1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 /* Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */ 28 /* All Rights Reserved */ 29 30 31 #pragma ident "%Z%%M% %I% %E% SMI" 32 33 #include <sys/types.h> 34 #include <sys/param.h> 35 #include <sys/thread.h> 36 #include <sys/sysmacros.h> 37 #include <sys/signal.h> 38 #include <sys/cred.h> 39 #include <sys/user.h> 40 #include <sys/errno.h> 41 #include <sys/vnode.h> 42 #include <sys/mman.h> 43 #include <sys/kmem.h> 44 #include <sys/proc.h> 45 #include <sys/pathname.h> 46 #include <sys/cmn_err.h> 47 #include <sys/systm.h> 48 #include <sys/elf.h> 49 #include <sys/vmsystm.h> 50 #include <sys/debug.h> 51 #include <sys/auxv.h> 52 #include <sys/exec.h> 53 #include <sys/prsystm.h> 54 #include <vm/as.h> 55 #include <vm/rm.h> 56 #include <vm/seg.h> 57 #include <vm/seg_vn.h> 58 #include <sys/modctl.h> 59 #include <sys/systeminfo.h> 60 #include <sys/vmparam.h> 61 #include <sys/machelf.h> 62 #include <sys/shm_impl.h> 63 #include <sys/archsystm.h> 64 #include <sys/fasttrap.h> 65 #include "elf_impl.h" 66 67 extern int at_flags; 68 69 #define ORIGIN_STR "ORIGIN" 70 #define ORIGIN_STR_SIZE 6 71 72 static int getelfhead(vnode_t *, cred_t *, Ehdr *, int *, int *, int *); 73 static int getelfphdr(vnode_t *, cred_t *, const Ehdr *, int, caddr_t *, 74 ssize_t *); 75 static int getelfshdr(vnode_t *, cred_t *, const Ehdr *, int, int, caddr_t *, 76 ssize_t *, caddr_t *, ssize_t *); 77 static size_t elfsize(Ehdr *, int, caddr_t, uintptr_t *); 78 static int mapelfexec(vnode_t *, Ehdr *, int, caddr_t, 79 Phdr **, Phdr **, Phdr **, Phdr **, Phdr *, 80 caddr_t *, caddr_t *, intptr_t *, size_t, long *, size_t *); 81 82 typedef enum { 83 STR_CTF, 84 STR_SYMTAB, 85 STR_DYNSYM, 86 STR_STRTAB, 87 STR_DYNSTR, 88 STR_SHSTRTAB, 89 STR_NUM 90 } shstrtype_t; 91 92 static const char *shstrtab_data[] = { 93 ".SUNW_ctf", 94 ".symtab", 95 ".dynsym", 96 ".strtab", 97 ".dynstr", 98 ".shstrtab" 99 }; 100 101 typedef struct shstrtab { 102 int sst_ndx[STR_NUM]; 103 int sst_cur; 104 } shstrtab_t; 105 106 static void 107 shstrtab_init(shstrtab_t *s) 108 { 109 bzero(&s->sst_ndx, sizeof (s->sst_ndx)); 110 s->sst_cur = 1; 111 } 112 113 static int 114 shstrtab_ndx(shstrtab_t *s, shstrtype_t type) 115 { 116 int ret; 117 118 if ((ret = s->sst_ndx[type]) != 0) 119 return (ret); 120 121 ret = s->sst_ndx[type] = s->sst_cur; 122 s->sst_cur += strlen(shstrtab_data[type]) + 1; 123 124 return (ret); 125 } 126 127 static size_t 128 shstrtab_size(const shstrtab_t *s) 129 { 130 return (s->sst_cur); 131 } 132 133 static void 134 shstrtab_dump(const shstrtab_t *s, char *buf) 135 { 136 int i, ndx; 137 138 *buf = '\0'; 139 for (i = 0; i < STR_NUM; i++) { 140 if ((ndx = s->sst_ndx[i]) != 0) 141 (void) strcpy(buf + ndx, shstrtab_data[i]); 142 } 143 } 144 145 static int 146 dtrace_safe_phdr(Phdr *phdrp, struct uarg *args, uintptr_t base) 147 { 148 ASSERT(phdrp->p_type == PT_SUNWDTRACE); 149 150 /* 151 * See the comment in fasttrap.h for information on how to safely 152 * update this program header. 