1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License, Version 1.0 only 6 * (the "License"). You may not use this file except in compliance 7 * with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 /* Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */ 28 /* All Rights Reserved */ 29 30 31 #pragma ident "%Z%%M% %I% %E% SMI" 32 33 #include <sys/types.h> 34 #include <sys/param.h> 35 #include <sys/thread.h> 36 #include <sys/sysmacros.h> 37 #include <sys/signal.h> 38 #include <sys/cred.h> 39 #include <sys/user.h> 40 #include <sys/errno.h> 41 #include <sys/vnode.h> 42 #include <sys/mman.h> 43 #include <sys/kmem.h> 44 #include <sys/proc.h> 45 #include <sys/pathname.h> 46 #include <sys/cmn_err.h> 47 #include <sys/systm.h> 48 #include <sys/elf.h> 49 #include <sys/vmsystm.h> 50 #include <sys/debug.h> 51 #include <sys/auxv.h> 52 #include <sys/exec.h> 53 #include <sys/prsystm.h> 54 #include <vm/as.h> 55 #include <vm/rm.h> 56 #include <vm/seg.h> 57 #include <vm/seg_vn.h> 58 #include <sys/modctl.h> 59 #include <sys/systeminfo.h> 60 #include <sys/vmparam.h> 61 #include <sys/machelf.h> 62 #include <sys/shm_impl.h> 63 #include <sys/archsystm.h> 64 #include <sys/fasttrap.h> 65 #include "elf_impl.h" 66 67 extern int at_flags; 68 69 #define ORIGIN_STR "ORIGIN" 70 #define ORIGIN_STR_SIZE 6 71 72 static int getelfhead(vnode_t *, cred_t *, Ehdr *); 73 static int getelfphdr(vnode_t *, cred_t *, const Ehdr *, caddr_t *, ssize_t *); 74 static int getelfshdr(vnode_t *, cred_t *, const Ehdr *, caddr_t *, ssize_t *, 75 caddr_t *, ssize_t *); 76 static size_t elfsize(Ehdr *, caddr_t, uintptr_t *); 77 static int mapelfexec(vnode_t *, Ehdr *, caddr_t, 78 Phdr **, Phdr **, Phdr **, Phdr **, Phdr *, 79 caddr_t *, caddr_t *, intptr_t *, size_t, long *, size_t *); 80 81 typedef enum { 82 STR_CTF, 83 STR_SYMTAB, 84 STR_DYNSYM, 85 STR_STRTAB, 86 STR_DYNSTR, 87 STR_SHSTRTAB, 88 STR_NUM 89 } shstrtype_t; 90 91 static const char *shstrtab_data[] = { 92 ".SUNW_ctf", 93 ".symtab", 94 ".dynsym", 95 ".strtab", 96 ".dynstr", 97 ".shstrtab" 98 }; 99 100 typedef struct shstrtab { 101 int sst_ndx[STR_NUM]; 102 int sst_cur; 103 } shstrtab_t; 104 105 static void 106 shstrtab_init(shstrtab_t *s) 107 { 108 bzero(&s->sst_ndx, sizeof (s->sst_ndx)); 109 s->sst_cur = 1; 110 } 111 112 static int 113 shstrtab_ndx(shstrtab_t *s, shstrtype_t type) 114 { 115 int ret; 116 117 if ((ret = s->sst_ndx[type]) != 0) 118 return (ret); 119 120 ret = s->sst_ndx[type] = s->sst_cur; 121 s->sst_cur += strlen(shstrtab_data[type]) + 1; 122 123 return (ret); 124 } 125 126 static size_t 127 shstrtab_size(const shstrtab_t *s) 128 { 129 return (s->sst_cur); 130 } 131 132 static void 133 shstrtab_dump(const shstrtab_t *s, char *buf) 134 { 135 int i, ndx; 136 137 *buf = '\0'; 138 for (i = 0; i < STR_NUM; i++) { 139 if ((ndx = s->sst_ndx[i]) != 0) 140 (void) strcpy(buf + ndx, shstrtab_data[i]); 141 } 142 } 143 144 static int 145 dtrace_safe_phdr(Phdr *phdrp, struct uarg *args, uintptr_t base) 146 { 147 ASSERT(phdrp->p_type == PT_SUNWDTRACE); 148 149 /* 150 * See the comment in fasttrap.h for information on how to safely 151 * update this program header. 152 */ 153 if (phdrp->p_memsz < PT_SUNWDTRACE_SIZE || 154 (phdrp->p_flags & (PF_R | PF_W | PF_X)) != (PF_R | PF_W | PF_X)) 155 return (-1); 156 157 args->thrptr = phdrp->p_vaddr + base; 158 159 return (0); 160 } 161 162 /*ARGSUSED*/ 163 int 164 elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap, 165 int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred) 166 { 167 caddr_t phdrbase = NULL; 168 caddr_t bssbase = 0; 169 caddr_t brkbase = 0; 170 size_t brksize = 0; 171 ssize_t dlnsize; 172 aux_entry_t *aux; 173 int error; 174 ssize_t resid; 175 int fd = -1; 176 intptr_t voffset; 177 Phdr *dyphdr = NULL; 178 Phdr *stphdr = NULL; 179 Phdr *uphdr = NULL; 180 Phdr *junk = NULL; 181 size_t len; 182 ssize_t phdrsize; 183 int postfixsize = 0; 184 int i, hsize; 185 Phdr *phdrp; 186 Phdr *dataphdrp = NULL; 187 Phdr *dtrphdr; 188 int hasu = 0; 189 int hasauxv = 0; 190 int hasdy = 0; 191 192 struct proc *p = ttoproc(curthread); 193 struct user *up = PTOU(p); 194 struct bigwad { 195 Ehdr ehdr; 196 aux_entry_t elfargs[__KERN_NAUXV_IMPL]; 197 char dl_name[MAXPATHLEN]; 198 char pathbuf[MAXPATHLEN]; 199 struct vattr vattr; 200 struct execenv exenv; 201 } *bigwad; /* kmem_alloc this behemoth so we don't blow stack */ 202 Ehdr *ehdrp; 203 char *dlnp; 204 char *pathbufp; 205 rlim64_t limit; 206 rlim64_t roundlimit; 207 208 ASSERT(p->p_model == DATAMODEL_ILP32 || p->p_model == DATAMODEL_LP64); 209 210 bigwad = kmem_alloc(sizeof (struct bigwad), KM_SLEEP); 211 ehdrp = &bigwad->ehdr; 212 dlnp = bigwad->dl_name; 213 pathbufp = bigwad->pathbuf; 214 215 /* 216 * Obtain ELF and program header information. 217 */ 218 if ((error = getelfhead(vp, CRED(), ehdrp)) != 0 || 219 (error = getelfphdr(vp, CRED(), ehdrp, &phdrbase, &phdrsize)) != 0) 220 goto out; 221 222 /* 223 * Put data model that we're exec-ing to into the args passed to 224 * exec_args(), so it will know what it is copying to on new stack. 225 * Now that we know whether we are exec-ing a 32-bit or 64-bit 226 * executable, we can set execsz with the appropriate NCARGS. 227 */ 228 #ifdef _LP64 229 if (ehdrp->e_ident[EI_CLASS] == ELFCLASS32) { 230 args->to_model = DATAMODEL_ILP32; 231 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS32-1); 232 } else { 233 args->to_model = DATAMODEL_LP64; 234 args->stk_prot &= ~PROT_EXEC; 235 #if defined(__i386) || defined(__amd64) 236 args->dat_prot &= ~PROT_EXEC; 237 #endif 238 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS64-1); 239 } 240 #else /* _LP64 */ 241 args->to_model = DATAMODEL_ILP32; 242 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS-1); 243 #endif /* _LP64 */ 244 245 /* 246 * Determine aux size now so that stack can be built 247 * in one shot (except actual copyout of aux image), 248 * determine any non-default stack protections, 249 * and still have this code be machine independent. 