have a interpreter (probably ld.so.1) then 852 * we don't set the brkbase now. Instead we 853 * delay it's setting until the first call 854 * via grow.c::brk(). This permits ld.so.1 to 855 * initialize brkbase to the tail of the executable it 856 * loads (which is where it needs to be). 857 */ 858 bigwad->exenv.ex_brkbase = (caddr_t)0; 859 bigwad->exenv.ex_bssbase = (caddr_t)0; 860 bigwad->exenv.ex_brksize = 0; 861 } else { 862 bigwad->exenv.ex_brkbase = brkbase; 863 bigwad->exenv.ex_bssbase = bssbase; 864 bigwad->exenv.ex_brksize = brksize; 865 } 866 bigwad->exenv.ex_magic = elfmagic; 867 bigwad->exenv.ex_vp = vp; 868 setexecenv(&bigwad->exenv); 869 } 870 871 ASSERT(error == 0); 872 goto out; 873 874 bad: 875 if (fd != -1) /* did we open the a.out yet */ 876 (void) execclose(fd); 877 878 psignal(p, SIGKILL); 879 880 if (error == 0) 881 error = ENOEXEC; 882 out: 883 if (phdrbase != NULL) 884 kmem_free(phdrbase, phdrsize); 885 if (cap != NULL) 886 kmem_free(cap, capsize); 887 kmem_free(bigwad, sizeof (struct bigwad)); 888 return (error); 889 } 890 891 /* 892 * Compute the memory size requirement for the ELF file. 893 */ 894 static size_t 895 elfsize(Ehdr *ehdrp, int nphdrs, caddr_t phdrbase, uintptr_t *lddata) 896 { 897 size_t len; 898 Phdr *phdrp = (Phdr *)phdrbase; 899 int hsize = ehdrp->e_phentsize; 900 int first = 1; 901 int dfirst = 1; /* first data segment */ 902 uintptr_t loaddr = 0; 903 uintptr_t hiaddr = 0; 904 uintptr_t lo, hi; 905 int i; 906 907 for (i = nphdrs; i > 0; i--) { 908 if (phdrp->p_type == PT_LOAD) { 909 lo = phdrp->p_vaddr; 910 hi = lo + phdrp->p_memsz; 911 if (first) { 912 loaddr = lo; 913 hiaddr = hi; 914 first = 0; 915 } else { 916 if (loaddr > lo) 917 loaddr = lo; 918 if (hiaddr < hi) 919 hiaddr = hi; 920 } 921 922 /* 923 * save the address of the first data segment 924 * of a object - used for the AT_SUNW_LDDATA 925 * aux entry. 926 */ 927 if ((lddata != NULL) && dfirst && 928 (phdrp->p_flags & PF_W)) { 929 *lddata = lo; 930 dfirst = 0; 931 } 932 } 933 phdrp = (Phdr *)((caddr_t)phdrp + hsize); 934 } 935 936 len = hiaddr - (loaddr & PAGEMASK); 937 len = roundup(len, PAGESIZE); 938 939 return (len); 940 } 941 942 /* 943 * Read in the ELF header and program header table. 944 * SUSV3 requires: 945 * ENOEXEC File format is not recognized 946 * EINVAL Format recognized but execution not supported 947 */ 948 static int 949 getelfhead(vnode_t *vp, cred_t *credp, Ehdr *ehdr, int *nshdrs, int *shstrndx, 950 int *nphdrs) 951 { 952 int error; 953 ssize_t resid; 954 955 /* 956 * We got here by the first two bytes in ident, 957 * now read the entire ELF header. 958 */ 959 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)ehdr, 960 sizeof (Ehdr), (offset_t)0, UIO_SYSSPACE, 0, 961 (rlim64_t)0, credp, &resid)) != 0) 962 return (error); 963 964 /* 965 * Since a separate version is compiled for handling 32-bit and 966 * 64-bit ELF executables on a 64-bit kernel, the 64-bit version 967 * doesn't need to be able to deal with 32-bit ELF files. 968 */ 969 if (resid != 0 || 970 ehdr->e_ident[EI_MAG2] != ELFMAG2 || 971 ehdr->e_ident[EI_MAG3] != ELFMAG3) 972 return (ENOEXEC); 973 974 if ((ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) || 975 #if defined(_ILP32) || defined(_ELF32_COMPAT) 976 ehdr->e_ident[EI_CLASS] != ELFCLASS32 || 977 #else 978 ehdr->e_ident[EI_CLASS] != ELFCLASS64 || 979 #endif 980 !elfheadcheck(ehdr->e_ident[EI_DATA], ehdr->e_machine, 981 ehdr->e_flags)) 982 return (EINVAL); 983 984 *nshdrs = ehdr->e_shnum; 985 *shstrndx = ehdr->e_shstrndx; 986 *nphdrs = ehdr->e_phnum; 987 988 /* 989 * If e_shnum, e_shstrndx, or e_phnum is its sentinel value, we need 990 * to read in the section header at index zero to acces the true 991 * values for those fields. 