153 */ 154 if (phdrp->p_memsz < PT_SUNWDTRACE_SIZE || 155 (phdrp->p_flags & (PF_R | PF_W | PF_X)) != (PF_R | PF_W | PF_X)) 156 return (-1); 157 158 args->thrptr = phdrp->p_vaddr + base; 159 160 return (0); 161 } 162 163 /*ARGSUSED*/ 164 int 165 elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap, 166 int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred) 167 { 168 caddr_t phdrbase = NULL; 169 caddr_t bssbase = 0; 170 caddr_t brkbase = 0; 171 size_t brksize = 0; 172 ssize_t dlnsize; 173 aux_entry_t *aux; 174 int error; 175 ssize_t resid; 176 int fd = -1; 177 intptr_t voffset; 178 Phdr *dyphdr = NULL; 179 Phdr *stphdr = NULL; 180 Phdr *uphdr = NULL; 181 Phdr *junk = NULL; 182 size_t len; 183 ssize_t phdrsize; 184 int postfixsize = 0; 185 int i, hsize; 186 Phdr *phdrp; 187 Phdr *dataphdrp = NULL; 188 Phdr *dtrphdr; 189 int hasu = 0; 190 int hasauxv = 0; 191 int hasdy = 0; 192 193 struct proc *p = ttoproc(curthread); 194 struct user *up = PTOU(p); 195 struct bigwad { 196 Ehdr ehdr; 197 aux_entry_t elfargs[__KERN_NAUXV_IMPL]; 198 char dl_name[MAXPATHLEN]; 199 char pathbuf[MAXPATHLEN]; 200 struct vattr vattr; 201 struct execenv exenv; 202 } *bigwad; /* kmem_alloc this behemoth so we don't blow stack */ 203 Ehdr *ehdrp; 204 int nshdrs, shstrndx, nphdrs; 205 char *dlnp; 206 char *pathbufp; 207 rlim64_t limit; 208 rlim64_t roundlimit; 209 210 ASSERT(p->p_model == DATAMODEL_ILP32 || p->p_model == DATAMODEL_LP64); 211 212 bigwad = kmem_alloc(sizeof (struct bigwad), KM_SLEEP); 213 ehdrp = &bigwad->ehdr; 214 dlnp = bigwad->dl_name; 215 pathbufp = bigwad->pathbuf; 216 217 /* 218 * Obtain ELF and program header information. 219 */ 220 if ((error = getelfhead(vp, CRED(), ehdrp, &nshdrs, &shstrndx, 221 &nphdrs)) != 0 || 222 (error = getelfphdr(vp, CRED(), ehdrp, nphdrs, &phdrbase, 223 &phdrsize)) != 0) 224 goto out; 225 226 /* 227 * Prevent executing an ELF file that has no entry point. 228 */ 229 if (ehdrp->e_entry == 0) { 230 uprintf("%s: Bad entry point\n", exec_file); 231 goto bad; 232 } 233 234 /* 235 * Put data model that we're exec-ing to into the args passed to 236 * exec_args(), so it will know what it is copying to on new stack. 237 * Now that we know whether we are exec-ing a 32-bit or 64-bit 238 * executable, we can set execsz with the appropriate NCARGS. 239 */ 240 #ifdef _LP64 241 if (ehdrp->e_ident[EI_CLASS] == ELFCLASS32) { 242 args->to_model = DATAMODEL_ILP32; 243 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS32-1); 244 } else { 245 args->to_model = DATAMODEL_LP64; 246 args->stk_prot &= ~PROT_EXEC; 247 #if defined(__i386) || defined(__amd64) 248 args->dat_prot &= ~PROT_EXEC; 249 #endif 250 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS64-1); 251 } 252 #else /* _LP64 */ 253 args->to_model = DATAMODEL_ILP32; 254 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS-1); 255 #endif /* _LP64 */ 256 257 /* 258 * Determine aux size now so that stack can be built 259 * in one shot (except actual copyout of aux image), 260 * determine any non-default stack protections, 261 * and still have this code be machine independent. 