250 */ 251 hsize = ehdrp->e_phentsize; 252 phdrp = (Phdr *)phdrbase; 253 for (i = ehdrp->e_phnum; i > 0; i--) { 254 switch (phdrp->p_type) { 255 case PT_INTERP: 256 hasauxv = hasdy = 1; 257 break; 258 case PT_PHDR: 259 hasu = 1; 260 break; 261 case PT_SUNWSTACK: 262 args->stk_prot = PROT_USER; 263 if (phdrp->p_flags & PF_R) 264 args->stk_prot |= PROT_READ; 265 if (phdrp->p_flags & PF_W) 266 args->stk_prot |= PROT_WRITE; 267 if (phdrp->p_flags & PF_X) 268 args->stk_prot |= PROT_EXEC; 269 break; 270 case PT_LOAD: 271 dataphdrp = phdrp; 272 break; 273 } 274 phdrp = (Phdr *)((caddr_t)phdrp + hsize); 275 } 276 277 if (ehdrp->e_type != ET_EXEC) { 278 dataphdrp = NULL; 279 hasauxv = 1; 280 } 281 282 /* Copy BSS permissions to args->dat_prot */ 283 if (dataphdrp != NULL) { 284 args->dat_prot = PROT_USER; 285 if (dataphdrp->p_flags & PF_R) 286 args->dat_prot |= PROT_READ; 287 if (dataphdrp->p_flags & PF_W) 288 args->dat_prot |= PROT_WRITE; 289 if (dataphdrp->p_flags & PF_X) 290 args->dat_prot |= PROT_EXEC; 291 } 292 293 /* 294 * If a auxvector will be required - reserve the space for 295 * it now. This may be increased by exec_args if there are 296 * ISA-specific types (included in __KERN_NAUXV_IMPL). 297 */ 298 if (hasauxv) { 299 /* 300 * If a AUX vector is being built - the base AUX 301 * entries are: 302 * 303 * AT_BASE 304 * AT_FLAGS 305 * AT_PAGESZ 306 * AT_SUN_LDSECURE 307 * AT_SUN_HWCAP 308 * AT_SUN_PLATFORM 309 * AT_SUN_EXECNAME 310 * AT_NULL 311 * 312 * total == 8 313 */ 314 if (hasdy && hasu) { 315 /* 316 * Has PT_INTERP & PT_PHDR - the auxvectors that 317 * will be built are: 318 * 319 * AT_PHDR 320 * AT_PHENT 321 * AT_PHNUM 322 * AT_ENTRY 323 * AT_LDDATA 324 * 325 * total = 5 326 */ 327 args->auxsize = (8 + 5) * sizeof (aux_entry_t); 328 } else if (hasdy) { 329 /* 330 * Has PT_INTERP but no PT_PHDR 331 * 332 * AT_EXECFD 333 * AT_LDDATA 334 * 335 * total = 2 336 */ 337 args->auxsize = (8 + 2) * sizeof (aux_entry_t); 338 } else { 339 args->auxsize = 8 * sizeof (aux_entry_t); 340 } 341 } else 342 args->auxsize = 0; 343 344 aux = bigwad->elfargs; 345 /* 346 * Move args to the user's stack. 347 */ 348 if ((error = exec_args(uap, args, idatap, (void **)&aux)) != 0) { 349 if (error == -1) { 350 error = ENOEXEC; 351 goto bad; 352 } 353 goto out; 354 } 355 356 /* 357 * If this is an ET_DYN executable (shared object), 358 * determine its memory size so that mapelfexec() can load it. 359 */ 360 if (ehdrp->e_type == ET_DYN) 361 len = elfsize(ehdrp, phdrbase, NULL); 362 else 363 len = 0; 364 365 dtrphdr = NULL; 366 367 if ((error = mapelfexec(vp, ehdrp, phdrbase, &uphdr, &dyphdr, &stphdr, 368 &dtrphdr, dataphdrp, &bssbase, &brkbase, &voffset, len, execsz, 369 &brksize)) != 0) 370 goto bad; 371 372 if (uphdr != NULL && dyphdr == NULL) 373 goto bad; 374 375 if (dtrphdr != NULL && dtrace_safe_phdr(dtrphdr, args, voffset) != 0) { 376 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, exec_file); 377 goto bad; 378 } 379 380 if (dyphdr != NULL) { 381 size_t len; 382 uintptr_t lddata; 383 char *p; 384 struct vnode *nvp; 385 386 dlnsize = dyphdr->p_filesz; 387 388 if (dlnsize > MAXPATHLEN || dlnsize <= 0) 389 goto bad; 390 391 /* 392 * Read in "interpreter" pathname. 393 */ 394 if ((error = vn_rdwr(UIO_READ, vp, dlnp, dyphdr->p_filesz, 395 (offset_t)dyphdr->p_offset, UIO_SYSSPACE, 0, (rlim64_t)0, 396 CRED(), &resid)) != 0) { 397 uprintf("%s: Cannot obtain interpreter pathname\n", 398 exec_file); 399 goto bad; 400 } 401 402 if (resid != 0 || dlnp[dlnsize - 1] != '\0') 403 goto bad; 404 405 /* 406 * Search for '$ORIGIN' token in interpreter path. 407 * If found, expand it. 408 */ 409 for (p = dlnp; p = strchr(p, '$'); ) { 410 uint_t len, curlen; 411 char *_ptr; 412 413 if (strncmp(++p, ORIGIN_STR, ORIGIN_STR_SIZE)) 414 continue; 415 416 curlen = 0; 417 len = p - dlnp - 1; 418 if (len) { 419 bcopy(dlnp, pathbufp, len); 420 curlen += len; 421 } 422 if (_ptr = strrchr(args->pathname, '/')) { 423 len = _ptr - args->pathname; 424 if ((curlen + len) > MAXPATHLEN) 425 break; 426 427 bcopy(args->pathname, &pathbufp[curlen], len); 428 curlen += len; 429 } else { 430 /* 431 * executable is a basename found in the 432 * current directory. So - just substitue 433 * '.' for ORIGIN. 434 */ 435 pathbufp[curlen] = '.'; 436 curlen++; 437 } 438 p += ORIGIN_STR_SIZE; 439 len = strlen(p); 440 441 if ((curlen + len) > MAXPATHLEN) 442 break; 443 bcopy(p, &pathbufp[curlen], len); 444 curlen += len; 445 pathbufp[curlen++] = '\0'; 446 bcopy(pathbufp, dlnp, curlen); 447 } 448 449 /* 450 * /usr/lib/ld.so.1 is known to be a symlink to /lib/ld.so.1 451 * (and /usr/lib/64/ld.so.1 is a symlink to /lib/64/ld.so.1). 452 * Just in case /usr is not mounted, change it now. 453 */ 454 if (strcmp(dlnp, USR_LIB_RTLD) == 0) 455 dlnp += 4; 456 error = lookupname(dlnp, UIO_SYSSPACE, FOLLOW, NULLVPP, &nvp); 457 if (error && dlnp != bigwad->dl_name) { 458 /* new kernel, old user-level */ 459 error = lookupname(dlnp -= 4, UIO_SYSSPACE, FOLLOW, 460 NULLVPP, &nvp); 461 } 462 if (error) { 463 uprintf("%s: Cannot find %s\n", exec_file, dlnp); 464 goto bad; 465 } 466 467 /* 468 * Setup the "aux" vector. 469 */ 470 if (uphdr) { 471 if (ehdrp->e_type == ET_DYN) { 472 /* don't use the first page */ 473 bigwad->exenv.ex_brkbase = (caddr_t)PAGESIZE; 474 bigwad->exenv.ex_bssbase = (caddr_t)PAGESIZE; 475 } else { 476 bigwad->exenv.ex_bssbase = bssbase; 477 bigwad->exenv.ex_brkbase = brkbase; 478 } 479 bigwad->exenv.ex_brksize = brksize; 480 bigwad->exenv.ex_magic = elfmagic; 481 bigwad->exenv.ex_vp = vp; 482 setexecenv(&bigwad->exenv); 483 484 ADDAUX(aux, AT_PHDR, uphdr->p_vaddr + voffset) 485 ADDAUX(aux, AT_PHENT, ehdrp->e_phentsize) 486 ADDAUX(aux, AT_PHNUM, ehdrp->e_phnum) 487 ADDAUX(aux, AT_ENTRY, ehdrp->e_entry + voffset) 488 } else { 489 if ((error = execopen(&vp, &fd)) != 0) { 490 VN_RELE(nvp); 491 goto bad; 492 } 493 494 ADDAUX(aux, AT_EXECFD, fd) 495 } 496 497 if ((error = execpermissions(nvp, &bigwad->vattr, args)) != 0) { 498 VN_RELE(nvp); 499 uprintf("%s: Cannot execute %s\n", exec_file, dlnp); 500 goto bad; 501 } 502 503 /* 504 * Now obtain the ELF header along with the entire program 505 * header contained in "nvp". 