992 */ 993 if ((*nshdrs == 0 && ehdr->e_shoff != 0) || 994 *shstrndx == SHN_XINDEX || *nphdrs == PN_XNUM) { 995 Shdr shdr; 996 997 if (ehdr->e_shoff == 0) 998 return (EINVAL); 999 1000 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)&shdr, 1001 sizeof (shdr), (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, 1002 (rlim64_t)0, credp, &resid)) != 0) 1003 return (error); 1004 1005 if (*nshdrs == 0) 1006 *nshdrs = shdr.sh_size; 1007 if (*shstrndx == SHN_XINDEX) 1008 *shstrndx = shdr.sh_link; 1009 if (*nphdrs == PN_XNUM && shdr.sh_info != 0) 1010 *nphdrs = shdr.sh_info; 1011 } 1012 1013 return (0); 1014 } 1015 1016 #ifdef _ELF32_COMPAT 1017 extern size_t elf_nphdr_max; 1018 #else 1019 size_t elf_nphdr_max = 1000; 1020 #endif 1021 1022 static int 1023 getelfphdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, int nphdrs, 1024 caddr_t *phbasep, ssize_t *phsizep) 1025 { 1026 ssize_t resid, minsize; 1027 int err; 1028 1029 /* 1030 * Since we're going to be using e_phentsize to iterate down the 1031 * array of program headers, it must be 8-byte aligned or else 1032 * a we might cause a misaligned access. We use all members through 1033 * p_flags on 32-bit ELF files and p_memsz on 64-bit ELF files so 1034 * e_phentsize must be at least large enough to include those 1035 * members. 1036 */ 1037 #if !defined(_LP64) || defined(_ELF32_COMPAT) 1038 minsize = offsetof(Phdr, p_flags) + sizeof (((Phdr *)NULL)->p_flags); 1039 #else 1040 minsize = offsetof(Phdr, p_memsz) + sizeof (((Phdr *)NULL)->p_memsz); 1041 #endif 1042 if (ehdr->e_phentsize < minsize || (ehdr->e_phentsize & 3)) 1043 return (EINVAL); 1044 1045 *phsizep = nphdrs * ehdr->e_phentsize; 1046 1047 if (*phsizep > sizeof (Phdr) * elf_nphdr_max) { 1048 if ((*phbasep = kmem_alloc(*phsizep, KM_NOSLEEP)) == NULL) 1049 return (ENOMEM); 1050 } else { 1051 *phbasep = kmem_alloc(*phsizep, KM_SLEEP); 1052 } 1053 1054 if ((err = vn_rdwr(UIO_READ, vp, *phbasep, *phsizep, 1055 (offset_t)ehdr->e_phoff, UIO_SYSSPACE, 0, (rlim64_t)0, 1056 credp, &resid)) != 0) { 1057 kmem_free(*phbasep, *phsizep); 1058 *phbasep = NULL; 1059 return (err); 1060 } 1061 1062 return (0); 1063 } 1064 1065 #ifdef _ELF32_COMPAT 1066 extern size_t elf_nshdr_max; 1067 extern size_t elf_shstrtab_max; 1068 #else 1069 size_t elf_nshdr_max = 10000; 1070 size_t elf_shstrtab_max = 100 * 1024; 1071 #endif 1072 1073 1074 static int 1075 getelfshdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, 1076 int nshdrs, int shstrndx, caddr_t *shbasep, ssize_t *shsizep, 1077 char **shstrbasep, ssize_t *shstrsizep) 1078 { 1079 ssize_t resid, minsize; 1080 int err; 1081 Shdr *shdr; 1082 1083 /* 1084 * Since we're going to be using e_shentsize to iterate down the 1085 * array of section headers, it must be 8-byte aligned or else 1086 * a we might cause a misaligned access. We use all members through 1087 * sh_entsize (on both 32- and 64-bit ELF files) so e_shentsize 1088 * must be at least large enough to include that member. The index 1089 * of the string table section must also be valid. 1090 */ 1091 minsize = offsetof(Shdr, sh_entsize) + sizeof (shdr->sh_entsize); 1092 if (ehdr->e_shentsize < minsize || (ehdr->e_shentsize & 3) || 1093 shstrndx >= nshdrs) 1094 return (EINVAL); 1095 1096 *shsizep = nshdrs * ehdr->e_shentsize; 1097 1098 if (*shsizep > sizeof (Shdr) * elf_nshdr_max) { 1099 if ((*shbasep = kmem_alloc(*shsizep, KM_NOSLEEP)) == NULL) 1100 return (ENOMEM); 1101 } else { 1102 *shbasep = kmem_alloc(*shsizep, KM_SLEEP); 1103 } 1104 1105 if ((err = vn_rdwr(UIO_READ, vp, *shbasep, *shsizep, 1106 (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, (rlim64_t)0, 1107 credp, &resid)) != 0) { 1108 kmem_free(*shbasep, *shsizep); 1109 return (err); 1110 } 1111 1112 /* 1113 * Pull the section string table out of the vnode; fail if the size 1114 * is zero. 1115 */ 1116 shdr = (Shdr *)(*shbasep + shstrndx * ehdr->e_shentsize); 1117 if ((*shstrsizep = shdr->sh_size) == 0) { 1118 kmem_free(*shbasep, *shsizep); 1119 return (EINVAL); 1120 } 1121 1122 if (*shstrsizep > elf_shstrtab_max) { 1123 if ((*shstrbasep = kmem_alloc(*shstrsizep, 1124 KM_NOSLEEP)) == NULL) { 1125 kmem_free(*shbasep, *shsizep); 1126 return (ENOMEM); 1127 } 1128 } else { 1129 *shstrbasep = kmem_alloc(*shstrsizep, KM_SLEEP); 1130 } 1131 1132 if ((err = vn_rdwr(UIO_READ, vp, *shstrbasep, *shstrsizep, 1133 (offset_t)shdr->sh_offset, UIO_SYSSPACE, 0, (rlim64_t)0, 1134 credp, &resid)) != 0) { 1135 kmem_free(*shbasep, *shsizep); 1136 kmem_free(*shstrbasep, *shstrsizep); 1137 return (err); 1138 } 1139 1140 /* 1141 * Make sure the strtab is null-terminated to make sure we 1142 * don't run off the end of the table. 