262 */ 263 hsize = ehdrp->e_phentsize; 264 phdrp = (Phdr *)phdrbase; 265 for (i = nphdrs; i > 0; i--) { 266 switch (phdrp->p_type) { 267 case PT_INTERP: 268 hasauxv = hasdy = 1; 269 break; 270 case PT_PHDR: 271 hasu = 1; 272 break; 273 case PT_SUNWSTACK: 274 args->stk_prot = PROT_USER; 275 if (phdrp->p_flags & PF_R) 276 args->stk_prot |= PROT_READ; 277 if (phdrp->p_flags & PF_W) 278 args->stk_prot |= PROT_WRITE; 279 if (phdrp->p_flags & PF_X) 280 args->stk_prot |= PROT_EXEC; 281 break; 282 case PT_LOAD: 283 dataphdrp = phdrp; 284 break; 285 } 286 phdrp = (Phdr *)((caddr_t)phdrp + hsize); 287 } 288 289 if (ehdrp->e_type != ET_EXEC) { 290 dataphdrp = NULL; 291 hasauxv = 1; 292 } 293 294 /* Copy BSS permissions to args->dat_prot */ 295 if (dataphdrp != NULL) { 296 args->dat_prot = PROT_USER; 297 if (dataphdrp->p_flags & PF_R) 298 args->dat_prot |= PROT_READ; 299 if (dataphdrp->p_flags & PF_W) 300 args->dat_prot |= PROT_WRITE; 301 if (dataphdrp->p_flags & PF_X) 302 args->dat_prot |= PROT_EXEC; 303 } 304 305 /* 306 * If a auxvector will be required - reserve the space for 307 * it now. This may be increased by exec_args if there are 308 * ISA-specific types (included in __KERN_NAUXV_IMPL). 309 */ 310 if (hasauxv) { 311 /* 312 * If a AUX vector is being built - the base AUX 313 * entries are: 314 * 315 * AT_BASE 316 * AT_FLAGS 317 * AT_PAGESZ 318 * AT_SUN_LDSECURE 319 * AT_SUN_HWCAP 320 * AT_SUN_PLATFORM 321 * AT_SUN_EXECNAME 322 * AT_NULL 323 * 324 * total == 8 325 */ 326 if (hasdy && hasu) { 327 /* 328 * Has PT_INTERP & PT_PHDR - the auxvectors that 329 * will be built are: 330 * 331 * AT_PHDR 332 * AT_PHENT 333 * AT_PHNUM 334 * AT_ENTRY 335 * AT_LDDATA 336 * 337 * total = 5 338 */ 339 args->auxsize = (8 + 5) * sizeof (aux_entry_t); 340 } else if (hasdy) { 341 /* 342 * Has PT_INTERP but no PT_PHDR 343 * 344 * AT_EXECFD 345 * AT_LDDATA 346 * 347 * total = 2 348 */ 349 args->auxsize = (8 + 2) * sizeof (aux_entry_t); 350 } else { 351 args->auxsize = 8 * sizeof (aux_entry_t); 352 } 353 } else 354 args->auxsize = 0; 355 356 aux = bigwad->elfargs; 357 /* 358 * Move args to the user's stack. 359 */ 360 if ((error = exec_args(uap, args, idatap, (void **)&aux)) != 0) { 361 if (error == -1) { 362 error = ENOEXEC; 363 goto bad; 364 } 365 goto out; 366 } 367 368 /* 369 * If this is an ET_DYN executable (shared object), 370 * determine its memory size so that mapelfexec() can load it. 371 */ 372 if (ehdrp->e_type == ET_DYN) 373 len = elfsize(ehdrp, nphdrs, phdrbase, NULL); 374 else 375 len = 0; 376 377 dtrphdr = NULL; 378 379 if ((error = mapelfexec(vp, ehdrp, nphdrs, phdrbase, &uphdr, &dyphdr, 380 &stphdr, &dtrphdr, dataphdrp, &bssbase, &brkbase, &voffset, len, 381 execsz, &brksize)) != 0) 382 goto bad; 383 384 if (uphdr != NULL && dyphdr == NULL) 385 goto bad; 386 387 if (dtrphdr != NULL && dtrace_safe_phdr(dtrphdr, args, voffset) != 0) { 388 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, exec_file); 389 goto bad; 390 } 391 392 if (dyphdr != NULL) { 393 size_t len; 394 uintptr_t lddata; 395 char *p; 396 struct vnode *nvp; 397 398 dlnsize = dyphdr->p_filesz; 399 400 if (dlnsize > MAXPATHLEN || dlnsize <= 0) 401 goto bad; 402 403 /* 404 * Read in "interpreter" pathname. 