506 */ 507 kmem_free(phdrbase, phdrsize); 508 phdrbase = NULL; 509 if ((error = getelfhead(nvp, CRED(), ehdrp)) != 0 || 510 (error = getelfphdr(nvp, CRED(), ehdrp, &phdrbase, 511 &phdrsize)) != 0) { 512 VN_RELE(nvp); 513 uprintf("%s: Cannot read %s\n", exec_file, dlnp); 514 goto bad; 515 } 516 517 /* 518 * Determine memory size of the "interpreter's" loadable 519 * sections. This size is then used to obtain the virtual 520 * address of a hole, in the user's address space, large 521 * enough to map the "interpreter". 522 */ 523 if ((len = elfsize(ehdrp, phdrbase, &lddata)) == 0) { 524 VN_RELE(nvp); 525 uprintf("%s: Nothing to load in %s\n", exec_file, dlnp); 526 goto bad; 527 } 528 529 dtrphdr = NULL; 530 531 error = mapelfexec(nvp, ehdrp, phdrbase, &junk, &junk, &junk, 532 &dtrphdr, NULL, NULL, NULL, &voffset, len, execsz, NULL); 533 if (error || junk != NULL) { 534 VN_RELE(nvp); 535 uprintf("%s: Cannot map %s\n", exec_file, dlnp); 536 goto bad; 537 } 538 539 /* 540 * We use the DTrace program header to initialize the 541 * architecture-specific user per-LWP location. The dtrace 542 * fasttrap provider requires ready access to per-LWP scratch 543 * space. We assume that there is only one such program header 544 * in the interpreter. 545 */ 546 if (dtrphdr != NULL && 547 dtrace_safe_phdr(dtrphdr, args, voffset) != 0) { 548 VN_RELE(nvp); 549 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, dlnp); 550 goto bad; 551 } 552 553 VN_RELE(nvp); 554 ADDAUX(aux, AT_SUN_LDDATA, voffset + lddata) 555 } 556 557 if (hasauxv) { 558 int auxf = AF_SUN_HWCAPVERIFY; 559 /* 560 * Note: AT_SUN_PLATFORM was filled in via exec_args() 561 */ 562 ADDAUX(aux, AT_BASE, voffset) 563 ADDAUX(aux, AT_FLAGS, at_flags) 564 ADDAUX(aux, AT_PAGESZ, PAGESIZE) 565 /* 566 * Linker flags. (security) 567 * p_flag not yet set at this time. 568 * We rely on gexec() to provide us with the information. 569 */ 570 ADDAUX(aux, AT_SUN_AUXFLAGS, 571 setid ? AF_SUN_SETUGID | auxf : auxf); 572 /* 573 * Hardware capability flag word (performance hints) 574 * Used for choosing faster library routines. 575 * (Potentially different between 32-bit and 64-bit ABIs) 576 */ 577 #if defined(_LP64) 578 if (args->to_model == DATAMODEL_NATIVE) 579 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap) 580 else 581 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap32) 582 #else 583 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap) 584 #endif 585 ADDAUX(aux, AT_NULL, 0) 586 postfixsize = (char *)aux - (char *)bigwad->elfargs; 587 ASSERT(postfixsize == args->auxsize); 588 ASSERT(postfixsize <= __KERN_NAUXV_IMPL * sizeof (aux_entry_t)); 589 } 590 591 /* 592 * For the 64-bit kernel, the limit is big enough that rounding it up 593 * to a page can overflow the 64-bit limit, so we check for btopr() 594 * overflowing here by comparing it with the unrounded limit in pages. 595 * If it hasn't overflowed, compare the exec size with the rounded up 596 * limit in pages. Otherwise, just compare with the unrounded limit. 597 */ 598 limit = btop(p->p_vmem_ctl); 599 roundlimit = btopr(p->p_vmem_ctl); 600 if ((roundlimit > limit && *execsz > roundlimit) || 601 (roundlimit < limit && *execsz > limit)) { 602 mutex_enter(&p->p_lock); 603 (void) rctl_action(rctlproc_legacy[RLIMIT_VMEM], p->p_rctls, p, 604 RCA_SAFE); 605 mutex_exit(&p->p_lock); 606 error = ENOMEM; 607 goto bad; 608 } 609 610 bzero(up->u_auxv, sizeof (up->u_auxv)); 611 if (postfixsize) { 612 int num_auxv; 613 614 /* 615 * Copy the aux vector to the user stack. 616 */ 617 error = execpoststack(args, bigwad->elfargs, postfixsize); 618 if (error) 619 goto bad; 620 621 /* 622 * Copy auxv to the process's user structure for use by /proc. 623 */ 624 num_auxv = postfixsize / sizeof (aux_entry_t); 625 ASSERT(num_auxv <= sizeof (up->u_auxv) / sizeof (auxv_t)); 626 aux = bigwad->elfargs; 627 for (i = 0; i < num_auxv; i++) { 628 up->u_auxv[i].a_type = aux[i].a_type; 629 up->u_auxv[i].a_un.a_val = (aux_val_t)aux[i].a_un.a_val; 630 } 631 } 632 633 /* 634 * Pass back the starting address so we can set the program counter. 635 */ 636 args->entry = (uintptr_t)(ehdrp->e_entry + voffset); 637 638 if (!uphdr) { 639 if (ehdrp->e_type == ET_DYN) { 640 /* 641 * If we are executing a shared library which doesn't 642 * have a interpreter (probably ld.so.1) then 643 * we don't set the brkbase now. Instead we 644 * delay it's setting until the first call 645 * via grow.c::brk(). This permits ld.so.1 to 646 * initialize brkbase to the tail of the executable it 647 * loads (which is where it needs to be). 648 */ 649 bigwad->exenv.ex_brkbase = (caddr_t)0; 650 bigwad->exenv.ex_bssbase = (caddr_t)0; 651 bigwad->exenv.ex_brksize = 0; 652 } else { 653 bigwad->exenv.ex_brkbase = brkbase; 654 bigwad->exenv.ex_bssbase = bssbase; 655 bigwad->exenv.ex_brksize = brksize; 656 } 657 bigwad->exenv.ex_magic = elfmagic; 658 bigwad->exenv.ex_vp = vp; 659 setexecenv(&bigwad->exenv); 660 } 661 662 ASSERT(error == 0); 663 goto out; 664 665 bad: 666 if (fd != -1) /* did we open the a.out yet */ 667 (void) execclose(fd); 668 669 psignal(p, SIGKILL); 670 671 if (error == 0) 672 error = ENOEXEC; 673 out: 674 if (phdrbase != NULL) 675 kmem_free(phdrbase, phdrsize); 676 kmem_free(bigwad, sizeof (struct bigwad)); 677 return (error); 678 } 679 680 /* 681 * Compute the memory size requirement for the ELF file. 682 */ 683 static size_t 684 elfsize(Ehdr *ehdrp, caddr_t phdrbase, uintptr_t *lddata) 685 { 686 size_t len; 687 Phdr *phdrp = (Phdr *)phdrbase; 688 int hsize = ehdrp->e_phentsize; 689 int first = 1; 690 int dfirst = 1; /* first data segment */ 691 uintptr_t loaddr = 0; 692 uintptr_t hiaddr = 0; 693 uintptr_t lo, hi; 694 int i; 695 696 for (i = ehdrp->e_phnum; i > 0; i--) { 697 if (phdrp->p_type == PT_LOAD) { 698 lo = phdrp->p_vaddr; 699 hi = lo + phdrp->p_memsz; 700 if (first) { 701 loaddr = lo; 702 hiaddr = hi; 703 first = 0; 704 } else { 705 if (loaddr > lo) 706 loaddr = lo; 707 if (hiaddr < hi) 708 hiaddr = hi; 709 } 710 711 /* 712 * save the address of the first data segment 713 * of a object - used for the AT_SUNW_LDDATA 714 * aux entry. 