1143 */ 1144 (*shstrbasep)[*shstrsizep - 1] = '\0'; 1145 1146 return (0); 1147 } 1148 1149 static int 1150 mapelfexec( 1151 vnode_t *vp, 1152 Ehdr *ehdr, 1153 int nphdrs, 1154 caddr_t phdrbase, 1155 Phdr **uphdr, 1156 Phdr **dyphdr, 1157 Phdr **stphdr, 1158 Phdr **dtphdr, 1159 Phdr *dataphdrp, 1160 caddr_t *bssbase, 1161 caddr_t *brkbase, 1162 intptr_t *voffset, 1163 intptr_t *minaddr, 1164 size_t len, 1165 long *execsz, 1166 size_t *brksize) 1167 { 1168 Phdr *phdr; 1169 int i, prot, error; 1170 caddr_t addr = NULL; 1171 size_t zfodsz; 1172 int ptload = 0; 1173 int page; 1174 off_t offset; 1175 int hsize = ehdr->e_phentsize; 1176 caddr_t mintmp = (caddr_t)-1; 1177 extern int use_brk_lpg; 1178 1179 if (ehdr->e_type == ET_DYN) { 1180 /* 1181 * Obtain the virtual address of a hole in the 1182 * address space to map the "interpreter". 1183 */ 1184 map_addr(&addr, len, (offset_t)0, 1, 0); 1185 if (addr == NULL) 1186 return (ENOMEM); 1187 *voffset = (intptr_t)addr; 1188 1189 /* 1190 * Calculate the minimum vaddr so it can be subtracted out. 1191 * According to the ELF specification, since PT_LOAD sections 1192 * must be sorted by increasing p_vaddr values, this is 1193 * guaranteed to be the first PT_LOAD section. 1194 */ 1195 phdr = (Phdr *)phdrbase; 1196 for (i = nphdrs; i > 0; i--) { 1197 if (phdr->p_type == PT_LOAD) { 1198 *voffset -= (uintptr_t)phdr->p_vaddr; 1199 break; 1200 } 1201 phdr = (Phdr *)((caddr_t)phdr + hsize); 1202 } 1203 1204 } else { 1205 *voffset = 0; 1206 } 1207 phdr = (Phdr *)phdrbase; 1208 for (i = nphdrs; i > 0; i--) { 1209 switch (phdr->p_type) { 1210 case PT_LOAD: 1211 if ((*dyphdr != NULL) && (*uphdr == NULL)) 1212 return (0); 1213 1214 ptload = 1; 1215 prot = PROT_USER; 1216 if (phdr->p_flags & PF_R) 1217 prot |= PROT_READ; 1218 if (phdr->p_flags & PF_W) 1219 prot |= PROT_WRITE; 1220 if (phdr->p_flags & PF_X) 1221 prot |= PROT_EXEC; 1222 1223 addr = (caddr_t)((uintptr_t)phdr->p_vaddr + *voffset); 1224 1225 /* 1226 * Keep track of the segment with the lowest starting 1227 * address. 1228 */ 1229 if (addr < mintmp) 1230 mintmp = addr; 1231 1232 zfodsz = (size_t)phdr->p_memsz - phdr->p_filesz; 1233 1234 offset = phdr->p_offset; 1235 if (((uintptr_t)offset & PAGEOFFSET) == 1236 ((uintptr_t)addr & PAGEOFFSET) && 1237 (!(vp->v_flag & VNOMAP))) { 1238 page = 1; 1239 } else { 1240 page = 0; 1241 } 1242 1243 /* 1244 * Set the heap pagesize for OOB when the bss size 1245 * is known and use_brk_lpg is not 0. 1246 */ 1247 if (brksize != NULL && use_brk_lpg && 1248 zfodsz != 0 && phdr == dataphdrp && 1249 (prot & PROT_WRITE)) { 1250 size_t tlen = P2NPHASE((uintptr_t)addr + 1251 phdr->p_filesz, PAGESIZE); 1252 1253 if (zfodsz > tlen) { 1254 curproc->p_brkpageszc = 1255 page_szc(map_pgsz(MAPPGSZ_HEAP, 1256 curproc, addr + phdr->p_filesz + 1257 tlen, zfodsz - tlen, 0)); 1258 } 1259 } 1260 1261 if (curproc->p_brkpageszc != 0 && phdr == dataphdrp && 1262 (prot & PROT_WRITE)) { 1263 uint_t szc = curproc->p_brkpageszc; 1264 size_t pgsz = page_get_pagesize(szc); 1265 caddr_t ebss = addr + phdr->p_memsz; 1266 size_t extra_zfodsz; 1267 1268 ASSERT(pgsz > PAGESIZE); 1269 1270 extra_zfodsz = P2NPHASE((uintptr_t)ebss, pgsz); 1271 1272 if (error = execmap(vp, addr, phdr->p_filesz, 1273 zfodsz + extra_zfodsz, phdr->p_offset, 1274 prot, page, szc)) 1275 goto bad; 1276 if (brksize != NULL) 1277 *brksize = extra_zfodsz; 1278 } else { 1279 if (error = execmap(vp, addr, phdr->p_filesz, 1280 zfodsz, phdr->p_offset, prot, page, 0)) 1281 goto bad; 1282 } 1283 1284 if (bssbase != NULL && addr >= *bssbase && 1285 phdr == dataphdrp) { 1286 *bssbase = addr + phdr->p_filesz; 1287 } 1288 if (brkbase != NULL && addr >= *brkbase) { 1289 *brkbase = addr + phdr->p_memsz; 1290 } 1291 1292 *execsz += btopr(phdr->p_memsz); 1293 break; 1294 1295 case PT_INTERP: 1296 if (ptload) 1297 goto bad; 1298 *dyphdr = phdr; 1299 break; 1300 1301 case PT_SHLIB: 1302 *stphdr = phdr; 1303 break; 1304 1305 case PT_PHDR: 1306 if (ptload) 1307 goto bad; 1308 *uphdr = phdr; 1309 break; 1310 1311 case PT_NULL: 1312 case PT_DYNAMIC: 1313 case PT_NOTE: 1314 break; 1315 1316 case PT_SUNWDTRACE: 1317 if (dtphdr != NULL) 1318 *dtphdr = phdr; 1319 break; 1320 1321 default: 1322 break; 1323 } 1324 phdr = (Phdr *)((caddr_t)phdr + hsize); 1325 } 1326 1327 if (minaddr != NULL) { 1328 ASSERT(mintmp != (caddr_t)-1); 1329 *minaddr = (intptr_t)mintmp; 1330 } 1331 1332 return (0); 1333 bad: 1334 if (error == 0) 1335 error = EINVAL; 1336 return (error); 1337 } 1338 1339 int 1340 elfnote(vnode_t *vp, offset_t *offsetp, int type, int descsz, void *desc, 1341 rlim64_t rlimit, cred_t *credp) 1342 { 1343 Note note; 1344 int error; 1345 1346 bzero(¬e, sizeof (note)); 1347 bcopy("CORE", note.name, 4); 1348 note.nhdr.n_type = type; 1349 /* 1350 * The System V ABI states that n_namesz must be the length of the 1351 * string that follows the Nhdr structure including the terminating 1352 * null. The ABI also specifies that sufficient padding should be 1353 * included so that the description that follows the name string 1354 * begins on a 4- or 8-byte boundary for 32- and 64-bit binaries 1355 * respectively. However, since this change was not made correctly 1356 * at the time of the 64-bit port, both 32- and 64-bit binaries 1357 * descriptions are only guaranteed to begin on a 4-byte boundary. 1358 */ 1359 note.nhdr.n_namesz = 5; 1360 note.nhdr.n_descsz = roundup(descsz, sizeof (Word)); 1361 1362 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, ¬e, 1363 sizeof (note), rlimit, credp)) 1364 return (error); 1365 1366 *offsetp += sizeof (note); 1367 1368 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, desc, 1369 note.nhdr.n_descsz, rlimit, credp)) 1370 return (error); 1371 1372 *offsetp += note.nhdr.n_descsz; 1373 return (0); 1374 } 1375 1376 /* 1377 * Copy the section data from one vnode to the section of another vnode. 1378 */ 1379 static void 1380 copy_scn(Shdr *src, vnode_t *src_vp, Shdr *dst, vnode_t *dst_vp, Off *doffset, 1381 void *buf, size_t size, cred_t *credp, rlim64_t rlimit) 1382 { 1383 ssize_t resid; 1384 size_t len, n = src->sh_size; 1385 offset_t off = 0; 1386 1387 while (n != 0) { 1388 len = MIN(size, n); 1389 if (vn_rdwr(UIO_READ, src_vp, buf, len, src->sh_offset + off, 1390 UIO_SYSSPACE, 0, (rlim64_t)0, credp, &resid) != 0 || 1391 resid >= len || 1392 core_write(dst_vp, UIO_SYSSPACE, *doffset + off, 1393 buf, len - resid, rlimit, credp) != 0) { 1394 dst->sh_size = 0; 1395 dst->sh_offset = 0; 1396 return; 1397 } 1398 1399 ASSERT(n >= len - resid); 1400 1401 n -= len - resid; 1402 off += len - resid; 1403 } 1404 1405 *doffset += src->sh_size; 1406 } 1407 1408 #ifdef _ELF32_COMPAT 1409 extern size_t elf_datasz_max; 1410 #else 1411 size_t elf_datasz_max = 1 * 1024 * 1024; 1412 #endif 1413 1414 /* 1415 * This function processes mappings that correspond to load objects to 1416 * examine their respective sections for elfcore(). It's called once with 1417 * v set to NULL to count the number of sections that we're going to need 1418 * and then again with v set to some allocated buffer that we fill in with 1419 * all the section data. 1420 */ 1421 static int 1422 process_scns(core_content_t content, proc_t *p, cred_t *credp, vnode_t *vp, 1423 Shdr *v, int nv, rlim64_t rlimit, Off *doffsetp, int *nshdrsp) 1424 { 1425 vnode_t *lastvp = NULL; 1426 struct seg *seg; 1427 int i, j; 1428 void *data = NULL; 1429 size_t datasz = 0; 1430 shstrtab_t shstrtab; 1431 struct as *as = p->p_as; 1432 int error = 0; 1433 1434 if (v != NULL) 1435 shstrtab_init(&shstrtab); 1436 1437 i = 1; 1438 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) { 1439 uint_t prot; 1440 vnode_t *mvp; 1441 void *tmp = NULL; 1442 caddr_t saddr = seg->s_base; 1443 caddr_t naddr; 1444 caddr_t eaddr; 1445 size_t segsize; 1446 1447 Ehdr ehdr; 1448 int nshdrs, shstrndx, nphdrs; 1449 caddr_t shbase; 1450 ssize_t shsize; 1451 char *shstrbase; 1452 ssize_t shstrsize; 1453 1454 Shdr *shdr; 1455 const char *name; 1456 size_t sz; 1457 uintptr_t off; 1458 1459 int ctf_ndx = 0; 1460 int symtab_ndx = 0; 1461 1462 /* 1463 * Since we're just looking for text segments of load 1464 * objects, we only care about the protection bits; we don't 1465 * care about the actual size of the segment so we use the 1466 * reserved size. If the segment's size is zero, there's 1467 * something fishy going on so we ignore this segment. 