405 */ 406 if ((error = vn_rdwr(UIO_READ, vp, dlnp, dyphdr->p_filesz, 407 (offset_t)dyphdr->p_offset, UIO_SYSSPACE, 0, (rlim64_t)0, 408 CRED(), &resid)) != 0) { 409 uprintf("%s: Cannot obtain interpreter pathname\n", 410 exec_file); 411 goto bad; 412 } 413 414 if (resid != 0 || dlnp[dlnsize - 1] != '\0') 415 goto bad; 416 417 /* 418 * Search for '$ORIGIN' token in interpreter path. 419 * If found, expand it. 420 */ 421 for (p = dlnp; p = strchr(p, '$'); ) { 422 uint_t len, curlen; 423 char *_ptr; 424 425 if (strncmp(++p, ORIGIN_STR, ORIGIN_STR_SIZE)) 426 continue; 427 428 curlen = 0; 429 len = p - dlnp - 1; 430 if (len) { 431 bcopy(dlnp, pathbufp, len); 432 curlen += len; 433 } 434 if (_ptr = strrchr(args->pathname, '/')) { 435 len = _ptr - args->pathname; 436 if ((curlen + len) > MAXPATHLEN) 437 break; 438 439 bcopy(args->pathname, &pathbufp[curlen], len); 440 curlen += len; 441 } else { 442 /* 443 * executable is a basename found in the 444 * current directory. So - just substitue 445 * '.' for ORIGIN. 446 */ 447 pathbufp[curlen] = '.'; 448 curlen++; 449 } 450 p += ORIGIN_STR_SIZE; 451 len = strlen(p); 452 453 if ((curlen + len) > MAXPATHLEN) 454 break; 455 bcopy(p, &pathbufp[curlen], len); 456 curlen += len; 457 pathbufp[curlen++] = '\0'; 458 bcopy(pathbufp, dlnp, curlen); 459 } 460 461 /* 462 * /usr/lib/ld.so.1 is known to be a symlink to /lib/ld.so.1 463 * (and /usr/lib/64/ld.so.1 is a symlink to /lib/64/ld.so.1). 464 * Just in case /usr is not mounted, change it now. 465 */ 466 if (strcmp(dlnp, USR_LIB_RTLD) == 0) 467 dlnp += 4; 468 error = lookupname(dlnp, UIO_SYSSPACE, FOLLOW, NULLVPP, &nvp); 469 if (error && dlnp != bigwad->dl_name) { 470 /* new kernel, old user-level */ 471 error = lookupname(dlnp -= 4, UIO_SYSSPACE, FOLLOW, 472 NULLVPP, &nvp); 473 } 474 if (error) { 475 uprintf("%s: Cannot find %s\n", exec_file, dlnp); 476 goto bad; 477 } 478 479 /* 480 * Setup the "aux" vector. 481 */ 482 if (uphdr) { 483 if (ehdrp->e_type == ET_DYN) { 484 /* don't use the first page */ 485 bigwad->exenv.ex_brkbase = (caddr_t)PAGESIZE; 486 bigwad->exenv.ex_bssbase = (caddr_t)PAGESIZE; 487 } else { 488 bigwad->exenv.ex_bssbase = bssbase; 489 bigwad->exenv.ex_brkbase = brkbase; 490 } 491 bigwad->exenv.ex_brksize = brksize; 492 bigwad->exenv.ex_magic = elfmagic; 493 bigwad->exenv.ex_vp = vp; 494 setexecenv(&bigwad->exenv); 495 496 ADDAUX(aux, AT_PHDR, uphdr->p_vaddr + voffset) 497 ADDAUX(aux, AT_PHENT, ehdrp->e_phentsize) 498 ADDAUX(aux, AT_PHNUM, nphdrs) 499 ADDAUX(aux, AT_ENTRY, ehdrp->e_entry + voffset) 500 } else { 501 if ((error = execopen(&vp, &fd)) != 0) { 502 VN_RELE(nvp); 503 goto bad; 504 } 505 506 ADDAUX(aux, AT_EXECFD, fd) 507 } 508 509 if ((error = execpermissions(nvp, &bigwad->vattr, args)) != 0) { 510 VN_RELE(nvp); 511 uprintf("%s: Cannot execute %s\n", exec_file, dlnp); 512 goto bad; 513 } 514 515 /* 516 * Now obtain the ELF header along with the entire program 517 * header contained in "nvp". 518 */ 519 kmem_free(phdrbase, phdrsize); 520 phdrbase = NULL; 521 if ((error = getelfhead(nvp, CRED(), ehdrp, &nshdrs, 522 &shstrndx, &nphdrs)) != 0 || 523 (error = getelfphdr(nvp, CRED(), ehdrp, nphdrs, &phdrbase, 524 &phdrsize)) != 0) { 525 VN_RELE(nvp); 526 uprintf("%s: Cannot read %s\n", exec_file, dlnp); 527 goto bad; 528 } 529 530 /* 531 * Determine memory size of the "interpreter's" loadable 532 * sections. This size is then used to obtain the virtual 533 * address of a hole, in the user's address space, large 534 * enough to map the "interpreter". 