715 */ 716 if ((lddata != NULL) && dfirst && 717 (phdrp->p_flags & PF_W)) { 718 *lddata = lo; 719 dfirst = 0; 720 } 721 } 722 phdrp = (Phdr *)((caddr_t)phdrp + hsize); 723 } 724 725 len = hiaddr - (loaddr & PAGEMASK); 726 len = roundup(len, PAGESIZE); 727 728 return (len); 729 } 730 731 /* 732 * Read in the ELF header and program header table. 733 * SUSV3 requires: 734 * ENOEXEC File format is not recognized 735 * EINVAL Format recognized but execution not supported 736 */ 737 static int 738 getelfhead(vnode_t *vp, cred_t *credp, Ehdr *ehdr) 739 { 740 int error; 741 ssize_t resid; 742 743 /* 744 * We got here by the first two bytes in ident, 745 * now read the entire ELF header. 746 */ 747 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)ehdr, 748 sizeof (Ehdr), (offset_t)0, UIO_SYSSPACE, 0, 749 (rlim64_t)0, credp, &resid)) != 0) 750 return (error); 751 752 /* 753 * Since a separate version is compiled for handling 32-bit and 754 * 64-bit ELF executables on a 64-bit kernel, the 64-bit version 755 * doesn't need to be able to deal with 32-bit ELF files. 756 */ 757 if (resid != 0 || 758 ehdr->e_ident[EI_MAG2] != ELFMAG2 || 759 ehdr->e_ident[EI_MAG3] != ELFMAG3) 760 return (ENOEXEC); 761 if ((ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) || 762 #if defined(_ILP32) || defined(_ELF32_COMPAT) 763 ehdr->e_ident[EI_CLASS] != ELFCLASS32 || 764 #else 765 ehdr->e_ident[EI_CLASS] != ELFCLASS64 || 766 #endif 767 !elfheadcheck(ehdr->e_ident[EI_DATA], ehdr->e_machine, 768 ehdr->e_flags)) 769 return (EINVAL); 770 771 return (0); 772 } 773 774 #ifdef _ELF32_COMPAT 775 extern size_t elf_nphdr_max; 776 #else 777 size_t elf_nphdr_max = 1000; 778 #endif 779 780 static int 781 getelfphdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, 782 caddr_t *phbasep, ssize_t *phsizep) 783 { 784 ssize_t resid, minsize; 785 int err; 786 787 /* 788 * Since we're going to be using e_phentsize to iterate down the 789 * array of program headers, it must be 8-byte aligned or else 790 * a we might cause a misaligned access. We use all members through 791 * p_flags on 32-bit ELF files and p_memsz on 64-bit ELF files so 792 * e_phentsize must be at least large enough to include those 793 * members. 794 */ 795 #if !defined(_LP64) || defined(_ELF32_COMPAT) 796 minsize = offsetof(Phdr, p_flags) + sizeof (((Phdr *)NULL)->p_flags); 797 #else 798 minsize = offsetof(Phdr, p_memsz) + sizeof (((Phdr *)NULL)->p_memsz); 799 #endif 800 if (ehdr->e_phentsize < minsize || (ehdr->e_phentsize & 3)) 801 return (EINVAL); 802 803 *phsizep = ehdr->e_phnum * ehdr->e_phentsize; 804 805 if (*phsizep > sizeof (Phdr) * elf_nphdr_max) { 806 if ((*phbasep = kmem_alloc(*phsizep, KM_NOSLEEP)) == NULL) 807 return (ENOMEM); 808 } else { 809 *phbasep = kmem_alloc(*phsizep, KM_SLEEP); 810 } 811 812 if ((err = vn_rdwr(UIO_READ, vp, *phbasep, *phsizep, 813 (offset_t)ehdr->e_phoff, UIO_SYSSPACE, 0, (rlim64_t)0, 814 credp, &resid)) != 0) { 815 kmem_free(*phbasep, *phsizep); 816 *phbasep = NULL; 817 return (err); 818 } 819 820 return (0); 821 } 822 823 #ifdef _ELF32_COMPAT 824 extern size_t elf_nshdr_max; 825 extern size_t elf_shstrtab_max; 826 #else 827 size_t elf_nshdr_max = 10000; 828 size_t elf_shstrtab_max = 100 * 1024; 829 #endif 830 831 832 static int 833 getelfshdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, 834 caddr_t *shbasep, ssize_t *shsizep, 835 char **shstrbasep, ssize_t *shstrsizep) 836 { 837 ssize_t resid, minsize; 838 int err; 839 Shdr *shdr; 840 841 /* 842 * Since we're going to be using e_shentsize to iterate down the 843 * array of section headers, it must be 8-byte aligned or else 844 * a we might cause a misaligned access. We use all members through 845 * sh_entsize (on both 32- and 64-bit ELF files) so e_shentsize 846 * must be at least large enough to include that member. The 847 * index of the string table section must be valid. 848 */ 849 minsize = offsetof(Shdr, sh_entsize) + sizeof (shdr->sh_entsize); 850 if (ehdr->e_shentsize < minsize || (ehdr->e_shentsize & 3) || 851 ehdr->e_shstrndx >= ehdr->e_shnum) 852 return (EINVAL); 853 854 *shsizep = ehdr->e_shnum * ehdr->e_shentsize; 855 856 if (*shsizep > sizeof (Shdr) * elf_nshdr_max) { 857 if ((*shbasep = kmem_alloc(*shsizep, KM_NOSLEEP)) == NULL) 858 return (ENOMEM); 859 } else { 860 *shbasep = kmem_alloc(*shsizep, KM_SLEEP); 861 } 862 863 if ((err = vn_rdwr(UIO_READ, vp, *shbasep, *shsizep, 864 (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, (rlim64_t)0, 865 credp, &resid)) != 0) { 866 kmem_free(*shbasep, *shsizep); 867 return (err); 868 } 869 870 /* 871 * Pull the section string table out of the vnode; fail if the size 872 * is zero. 873 */ 874 shdr = (Shdr *)(*shbasep + ehdr->e_shstrndx * ehdr->e_shentsize); 875 if ((*shstrsizep = shdr->sh_size) == 0) { 876 kmem_free(*shbasep, *shsizep); 877 return (EINVAL); 878 } 879 880 if (*shstrsizep > elf_shstrtab_max) { 881 if ((*shstrbasep = kmem_alloc(*shstrsizep, 882 KM_NOSLEEP)) == NULL) { 883 kmem_free(*shbasep, *shsizep); 884 return (ENOMEM); 885 } 886 } else { 887 *shstrbasep = kmem_alloc(*shstrsizep, KM_SLEEP); 888 } 889 890 if ((err = vn_rdwr(UIO_READ, vp, *shstrbasep, *shstrsizep, 891 (offset_t)shdr->sh_offset, UIO_SYSSPACE, 0, (rlim64_t)0, 892 credp, &resid)) != 0) { 893 kmem_free(*shbasep, *shsizep); 894 kmem_free(*shstrbasep, *shstrsizep); 895 return (err); 896 } 897 898 /* 899 * Make sure the strtab is null-terminated to make sure we 900 * don't run off the end of the table. 