1468 */ 1469 if (seg->s_ops != &segvn_ops || 1470 SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 || 1471 mvp == lastvp || mvp == NULL || mvp->v_type != VREG || 1472 (segsize = pr_getsegsize(seg, 1)) == 0) 1473 continue; 1474 1475 eaddr = saddr + segsize; 1476 prot = pr_getprot(seg, 1, &tmp, &saddr, &naddr, eaddr); 1477 pr_getprot_done(&tmp); 1478 1479 /* 1480 * Skip this segment unless the protection bits look like 1481 * what we'd expect for a text segment. 1482 */ 1483 if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC) 1484 continue; 1485 1486 if (getelfhead(mvp, credp, &ehdr, &nshdrs, &shstrndx, 1487 &nphdrs) != 0 || 1488 getelfshdr(mvp, credp, &ehdr, nshdrs, shstrndx, 1489 &shbase, &shsize, &shstrbase, &shstrsize) != 0) 1490 continue; 1491 1492 off = ehdr.e_shentsize; 1493 for (j = 1; j < nshdrs; j++, off += ehdr.e_shentsize) { 1494 Shdr *symtab = NULL, *strtab; 1495 1496 shdr = (Shdr *)(shbase + off); 1497 1498 if (shdr->sh_name >= shstrsize) 1499 continue; 1500 1501 name = shstrbase + shdr->sh_name; 1502 1503 if (strcmp(name, shstrtab_data[STR_CTF]) == 0) { 1504 if ((content & CC_CONTENT_CTF) == 0 || 1505 ctf_ndx != 0) 1506 continue; 1507 1508 if (shdr->sh_link > 0 && 1509 shdr->sh_link < nshdrs) { 1510 symtab = (Shdr *)(shbase + 1511 shdr->sh_link * ehdr.e_shentsize); 1512 } 1513 1514 if (v != NULL && i < nv - 1) { 1515 if (shdr->sh_size > datasz && 1516 shdr->sh_size <= elf_datasz_max) { 1517 if (data != NULL) 1518 kmem_free(data, datasz); 1519 1520 datasz = shdr->sh_size; 1521 data = kmem_alloc(datasz, 1522 KM_SLEEP); 1523 } 1524 1525 v[i].sh_name = shstrtab_ndx(&shstrtab, 1526 STR_CTF); 1527 v[i].sh_addr = (Addr)(uintptr_t)saddr; 1528 v[i].sh_type = SHT_PROGBITS; 1529 v[i].sh_addralign = 4; 1530 *doffsetp = roundup(*doffsetp, 1531 v[i].sh_addralign); 1532 v[i].sh_offset = *doffsetp; 1533 v[i].sh_size = shdr->sh_size; 1534 if (symtab == NULL) { 1535 v[i].sh_link = 0; 1536 } else if (symtab->sh_type == 1537 SHT_SYMTAB && 1538 symtab_ndx != 0) { 1539 v[i].sh_link = 1540 symtab_ndx; 1541 } else { 1542 v[i].sh_link = i + 1; 1543 } 1544 1545 copy_scn(shdr, mvp, &v[i], vp, 1546 doffsetp, data, datasz, credp, 1547 rlimit); 1548 } 1549 1550 ctf_ndx = i++; 1551 1552 /* 1553 * We've already dumped the symtab. 1554 */ 1555 if (symtab != NULL && 1556 symtab->sh_type == SHT_SYMTAB && 1557 symtab_ndx != 0) 1558 continue; 1559 1560 } else if (strcmp(name, 1561 shstrtab_data[STR_SYMTAB]) == 0) { 1562 if ((content & CC_CONTENT_SYMTAB) == 0 || 1563 symtab != 0) 1564 continue; 1565 1566 symtab = shdr; 1567 } 1568 1569 if (symtab != NULL) { 1570 if ((symtab->sh_type != SHT_DYNSYM && 1571 symtab->sh_type != SHT_SYMTAB) || 1572 symtab->sh_link == 0 || 1573 symtab->sh_link >= nshdrs) 1574 continue; 1575 1576 strtab = (Shdr *)(shbase + 1577 symtab->sh_link * ehdr.e_shentsize); 1578 1579 if (strtab->sh_type != SHT_STRTAB) 1580 continue; 1581 1582 if (v != NULL && i < nv - 2) { 1583 sz = MAX(symtab->sh_size, 1584 strtab->sh_size); 1585 if (sz > datasz && 1586 sz <= elf_datasz_max) { 1587 if (data != NULL) 1588 kmem_free(data, datasz); 1589 1590 datasz = sz; 1591 data = kmem_alloc(datasz, 1592 KM_SLEEP); 1593 } 1594 1595 if (symtab->sh_type == SHT_DYNSYM) { 1596 v[i].sh_name = shstrtab_ndx( 1597 &shstrtab, STR_DYNSYM); 1598 v[i + 1].sh_name = shstrtab_ndx( 1599 &shstrtab, STR_DYNSTR); 1600 } else { 1601 v[i].sh_name = shstrtab_ndx( 1602 &shstrtab, STR_SYMTAB); 1603 v[i + 1].sh_name = shstrtab_ndx( 1604 &shstrtab, STR_STRTAB); 1605 } 1606 1607 v[i].sh_type = symtab->sh_type; 1608 v[i].sh_addr = symtab->sh_addr; 1609 if (ehdr.e_type == ET_DYN || 1610 v[i].sh_addr == 0) 1611 v[i].sh_addr += 1612 (Addr)(uintptr_t)saddr; 1613 v[i].sh_addralign = 1614 symtab->sh_addralign; 1615 *doffsetp = roundup(*doffsetp, 1616 v[i].sh_addralign); 1617 v[i].sh_offset = *doffsetp; 1618 v[i].sh_size = symtab->sh_size; 1619 v[i].sh_link = i + 1; 1620 v[i].sh_entsize = symtab->sh_entsize; 1621 v[i].sh_info = symtab->sh_info; 1622 1623 copy_scn(symtab, mvp, &v[i], vp, 1624 doffsetp, data, datasz, credp, 1625 rlimit); 1626 1627 v[i + 1].sh_type = SHT_STRTAB; 1628 v[i + 1].sh_flags = SHF_STRINGS; 1629 v[i + 1].sh_addr = symtab->sh_addr; 1630 if (ehdr.e_type == ET_DYN || 1631 v[i + 1].sh_addr == 0) 1632 v[i + 1].sh_addr += 1633 (Addr)(uintptr_t)saddr; 1634 v[i + 1].sh_addralign = 1635 strtab->sh_addralign; 1636 *doffsetp = roundup(*doffsetp, 1637 v[i + 1].sh_addralign); 1638 v[i + 1].sh_offset = *doffsetp; 1639 v[i + 1].sh_size = strtab->sh_size; 1640 1641 copy_scn(strtab, mvp, &v[i + 1], vp, 1642 doffsetp, data, datasz, credp, 1643 rlimit); 1644 } 1645 1646 if (symtab->sh_type == SHT_SYMTAB) 1647 symtab_ndx = i; 1648 i += 2; 1649 } 1650 } 1651 1652 kmem_free(shstrbase, shstrsize); 1653 kmem_free(shbase, shsize); 1654 1655 lastvp = mvp; 1656 } 1657 1658 if (v == NULL) { 1659 if (i == 1) 1660 *nshdrsp = 0; 1661 else 1662 *nshdrsp = i + 1; 1663 goto done; 1664 } 1665 1666 if (i != nv - 1) { 1667 cmn_err(CE_WARN, "elfcore: core dump failed for " 1668 "process %d; address space is changing", p->p_pid); 1669 error = EIO; 1670 goto done; 1671 } 1672 1673 v[i].sh_name = shstrtab_ndx(&shstrtab, STR_SHSTRTAB); 1674 v[i].sh_size = shstrtab_size(&shstrtab); 1675 v[i].sh_addralign = 1; 1676 *doffsetp = roundup(*doffsetp, v[i].sh_addralign); 1677 v[i].sh_offset = *doffsetp; 1678 v[i].sh_flags = SHF_STRINGS; 1679 v[i].sh_type = SHT_STRTAB; 1680 1681 if (v[i].sh_size > datasz) { 1682 if (data != NULL) 1683 kmem_free(data, datasz); 1684 1685 datasz = v[i].sh_size; 1686 data = kmem_alloc(datasz, 1687 KM_SLEEP); 1688 } 1689 1690 shstrtab_dump(&shstrtab, data); 1691 1692 if ((error = core_write(vp, UIO_SYSSPACE, *doffsetp, 1693 data, v[i].sh_size, rlimit, credp)) != 0) 1694 goto done; 1695 1696 *doffsetp += v[i].sh_size; 1697 1698 done: 1699 if (data != NULL) 1700 kmem_free(data, datasz); 1701 1702 return (error); 1703 } 1704 1705 int 1706 elfcore(vnode_t *vp, proc_t *p, cred_t *credp, rlim64_t rlimit, int sig, 1707 core_content_t content) 1708 { 1709 offset_t poffset, soffset; 1710 Off doffset; 1711 int error, i, nphdrs, nshdrs; 1712 int overflow = 0; 1713 struct seg *seg; 1714 struct as *as = p->p_as; 1715 union { 1716 Ehdr ehdr; 1717 Phdr phdr[1]; 1718 Shdr shdr[1]; 1719 } *bigwad; 1720 size_t bigsize; 1721 size_t phdrsz, shdrsz; 1722 Ehdr *ehdr; 1723 Phdr *v; 1724 caddr_t brkbase; 1725 size_t brksize; 1726 caddr_t stkbase; 1727 size_t stksize; 1728 int ntries = 0; 1729 1730 top: 1731 /* 1732 * Make sure we have everything we need (registers, etc.). 1733 * All other lwps have already stopped and are in an orderly state. 1734 */ 1735 ASSERT(p == ttoproc(curthread)); 1736 prstop(0, 0); 1737 1738 AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER); 1739 nphdrs = prnsegs(as, 0) + 2; /* two CORE note sections */ 1740 1741 /* 1742 * Count the number of section headers we're going to need. 1743 */ 1744 nshdrs = 0; 1745 if (content & (CC_CONTENT_CTF | CC_CONTENT_SYMTAB)) { 1746 (void) process_scns(content, p, credp, NULL, NULL, NULL, 0, 1747 NULL, &nshdrs); 1748 } 1749 AS_LOCK_EXIT(as, &as->a_lock); 1750 1751 ASSERT(nshdrs == 0 || nshdrs > 1); 1752 1753 /* 1754 * The core file contents may required zero section headers, but if 1755 * we overflow the 16 bits allotted to the program header count in 1756 * the ELF header, we'll need that program header at index zero. 1757 */ 1758 if (nshdrs == 0 && nphdrs >= PN_XNUM) 1759 nshdrs = 1; 1760 1761 phdrsz = nphdrs * sizeof (Phdr); 1762 shdrsz = nshdrs * sizeof (Shdr); 1763 1764 bigsize = MAX(sizeof (*bigwad), MAX(phdrsz, shdrsz)); 1765 bigwad = kmem_alloc(bigsize, KM_SLEEP); 1766 1767 ehdr = &bigwad->ehdr; 1768 bzero(ehdr, sizeof (*ehdr)); 1769 1770 ehdr->e_ident[EI_MAG0] = ELFMAG0; 1771 ehdr->e_ident[EI_MAG1] = ELFMAG1; 1772 ehdr->e_ident[EI_MAG2] = ELFMAG2; 1773 ehdr->e_ident[EI_MAG3] = ELFMAG3; 1774 ehdr->e_ident[EI_CLASS] = ELFCLASS; 1775 ehdr->e_type = ET_CORE; 1776 1777 #if !defined(_LP64) || defined(_ELF32_COMPAT) 1778 1779 #if defined(__sparc) 1780 ehdr->e_ident[EI_DATA] = ELFDATA2MSB; 1781 ehdr->e_machine = EM_SPARC; 1782 #elif defined(__i386) || defined(__i386_COMPAT) 1783 ehdr->e_ident[EI_DATA] = ELFDATA2LSB; 1784 ehdr->e_machine = EM_386; 1785 #else 1786 #error "no recognized machine type is defined" 1787 #endif 1788 1789 #else /* !defined(_LP64) || defined(_ELF32_COMPAT) */ 1790 1791 #if defined(__sparc) 1792 ehdr->e_ident[EI_DATA] = ELFDATA2MSB; 1793 ehdr->e_machine = EM_SPARCV9; 1794 #elif defined(__amd64) 1795 ehdr->e_ident[EI_DATA] = ELFDATA2LSB; 1796 ehdr->e_machine = EM_AMD64; 1797 #else 1798 #error "no recognized 64-bit machine type is defined" 1799 #endif 1800 1801 #endif /* !defined(_LP64) || defined(_ELF32_COMPAT) */ 1802 1803 /* 1804 * If the count of program headers or section headers or the index 1805 * of the section string table can't fit in the mere 16 bits 1806 * shortsightedly allotted to them in the ELF header, we use the 1807 * extended formats and put the real values in the section header 1808 * as index 0. 1809 */ 1810 ehdr->e_version = EV_CURRENT; 1811 ehdr->e_ehsize = sizeof (Ehdr); 1812 1813 if (nphdrs >= PN_XNUM) 1814 ehdr->e_phnum = PN_XNUM; 1815 else 1816 ehdr->e_phnum = (unsigned short)nphdrs; 1817 1818 ehdr->e_phoff = sizeof (Ehdr); 1819 ehdr->e_phentsize = sizeof (Phdr); 1820 1821 if (nshdrs > 0) { 1822 if (nshdrs >= SHN_LORESERVE) 1823 ehdr->e_shnum = 0; 1824 else 1825 ehdr->e_shnum = (unsigned short)nshdrs; 1826 1827 if (nshdrs - 1 >= SHN_LORESERVE) 1828 ehdr->e_shstrndx = SHN_XINDEX; 1829 else 1830 ehdr->e_shstrndx = (unsigned short)(nshdrs - 1); 1831 1832 ehdr->e_shoff = ehdr->e_phoff + ehdr->e_phentsize * nphdrs; 1833 ehdr->e_shentsize = sizeof (Shdr); 1834 } 1835 1836 if (error = core_write(vp, UIO_SYSSPACE, (offset_t)0, ehdr, 1837 sizeof (Ehdr), rlimit, credp)) 1838 goto done; 1839 1840 poffset = sizeof (Ehdr); 1841 soffset = sizeof (Ehdr) + phdrsz; 1842 doffset = sizeof (Ehdr) + phdrsz + shdrsz; 1843 1844 v = &bigwad->phdr[0]; 1845 bzero(v, phdrsz); 1846 1847 setup_old_note_header(&v[0], p); 1848 v[0].p_offset = doffset = roundup(doffset, sizeof (Word)); 1849 doffset += v[0].p_filesz; 1850 1851 setup_note_header(&v[1], p); 1852 v[1].p_offset = doffset = roundup(doffset, sizeof (Word)); 1853 doffset += v[1].p_filesz; 1854 1855 mutex_enter(&p->p_lock); 1856 1857 brkbase = p->p_brkbase; 1858 brksize = p->p_brksize; 1859 1860 stkbase = p->p_usrstack - p->p_stksize; 1861 stksize = p->p_stksize; 1862 1863 mutex_exit(&p->p_lock); 1864 1865 AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER); 1866 i = 2; 1867 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) { 1868 caddr_t eaddr = seg->s_base + pr_getsegsize(seg, 0); 1869 caddr_t saddr, naddr; 1870 void *tmp = NULL; 1871 extern struct seg_ops segspt_shmops; 1872 1873 for (saddr = seg->s_base; saddr < eaddr; saddr = naddr) { 1874 uint_t prot; 1875 size_t size; 1876 int type; 1877 vnode_t *mvp; 1878 1879 prot = pr_getprot(seg, 0, &tmp, &saddr, &naddr, eaddr); 1880 prot &= PROT_READ | PROT_WRITE | PROT_EXEC; 1881 if ((size = (size_t)(naddr - saddr)) == 0) 1882 continue; 1883 if (i == nphdrs) { 1884 overflow++; 1885 continue; 1886 } 1887 v[i].p_type = PT_LOAD; 1888 v[i].p_vaddr = (Addr)(uintptr_t)saddr; 1889 v[i].p_memsz = size; 1890 if (prot & PROT_READ) 1891 v[i].p_flags |= PF_R; 1892 if (prot & PROT_WRITE) 1893 v[i].p_flags |= PF_W; 1894 if (prot & PROT_EXEC) 1895 v[i].p_flags |= PF_X; 1896 1897 /* 1898 * Figure out which mappings to include in the core. 1899 */ 1900 type = SEGOP_GETTYPE(seg, saddr); 1901 1902 if (saddr == stkbase && size == stksize) { 1903 if (!(content & CC_CONTENT_STACK)) 1904 goto exclude; 1905 1906 } else if (saddr == brkbase && size == brksize) { 1907 if (!(content & CC_CONTENT_HEAP)) 1908 goto exclude; 1909 1910 } else if (seg->s_ops == &segspt_shmops) { 1911 if (type & MAP_NORESERVE) { 1912 if (!(content & CC_CONTENT_DISM)) 1913 goto exclude; 1914 } else { 1915 if (!(content & CC_CONTENT_ISM)) 1916 goto exclude; 1917 } 1918 1919 } else if (seg->s_ops != &segvn_ops) { 1920 goto exclude; 1921 1922 } else if (type & MAP_SHARED) { 1923 if (shmgetid(p, saddr) != SHMID_NONE) { 1924 if (!(content & CC_CONTENT_SHM)) 1925 goto exclude; 1926 1927 } else if (SEGOP_GETVP(seg, seg->s_base, 1928 &mvp) != 0 || mvp == NULL || 1929 mvp->v_type != VREG) { 1930 if (!(content & CC_CONTENT_SHANON)) 1931 goto exclude; 1932 1933 } else { 1934 if (!(content & CC_CONTENT_SHFILE)) 1935 goto exclude; 1936 } 1937 1938 } else if (SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 || 1939 mvp == NULL || mvp->v_type != VREG) { 1940 if (!(content & CC_CONTENT_ANON)) 1941 goto exclude; 1942 1943 } else if (prot == (PROT_READ | PROT_EXEC)) { 1944 if (!(content & CC_CONTENT_TEXT)) 1945 goto exclude; 1946 1947 } else if (prot == PROT_READ) { 1948 if (!(content & CC_CONTENT_RODATA)) 1949 goto exclude; 1950 1951 } else { 1952 if (!