901 */ 902 (*shstrbasep)[*shstrsizep - 1] = '\0'; 903 904 return (0); 905 } 906 907 static int 908 mapelfexec( 909 vnode_t *vp, 910 Ehdr *ehdr, 911 caddr_t phdrbase, 912 Phdr **uphdr, 913 Phdr **dyphdr, 914 Phdr **stphdr, 915 Phdr **dtphdr, 916 Phdr *dataphdrp, 917 caddr_t *bssbase, 918 caddr_t *brkbase, 919 intptr_t *voffset, 920 size_t len, 921 long *execsz, 922 size_t *brksize) 923 { 924 Phdr *phdr; 925 int i, prot, error; 926 caddr_t addr; 927 size_t zfodsz; 928 int ptload = 0; 929 int page; 930 off_t offset; 931 int hsize = ehdr->e_phentsize; 932 933 if (ehdr->e_type == ET_DYN) { 934 /* 935 * Obtain the virtual address of a hole in the 936 * address space to map the "interpreter". 937 */ 938 map_addr(&addr, len, (offset_t)0, 1, 0); 939 if (addr == NULL) 940 return (ENOMEM); 941 *voffset = (intptr_t)addr; 942 } else { 943 *voffset = 0; 944 } 945 phdr = (Phdr *)phdrbase; 946 for (i = (int)ehdr->e_phnum; i > 0; i--) { 947 switch (phdr->p_type) { 948 case PT_LOAD: 949 if ((*dyphdr != NULL) && (*uphdr == NULL)) 950 return (0); 951 952 ptload = 1; 953 prot = PROT_USER; 954 if (phdr->p_flags & PF_R) 955 prot |= PROT_READ; 956 if (phdr->p_flags & PF_W) 957 prot |= PROT_WRITE; 958 if (phdr->p_flags & PF_X) 959 prot |= PROT_EXEC; 960 961 addr = (caddr_t)((uintptr_t)phdr->p_vaddr + *voffset); 962 zfodsz = (size_t)phdr->p_memsz - phdr->p_filesz; 963 964 offset = phdr->p_offset; 965 if (((uintptr_t)offset & PAGEOFFSET) == 966 ((uintptr_t)addr & PAGEOFFSET) && 967 (!(vp->v_flag & VNOMAP))) { 968 page = 1; 969 } else { 970 page = 0; 971 } 972 973 if (curproc->p_brkpageszc != 0 && phdr == dataphdrp) { 974 /* 975 * segvn only uses large pages for segments 976 * that have the requested large page size 977 * aligned base and size. To insure the part 978 * of bss that starts at heap large page size 979 * boundary gets mapped by large pages create 980 * 2 bss segvn segments which is accomplished 981 * by calling execmap twice. First execmap 982 * will create the bss segvn segment that is 983 * before the large page boundary and it will 984 * be mapped with base pages. If bss start is 985 * already large page aligned only 1 bss 986 * segment will be created. The second bss 987 * segment's size is large page size aligned 988 * so that segvn uses large pages for that 989 * segment and it also makes the heap that 990 * starts right after bss to start at large 991 * page boundary. 992 */ 993 uint_t szc = curproc->p_brkpageszc; 994 size_t pgsz = page_get_pagesize(szc); 995 caddr_t zaddr = addr + phdr->p_filesz; 996 size_t zlen = P2NPHASE((uintptr_t)zaddr, pgsz); 997 998 ASSERT(pgsz > PAGESIZE); 999 1000 if (error = execmap(vp, addr, phdr->p_filesz, 1001 zlen, phdr->p_offset, prot, page, szc)) 1002 goto bad; 1003 if (zfodsz > zlen) { 1004 zfodsz -= zlen; 1005 zaddr += zlen; 1006 zlen = P2ROUNDUP(zfodsz, pgsz); 1007 if (error = execmap(vp, zaddr, 0, zlen, 1008 phdr->p_offset, prot, page, szc)) 1009 goto bad; 1010 } 1011 if (brksize != NULL) 1012 *brksize = zlen - zfodsz; 1013 } else { 1014 if (error = execmap(vp, addr, phdr->p_filesz, 1015 zfodsz, phdr->p_offset, prot, page, 0)) 1016 goto bad; 1017 } 1018 1019 if (bssbase != NULL && addr >= *bssbase && 1020 phdr == dataphdrp) { 1021 *bssbase = addr + phdr->p_filesz; 1022 } 1023 if (brkbase != NULL && addr >= *brkbase) { 1024 *brkbase = addr + phdr->p_memsz; 1025 } 1026 1027 *execsz += btopr(phdr->p_memsz); 1028 break; 1029 1030 case PT_INTERP: 1031 if (ptload) 1032 goto bad; 1033 *dyphdr = phdr; 1034 break; 1035 1036 case PT_SHLIB: 1037 *stphdr = phdr; 1038 break; 1039 1040 case PT_PHDR: 1041 if (ptload) 1042 goto bad; 1043 *uphdr = phdr; 1044 break; 1045 1046 case PT_NULL: 1047 case PT_DYNAMIC: 1048 case PT_NOTE: 1049 break; 1050 1051 case PT_SUNWDTRACE: 1052 if (dtphdr != NULL) 1053 *dtphdr = phdr; 1054 break; 1055 1056 default: 1057 break; 1058 } 1059 phdr = (Phdr *)((caddr_t)phdr + hsize); 1060 } 1061 return (0); 1062 bad: 1063 if (error == 0) 1064 error = EINVAL; 1065 return (error); 1066 } 1067 1068 int 1069 elfnote(vnode_t *vp, offset_t *offsetp, int type, int descsz, void *desc, 1070 rlim64_t rlimit, cred_t *credp) 1071 { 1072 Note note; 1073 int error; 1074 1075 bzero(¬e, sizeof (note)); 1076 bcopy("CORE", note.name, 4); 1077 note.nhdr.n_type = type; 1078 /* 1079 * The System V ABI states that n_namesz must be the length of the 1080 * string that follows the Nhdr structure including the terminating 1081 * null. The ABI also specifies that sufficient padding should be 1082 * included so that the description that follows the name string 1083 * begins on a 4- or 8-byte boundary for 32- and 64-bit binaries 1084 * respectively. However, since this change was not made correctly 1085 * at the time of the 64-bit port, both 32- and 64-bit binaries 1086 * descriptions are only guaranteed to begin on a 4-byte boundary. 1087 */ 1088 note.nhdr.n_namesz = 5; 1089 note.nhdr.n_descsz = roundup(descsz, sizeof (Word)); 1090 1091 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, ¬e, 1092 sizeof (note), rlimit, credp)) 1093 return (error); 1094 1095 *offsetp += sizeof (note); 1096 1097 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, desc, 1098 note.nhdr.n_descsz, rlimit, credp)) 1099 return (error); 1100 1101 *offsetp += note.nhdr.n_descsz; 1102 return (0); 1103 } 1104 1105 /* 1106 * Copy the section data from one vnode to the section of another vnode. 1107 */ 1108 static void 1109 copy_scn(Shdr *src, vnode_t *src_vp, Shdr *dst, vnode_t *dst_vp, Off *doffset, 1110 void *buf, size_t size, cred_t *credp, rlim64_t rlimit) 1111 { 1112 ssize_t resid; 1113 size_t len, n = src->sh_size; 1114 offset_t off = 0; 1115 1116 while (n != 0) { 1117 len = MIN(size, n); 1118 if (vn_rdwr(UIO_READ, src_vp, buf, len, src->sh_offset + off, 1119 UIO_SYSSPACE, 0, (rlim64_t)0, credp, &resid) != 0 || 1120 resid >= len || 1121 core_write(dst_vp, UIO_SYSSPACE, *doffset + off, 1122 buf, len - resid, rlimit, credp) != 0) { 1123 dst->sh_size = 0; 1124 dst->sh_offset = 0; 1125 return; 1126 } 1127 1128 ASSERT(n >= len - resid); 1129 1130 n -= len - resid; 1131 off += len - resid; 1132 } 1133 1134 *doffset += src->sh_size; 1135 } 1136 1137 #ifdef _ELF32_COMPAT 1138 extern size_t elf_datasz_max; 1139 #else 1140 size_t elf_datasz_max = 1 * 1024 * 1024; 1141 #endif 1142 1143 /* 1144 * This function processes mappings that correspond to load objects to 1145 * examine their respective sections for elfcore(). It's called once with 1146 * v set to NULL to count the number of sections that we're going to need 1147 * and then again with v set to some allocated buffer that we fill in with 1148 * all the section data. 1149 */ 1150 static int 1151 process_scns(core_content_t content, proc_t *p, cred_t *credp, vnode_t *vp, 1152 Shdr *v, int nshdrs, rlim64_t rlimit, Off *doffsetp, int *nshdrsp) 1153 { 1154 vnode_t *lastvp = NULL; 1155 struct seg *seg; 1156 int i, j; 1157 void *data = NULL; 1158 size_t datasz = 0; 1159 shstrtab_t shstrtab; 1160 struct as *as = p->p_as; 1161 int error = 0; 1162 1163 if (v != NULL) 1164 shstrtab_init(&shstrtab); 1165 1166 i = 1; 1167 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) { 1168 uint_t prot; 1169 vnode_t *mvp; 1170 void *tmp = NULL; 1171 caddr_t saddr = seg->s_base; 1172 caddr_t naddr; 1173 caddr_t eaddr; 1174 size_t segsize; 1175 1176 Ehdr ehdr; 1177 caddr_t shbase; 1178 ssize_t shsize; 1179 char *shstrbase; 1180 ssize_t shstrsize; 1181 1182 Shdr *shdr; 1183 const char *name; 1184 size_t sz; 1185 uintptr_t off; 1186 1187 int ctf_ndx = 0; 1188 int symtab_ndx = 0; 1189 1190 /* 1191 * Since we're just looking for text segments of load 1192 * objects, we only care about the protection bits; we don't 1193 * care about the actual size of the segment so we use the 1194 * reserved size. If the segment's size is zero, there's 1195 * something fishy going on so we ignore this segment. 1196 */ 1197 if (seg->s_ops != &segvn_ops || 1198 SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 || 1199 mvp == lastvp || mvp == NULL || mvp->v_type != VREG || 1200 (segsize = pr_getsegsize(seg, 1)) == 0) 1201 continue; 1202 1203 eaddr = saddr + segsize; 1204 prot = pr_getprot(seg, 1, &tmp, &saddr, &naddr, eaddr); 1205 pr_getprot_done(&tmp); 1206 1207 /* 1208 * Skip this segment unless the protection bits look like 1209 * what we'd expect for a text segment. 1210 */ 1211 if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC) 1212 continue; 1213 1214 if (getelfhead(mvp, credp, &ehdr) != 0 || 1215 getelfshdr(mvp, credp, &ehdr, &shbase, &shsize, 1216 &shstrbase, &shstrsize) != 0) 1217 continue; 1218 1219 off = ehdr.e_shentsize; 1220 for (j = 1; j < ehdr.e_shnum; j++, off += ehdr.e_shentsize) { 1221 Shdr *symtab = NULL, *strtab; 1222 1223 shdr = (Shdr *)(shbase + off); 1224 1225 if (shdr->sh_name >= shstrsize) 1226 continue; 1227 1228 name = shstrbase + shdr->sh_name; 1229 1230 if (strcmp(name, shstrtab_data[STR_CTF]) == 0) { 1231 if ((content & CC_CONTENT_CTF) == 0 || 1232 ctf_ndx != 0) 1233 continue; 1234 1235 if (shdr->sh_link > 0 && 1236 shdr->sh_link < ehdr.e_shnum) { 1237 symtab = (Shdr *)(shbase + 1238 shdr->sh_link * ehdr.e_shentsize); 1239 } 1240 1241 if (v != NULL && i < nshdrs - 1) { 1242 if (shdr->sh_size > datasz && 1243 shdr->sh_size <= elf_datasz_max) { 1244 if (data != NULL) 1245 kmem_free(data, datasz); 1246 1247 datasz = shdr->sh_size; 1248 data = kmem_alloc(datasz, 1249 KM_SLEEP); 1250 } 1251 1252 v[i].sh_name = shstrtab_ndx(&shstrtab, 1253 STR_CTF); 1254 v[i].sh_addr = (Addr)(uintptr_t)saddr; 1255 v[i].sh_type = SHT_PROGBITS; 1256 v[i].sh_addralign = 4; 1257 *doffsetp = roundup(*doffsetp, 1258 v[i].sh_addralign); 1259 v[i].sh_offset = *doffsetp; 1260 v[i].sh_size = shdr->sh_size; 1261 if (symtab == NULL) { 1262 v[i].sh_link = 0; 1263 } else if (symtab->sh_type == 1264 SHT_SYMTAB && 1265 symtab_ndx != 0) { 1266 v[i].sh_link = 1267 symtab_ndx; 1268 } else { 1269 v[i].sh_link = i + 1; 1270 } 1271 1272 copy_scn(shdr, mvp, &v[i], vp, 1273 doffsetp, data, datasz, credp, 1274 rlimit); 1275 } 1276 1277 ctf_ndx = i++; 1278 1279 /* 1280 * We've already dumped the symtab. 1281 */ 1282 if (symtab != NULL && 1283 symtab->sh_type == SHT_SYMTAB && 1284 symtab_ndx != 0) 1285 continue; 1286 1287 } else if (strcmp(name, 1288 shstrtab_data[STR_SYMTAB]) == 0) { 1289 if ((content & CC_CONTENT_SYMTAB) == 0 || 1290 symtab != 0) 1291 continue; 1292 1293 symtab = shdr; 1294 } 1295 1296 if (symtab != NULL) { 1297 if ((symtab->sh_type != SHT_DYNSYM && 1298 symtab->sh_type != SHT_SYMTAB) || 1299 symtab->sh_link == 0 || 1300 symtab->sh_link >= ehdr.e_shnum) 1301 continue; 1302 1303 strtab = (Shdr *)(shbase + 1304 symtab->sh_link * ehdr.e_shentsize); 1305 1306 if (strtab->sh_type != SHT_STRTAB) 1307 continue; 1308 1309 if (v != NULL && i < nshdrs - 2) { 1310 sz = MAX(symtab->sh_size, 1311 strtab->sh_size); 1312 if (sz > datasz && 1313 sz <= elf_datasz_max) { 1314 if (data != NULL) 1315 kmem_free(data, datasz); 1316 1317 datasz = sz; 1318 data = kmem_alloc(datasz, 1319 KM_SLEEP); 1320 } 1321 1322 if (symtab->sh_type == SHT_DYNSYM) { 1323 v[i].sh_name = shstrtab_ndx( 1324 &shstrtab, STR_DYNSYM); 1325 v[i + 1].sh_name = shstrtab_ndx( 1326 &shstrtab, STR_DYNSTR); 1327 } else { 1328 v[i].sh_name = shstrtab_ndx( 1329 &shstrtab, STR_SYMTAB); 1330 v[i + 1].sh_name = shstrtab_ndx( 1331 &shstrtab, STR_STRTAB); 1332 } 1333 1334 v[i].sh_type = symtab->sh_type; 1335 v[i].sh_addr = symtab->sh_addr; 1336 if (ehdr.e_type == ET_DYN || 1337 v[i].sh_addr == 0) 1338 v[i].sh_addr += 1339 (Addr)(uintptr_t)saddr; 1340 v[i].sh_addralign = 1341 symtab->sh_addralign; 1342 *doffsetp = roundup(*doffsetp, 1343 v[i].sh_addralign); 1344 v[i].sh_offset = *doffsetp; 1345 v[i].sh_size = symtab->sh_size; 1346 v[i].sh_link = i + 1; 1347 v[i].sh_entsize = symtab->sh_entsize; 1348 v[i].sh_info = symtab->sh_info; 1349 1350 copy_scn(symtab, mvp, &v[i], vp, 1351 doffsetp, data, datasz, credp, 1352 rlimit); 1353 1354 v[i + 1].sh_type = SHT_STRTAB; 1355 v[i + 1].sh_flags = SHF_STRINGS; 1356 v[i + 1].sh_addr = symtab->sh_addr; 