(content & CC_CONTENT_DATA)) 1953 goto exclude; 1954 } 1955 1956 doffset = roundup(doffset, sizeof (Word)); 1957 v[i].p_offset = doffset; 1958 v[i].p_filesz = size; 1959 doffset += size; 1960 exclude: 1961 i++; 1962 } 1963 ASSERT(tmp == NULL); 1964 } 1965 AS_LOCK_EXIT(as, &as->a_lock); 1966 1967 if (overflow || i != nphdrs) { 1968 if (ntries++ == 0) { 1969 kmem_free(bigwad, bigsize); 1970 overflow = 0; 1971 goto top; 1972 } 1973 cmn_err(CE_WARN, "elfcore: core dump failed for " 1974 "process %d; address space is changing", p->p_pid); 1975 error = EIO; 1976 goto done; 1977 } 1978 1979 if ((error = core_write(vp, UIO_SYSSPACE, poffset, 1980 v, phdrsz, rlimit, credp)) != 0) 1981 goto done; 1982 1983 if ((error = write_old_elfnotes(p, sig, vp, v[0].p_offset, rlimit, 1984 credp)) != 0) 1985 goto done; 1986 1987 if ((error = write_elfnotes(p, sig, vp, v[1].p_offset, rlimit, 1988 credp, content)) != 0) 1989 goto done; 1990 1991 for (i = 2; i < nphdrs; i++) { 1992 if (v[i].p_filesz == 0) 1993 continue; 1994 1995 /* 1996 * If dumping out this segment fails, rather than failing 1997 * the core dump entirely, we reset the size of the mapping 1998 * to zero to indicate that the data is absent from the core 1999 * file and or in the PF_SUNW_FAILURE flag to differentiate 2000 * this from mappings that were excluded due to the core file 2001 * content settings. 2002 */ 2003 if ((error = core_seg(p, vp, v[i].p_offset, 2004 (caddr_t)(uintptr_t)v[i].p_vaddr, v[i].p_filesz, 2005 rlimit, credp)) != 0) { 2006 2007 /* 2008 * Since the space reserved for the segment is now 2009 * unused, we stash the errno in the first four 2010 * bytes. This undocumented interface will let us 2011 * understand the nature of the failure. 2012 */ 2013 (void) core_write(vp, UIO_SYSSPACE, v[i].p_offset, 2014 &error, sizeof (error), rlimit, credp); 2015 2016 v[i].p_filesz = 0; 2017 v[i].p_flags |= PF_SUNW_FAILURE; 2018 if ((error = core_write(vp, UIO_SYSSPACE, 2019 poffset + sizeof (v[i]) * i, &v[i], sizeof (v[i]), 2020 rlimit, credp)) != 0) 2021 goto done; 2022 } 2023 } 2024 2025 if (nshdrs > 0) { 2026 bzero(&bigwad->shdr[0], shdrsz); 2027 2028 if (nshdrs >= SHN_LORESERVE) 2029 bigwad->shdr[0].sh_size = nshdrs; 2030 2031 if (nshdrs - 1 >= SHN_LORESERVE) 2032 bigwad->shdr[0].sh_link = nshdrs - 1; 2033 2034 if (nphdrs >= PN_XNUM) 2035 bigwad->shdr[0].sh_info = nphdrs; 2036 2037 if (nshdrs > 1) { 2038 AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER); 2039 if ((error = process_scns(content, p, credp, vp, 2040 &bigwad->shdr[0], nshdrs, rlimit, &doffset, 2041 NULL)) != 0) { 2042 AS_LOCK_EXIT(as, &as->a_lock); 2043 goto done; 2044 } 2045 AS_LOCK_EXIT(as, &as->a_lock); 2046 } 2047 2048 if ((error = core_write(vp, UIO_SYSSPACE, soffset, 2049 &bigwad->shdr[0], shdrsz, rlimit, credp)) != 0) 2050 goto done; 2051 } 2052 2053 done: 2054 kmem_free(bigwad, bigsize); 2055 return (error); 2056 } 2057 2058 #ifndef _ELF32_COMPAT 2059 2060 static struct execsw esw = { 2061 #ifdef _LP64 2062 elf64magicstr, 2063 #else /* _LP64 */ 2064 elf32magicstr, 2065 #endif /* _LP64 */ 2066 0, 2067 5, 2068 elfexec, 2069 elfcore 2070 }; 2071 2072 static struct modlexec modlexec = { 2073 &mod_execops, "exec module for elf", &esw 2074 }; 2075 2076 #ifdef _LP64 2077 extern int elf32exec(vnode_t *vp, execa_t *uap, uarg_t *args, 2078 intpdata_t *idatap, int level, long *execsz, 2079 int setid, caddr_t exec_file, cred_t *cred, 2080 int brand_action); 2081 extern int elf32core(vnode_t *vp, proc_t *p, cred_t *credp, 2082 rlim64_t rlimit, int sig, core_content_t content); 2083 2084 static struct execsw esw32 = { 2085 elf32magicstr, 2086 0, 2087 5, 2088 elf32exec, 2089 elf32core 2090 }; 2091 2092 static struct modlexec modlexec32 = { 2093 &mod_execops, "32-bit exec module for elf", &esw32 2094 }; 2095 #endif /* _LP64 */ 2096 2097 static struct modlinkage modlinkage = { 2098 MODREV_1, 2099 (void *)&modlexec, 2100 #ifdef _LP64 2101 (void *)&modlexec32, 2102 #endif /* _LP64 */ 2103 NULL 2104 }; 2105 2106 int 2107 _init(void) 2108 { 2109 return (mod_install(&modlinkage)); 2110 } 2111 2112 int 2113 _fini(void) 2114 { 2115 return (mod_remove(&modlinkage)); 2116 } 2117 2118 int 2119 _info(struct modinfo *modinfop) 2120 { 2121 return (mod_info(&modlinkage, modinfop)); 2122 } 2123 2124 #endif /* !_ELF32_COMPAT */ 2125