1357 if (ehdr.e_type == ET_DYN || 1358 v[i + 1].sh_addr == 0) 1359 v[i + 1].sh_addr += 1360 (Addr)(uintptr_t)saddr; 1361 v[i + 1].sh_addralign = 1362 strtab->sh_addralign; 1363 *doffsetp = roundup(*doffsetp, 1364 v[i + 1].sh_addralign); 1365 v[i + 1].sh_offset = *doffsetp; 1366 v[i + 1].sh_size = strtab->sh_size; 1367 1368 copy_scn(strtab, mvp, &v[i + 1], vp, 1369 doffsetp, data, datasz, credp, 1370 rlimit); 1371 } 1372 1373 if (symtab->sh_type == SHT_SYMTAB) 1374 symtab_ndx = i; 1375 i += 2; 1376 } 1377 } 1378 1379 kmem_free(shstrbase, shstrsize); 1380 kmem_free(shbase, shsize); 1381 1382 lastvp = mvp; 1383 } 1384 1385 if (v == NULL) { 1386 if (i == 1) 1387 *nshdrsp = 0; 1388 else 1389 *nshdrsp = i + 1; 1390 goto done; 1391 } 1392 1393 if (i != nshdrs - 1) { 1394 cmn_err(CE_WARN, "elfcore: core dump failed for " 1395 "process %d; address space is changing", p->p_pid); 1396 error = EIO; 1397 goto done; 1398 } 1399 1400 v[i].sh_name = shstrtab_ndx(&shstrtab, STR_SHSTRTAB); 1401 v[i].sh_size = shstrtab_size(&shstrtab); 1402 v[i].sh_addralign = 1; 1403 *doffsetp = roundup(*doffsetp, v[i].sh_addralign); 1404 v[i].sh_offset = *doffsetp; 1405 v[i].sh_flags = SHF_STRINGS; 1406 v[i].sh_type = SHT_STRTAB; 1407 1408 if (v[i].sh_size > datasz) { 1409 if (data != NULL) 1410 kmem_free(data, datasz); 1411 1412 datasz = v[i].sh_size; 1413 data = kmem_alloc(datasz, 1414 KM_SLEEP); 1415 } 1416 1417 shstrtab_dump(&shstrtab, data); 1418 1419 if ((error = core_write(vp, UIO_SYSSPACE, *doffsetp, 1420 data, v[i].sh_size, rlimit, credp)) != 0) 1421 goto done; 1422 1423 *doffsetp += v[i].sh_size; 1424 1425 done: 1426 if (data != NULL) 1427 kmem_free(data, datasz); 1428 1429 return (error); 1430 } 1431 1432 int 1433 elfcore(vnode_t *vp, proc_t *p, cred_t *credp, rlim64_t rlimit, int sig, 1434 core_content_t content) 1435 { 1436 offset_t poffset, soffset; 1437 Off doffset; 1438 int error, i, nphdrs, nshdrs; 1439 int overflow = 0; 1440 struct seg *seg; 1441 struct as *as = p->p_as; 1442 union { 1443 Ehdr ehdr; 1444 Phdr phdr[1]; 1445 Shdr shdr[1]; 1446 } *bigwad; 1447 size_t bigsize; 1448 size_t phdrsz, shdrsz; 1449 Ehdr *ehdr; 1450 Phdr *v; 1451 caddr_t brkbase; 1452 size_t brksize; 1453 caddr_t stkbase; 1454 size_t stksize; 1455 int ntries = 0; 1456 1457 top: 1458 /* 1459 * Make sure we have everything we need (registers, etc.). 1460 * All other lwps have already stopped and are in an orderly state. 1461 */ 1462 ASSERT(p == ttoproc(curthread)); 1463 prstop(0, 0); 1464 1465 AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER); 1466 nphdrs = prnsegs(as, 0) + 2; /* two CORE note sections */ 1467 1468 /* 1469 * Count the number of section headers we're going to need. 1470 */ 1471 nshdrs = 0; 1472 if (content & (CC_CONTENT_CTF | CC_CONTENT_SYMTAB)) { 1473 (void) process_scns(content, p, credp, NULL, NULL, NULL, 0, 1474 NULL, &nshdrs); 1475 } 1476 AS_LOCK_EXIT(as, &as->a_lock); 1477 1478 phdrsz = nphdrs * sizeof (Phdr); 1479 shdrsz = nshdrs * sizeof (Shdr); 1480 1481 bigsize = MAX(sizeof (*bigwad), MAX(phdrsz, shdrsz)); 1482 bigwad = kmem_alloc(bigsize, KM_SLEEP); 1483 1484 ehdr = &bigwad->ehdr; 1485 bzero(ehdr, sizeof (*ehdr)); 1486 1487 ehdr->e_ident[EI_MAG0] = ELFMAG0; 1488 ehdr->e_ident[EI_MAG1] = ELFMAG1; 1489 ehdr->e_ident[EI_MAG2] = ELFMAG2; 1490 ehdr->e_ident[EI_MAG3] = ELFMAG3; 1491 ehdr->e_ident[EI_CLASS] = ELFCLASS; 1492 ehdr->e_type = ET_CORE; 1493 1494 #if !defined(_LP64) || defined(_ELF32_COMPAT) 1495 1496 #if defined(__sparc) 1497 ehdr->e_ident[EI_DATA] = ELFDATA2MSB; 1498 ehdr->e_machine = EM_SPARC; 1499 #elif defined(__i386) || defined(__i386_COMPAT) 1500 ehdr->e_ident[EI_DATA] = ELFDATA2LSB; 1501 ehdr->e_machine = EM_386; 1502 #else 1503 #error "no recognized machine type is defined" 1504 #endif 1505 1506 #else /* !defined(_LP64) || defined(_ELF32_COMPAT) */ 1507 1508 #if defined(__sparc) 1509 ehdr->e_ident[EI_DATA] = ELFDATA2MSB; 1510 ehdr->e_machine = EM_SPARCV9; 1511 #elif defined(__ia64) 1512 ehdr->e_ident[EI_DATA] = ELFDATA2LSB; 1513 ehdr->e_machine = EM_IA_64; 1514 #elif defined(__amd64) 1515 ehdr->e_ident[EI_DATA] = ELFDATA2LSB; 1516 ehdr->e_machine = EM_AMD64; 1517 #else 1518 #error "no recognized 64-bit machine type is defined" 1519 #endif 1520 1521 #endif /* !defined(_LP64) || defined(_ELF32_COMPAT) */ 1522 1523 ehdr->e_version = EV_CURRENT; 1524 ehdr->e_phoff = sizeof (Ehdr); 1525 ehdr->e_ehsize = sizeof (Ehdr); 1526 ehdr->e_phentsize = sizeof (Phdr); 1527 ehdr->e_phnum = (unsigned short)nphdrs; 1528 1529 if (nshdrs > 0) { 1530 ehdr->e_shstrndx = (unsigned short)(nshdrs - 1); 1531 ehdr->e_shentsize = sizeof (Shdr); 1532 ehdr->e_shnum = (unsigned short)nshdrs; 1533 ehdr->e_shoff = ehdr->e_phoff + 1534 ehdr->e_phentsize * ehdr->e_phnum; 1535 } 1536 1537 if (error = core_write(vp, UIO_SYSSPACE, (offset_t)0, ehdr, 1538 sizeof (Ehdr), rlimit, credp)) 1539 goto done; 1540 1541 poffset = sizeof (Ehdr); 1542 soffset = sizeof (Ehdr) + phdrsz; 1543 doffset = sizeof (Ehdr) + phdrsz + shdrsz; 1544 1545 v = &bigwad->phdr[0]; 1546 bzero(v, phdrsz); 1547 1548 setup_old_note_header(&v[0], p); 1549 v[0].p_offset = doffset = roundup(doffset, sizeof (Word)); 1550 doffset += v[0].p_filesz; 1551 1552 setup_note_header(&v[1], p); 1553 v[1].p_offset = doffset = roundup(doffset, sizeof (Word)); 1554 doffset += v[1].p_filesz; 1555 1556 mutex_enter(&p->p_lock); 1557 1558 brkbase = p->p_brkbase; 1559 brksize = p->p_brksize; 1560 1561 stkbase = p->p_usrstack - p->p_stksize; 1562 stksize = p->p_stksize; 1563 1564 mutex_exit(&p->p_lock); 1565 1566 AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER); 1567 i = 2; 1568 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) { 1569 caddr_t eaddr = seg->s_base + pr_getsegsize(seg, 0); 1570 caddr_t saddr, naddr; 1571 void *tmp = NULL; 1572 extern struct seg_ops segspt_shmops; 1573 1574 for (saddr = seg->s_base; saddr < eaddr; saddr = naddr) { 1575 uint_t prot; 1576 size_t size; 1577 int type; 1578 vnode_t *mvp; 1579 1580 prot = pr_getprot(seg, 0, &tmp, &saddr, &naddr, eaddr); 1581 prot &= PROT_READ | PROT_WRITE | PROT_EXEC; 1582 if ((size = (size_t)(naddr - saddr)) == 0) 1583 continue; 1584 if (i == nphdrs) { 1585 overflow++; 1586 continue; 1587 } 1588 v[i].p_type = PT_LOAD; 1589 v[i].p_vaddr = (Addr)(uintptr_t)saddr; 1590 v[i].p_memsz = size; 1591 if (prot & PROT_READ) 1592 v[i].p_flags |= PF_R; 1593 if (prot & PROT_WRITE) 1594 v[i].p_flags |= PF_W; 1595 if (prot & PROT_EXEC) 1596 v[i].p_flags |= PF_X; 1597 1598 /* 1599 * Figure out which mappings to include in the core. 1600 */ 1601 type = SEGOP_GETTYPE(seg, saddr); 1602 1603 if (saddr == stkbase && size == stksize) { 1604 if (!(content & CC_CONTENT_STACK)) 1605 goto exclude; 1606 1607 } else if (saddr == brkbase && size == brksize) { 1608 if (!(content & CC_CONTENT_HEAP)) 1609 goto exclude; 1610 1611 } else if (seg->s_ops == &segspt_shmops) { 1612 if (type & MAP_NORESERVE) { 1613 if (!(content & CC_CONTENT_DISM)) 1614 goto exclude; 1615 } else { 1616 if (!(content & CC_CONTENT_ISM)) 1617 goto exclude; 1618 } 1619 1620 } else if (seg->s_ops != &segvn_ops) { 1621 goto exclude; 1622 1623 } else if (type & MAP_SHARED) { 1624 if (shmgetid(p, saddr) != SHMID_NONE) { 1625 if (!(content & CC_CONTENT_SHM)) 1626 goto exclude; 1627 1628 } else if (SEGOP_GETVP(seg, seg->s_base, 1629 &mvp) != 0 || mvp == NULL || 1630 mvp->v_type != VREG) { 1631 if (!(content & CC_CONTENT_SHANON)) 1632 goto exclude; 1633 1634 } else { 1635 if (!(content & CC_CONTENT_SHFILE)) 1636 goto exclude; 1637 } 1638 1639 } else if (SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 || 1640 mvp == NULL || mvp->v_type != VREG) { 1641 if (!(content & CC_CONTENT_ANON)) 1642 goto exclude; 1643 1644 } else if (prot == (PROT_READ | PROT_EXEC)) { 1645 if (!(content & CC_CONTENT_TEXT)) 1646 goto exclude; 1647 1648 } else if (prot == PROT_READ) { 1649 if (!(content & CC_CONTENT_RODATA)) 1650 goto exclude; 1651 1652 } else { 1653 if (!(content & CC_CONTENT_DATA)) 1654 goto exclude; 1655 } 1656 1657 doffset = roundup(doffset, sizeof (Word)); 1658 v[i].p_offset = doffset; 1659 v[i].p_filesz = size; 1660 doffset += size; 1661 exclude: 1662 i++; 1663 } 1664 ASSERT(tmp == NULL); 1665 } 1666 AS_LOCK_EXIT(as, &as->a_lock); 1667 1668 if (overflow || i != nphdrs) { 1669 if (ntries++ == 0) { 1670 kmem_free(bigwad, bigsize); 1671 goto top; 1672 } 1673 cmn_err(CE_WARN, "elfcore: core dump failed for " 1674 "process %d; address space is changing", p->p_pid); 1675 error = EIO; 1676 goto done; 1677 } 1678 1679 if ((error = core_write(vp, UIO_SYSSPACE, poffset, 1680 v, phdrsz, rlimit, credp)) != 0) 1681 goto done; 1682 1683 if ((error = write_old_elfnotes(p, sig, vp, v[0].p_offset, rlimit, 1684 credp)) != 0) 1685 goto done; 1686 1687 if ((error = write_elfnotes(p, sig, vp, v[1].p_offset, rlimit, 1688 credp, content)) != 0) 1689 goto done; 1690 1691 for (i = 2; i < nphdrs; i++) { 1692 if (v[i].p_filesz == 0) 1693 continue; 1694 1695 /* 1696 * If dumping out this segment fails, rather than failing 1697 * the core dump entirely, we reset the size of the mapping 1698 * to zero to indicate that the data is absent from the core 1699 * file and or in the PF_SUNW_FAILURE flag to differentiate 1700 * this from mappings that were excluded due to the core file 1701 * content settings. 1702 */ 1703 if ((error = core_seg(p, vp, v[i].p_offset, 1704 (caddr_t)(uintptr_t)v[i].p_vaddr, v[i].p_filesz, 1705 rlimit, credp)) != 0) { 1706 1707 /* 1708 * Since the space reserved for the segment is now 1709 * unused, we stash the errno in the first four 1710 * bytes. This undocumented interface will let us 1711 * understand the nature of the failure. 1712 */ 1713 (void) core_write(vp, UIO_SYSSPACE, v[i].p_offset, 1714 &error, sizeof (error), rlimit, credp); 1715 1716 v[i].p_filesz = 0; 1717 v[i].p_flags |= PF_SUNW_FAILURE; 1718 if ((error = core_write(vp, UIO_SYSSPACE, 1719 poffset + sizeof (v[i]) * i, &v[i], sizeof (v[i]), 1720 rlimit, credp)) != 0) 1721 goto done; 1722 } 1723 } 1724 1725 if (nshdrs > 0) { 1726 bzero(&bigwad->shdr[0], shdrsz); 1727 1728 AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER); 1729 if ((error = process_scns(content, p, credp, vp, 1730 &bigwad->shdr[0], nshdrs, rlimit, &doffset, NULL)) != 0) { 1731 AS_LOCK_EXIT(as, &as->a_lock); 1732 goto done; 1733 } 1734 AS_LOCK_EXIT(as, &as->a_lock); 1735 1736 1737 if ((error = core_write(vp, UIO_SYSSPACE, soffset, 1738 &bigwad->shdr[0], shdrsz, rlimit, credp)) != 0) 1739 goto done; 1740 } 1741 1742 done: 1743 kmem_free(bigwad, bigsize); 1744 return (error); 1745 } 1746 1747 #ifndef _ELF32_COMPAT 1748 1749 static struct execsw esw = { 1750 #ifdef _LP64 1751 elf64magicstr, 1752 #else /* _LP64 */ 1753 elf32magicstr, 1754 #endif /* _LP64 */ 1755 0, 1756 5, 1757 elfexec, 1758 elfcore 1759 }; 1760 1761 static struct modlexec modlexec = { 1762 &mod_execops, "exec module for elf", &esw 1763 }; 1764 1765 #ifdef _LP64 1766 extern int elf32exec(vnode_t *vp, execa_t *uap, uarg_t *args, 1767 intpdata_t *idatap, int level, long *execsz, 1768 int setid, caddr_t exec_file, cred_t *cred); 1769 extern int elf32core(vnode_t *vp, proc_t *p, cred_t *credp, 1770 rlim64_t rlimit, int sig, core_content_t content); 1771 1772 static struct execsw esw32 = { 1773 elf32magicstr, 1774 0, 1775 5, 1776 elf32exec, 1777 elf32core 1778 }; 1779 1780 static struct modlexec modlexec32 = { 1781 &mod_execops, "32-bit exec module for elf", &esw32 1782 }; 1783 #endif /* _LP64 */ 1784 1785 static struct modlinkage modlinkage = { 1786 MODREV_1, 1787 (void *)&modlexec, 1788 #ifdef _LP64 1789 (void *)&modlexec32, 1790 #endif /* _LP64 */ 1791 NULL 1792 }; 1793 1794 int 1795 _init(void) 1796 { 1797 return (mod_install(&modlinkage)); 1798 } 1799 1800 int 1801 _fini(void) 1802 { 1803 return (mod_remove(&modlinkage)); 1804 } 1805 1806 int 1807 _info(struct modinfo *modinfop) 1808 { 1809 return (mod_info(&modlinkage, modinfop)); 1810 } 1811 1812 #endif /* !_ELF32_COMPAT */ 1813