535 */ 536 if ((len = elfsize(ehdrp, nphdrs, phdrbase, &lddata)) == 0) { 537 VN_RELE(nvp); 538 uprintf("%s: Nothing to load in %s\n", exec_file, dlnp); 539 goto bad; 540 } 541 542 dtrphdr = NULL; 543 544 error = mapelfexec(nvp, ehdrp, nphdrs, phdrbase, &junk, &junk, 545 &junk, &dtrphdr, NULL, NULL, NULL, &voffset, len, execsz, 546 NULL); 547 if (error || junk != NULL) { 548 VN_RELE(nvp); 549 uprintf("%s: Cannot map %s\n", exec_file, dlnp); 550 goto bad; 551 } 552 553 /* 554 * We use the DTrace program header to initialize the 555 * architecture-specific user per-LWP location. The dtrace 556 * fasttrap provider requires ready access to per-LWP scratch 557 * space. We assume that there is only one such program header 558 * in the interpreter. 559 */ 560 if (dtrphdr != NULL && 561 dtrace_safe_phdr(dtrphdr, args, voffset) != 0) { 562 VN_RELE(nvp); 563 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, dlnp); 564 goto bad; 565 } 566 567 VN_RELE(nvp); 568 ADDAUX(aux, AT_SUN_LDDATA, voffset + lddata) 569 } 570 571 if (hasauxv) { 572 int auxf = AF_SUN_HWCAPVERIFY; 573 /* 574 * Note: AT_SUN_PLATFORM was filled in via exec_args() 575 */ 576 ADDAUX(aux, AT_BASE, voffset) 577 ADDAUX(aux, AT_FLAGS, at_flags) 578 ADDAUX(aux, AT_PAGESZ, PAGESIZE) 579 /* 580 * Linker flags. (security) 581 * p_flag not yet set at this time. 582 * We rely on gexec() to provide us with the information. 583 * If the application is set-uid but this is not reflected 584 * in a mismatch between real/effective uids/gids, then 585 * don't treat this as a set-uid exec. So we care about 586 * the EXECSETID_UGIDS flag but not the ...SETID flag. 587 */ 588 setid &= ~EXECSETID_SETID; 589 ADDAUX(aux, AT_SUN_AUXFLAGS, 590 setid ? AF_SUN_SETUGID | auxf : auxf); 591 /* 592 * Hardware capability flag word (performance hints) 593 * Used for choosing faster library routines. 594 * (Potentially different between 32-bit and 64-bit ABIs) 595 */ 596 #if defined(_LP64) 597 if (args->to_model == DATAMODEL_NATIVE) 598 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap) 599 else 600 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap32) 601 #else 602 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap) 603 #endif 604 ADDAUX(aux, AT_NULL, 0) 605 postfixsize = (char *)aux - (char *)bigwad->elfargs; 606 ASSERT(postfixsize == args->auxsize); 607 ASSERT(postfixsize <= __KERN_NAUXV_IMPL * sizeof (aux_entry_t)); 608 } 609 610 /* 611 * For the 64-bit kernel, the limit is big enough that rounding it up 612 * to a page can overflow the 64-bit limit, so we check for btopr() 613 * overflowing here by comparing it with the unrounded limit in pages. 614 * If it hasn't overflowed, compare the exec size with the rounded up 615 * limit in pages. Otherwise, just compare with the unrounded limit. 616 */ 617 limit = btop(p->p_vmem_ctl); 618 roundlimit = btopr(p->p_vmem_ctl); 619 if ((roundlimit > limit && *execsz > roundlimit) || 620 (roundlimit < limit && *execsz > limit)) { 621 mutex_enter(&p->p_lock); 622 (void) rctl_action(rctlproc_legacy[RLIMIT_VMEM], p->p_rctls, p, 623 RCA_SAFE); 624 mutex_exit(&p->p_lock); 625 error = ENOMEM; 626 goto bad; 627 } 628 629 bzero(up->u_auxv, sizeof (up->u_auxv)); 630 if (postfixsize) { 631 int num_auxv; 632 633 /* 634 * Copy the aux vector to the user stack. 635 */ 636 error = execpoststack(args, bigwad->elfargs, postfixsize); 637 if (error) 638 goto bad; 639 640 /* 641 * Copy auxv to the process's user structure for use by /proc. 642 */ 643 num_auxv = postfixsize / sizeof (aux_entry_t); 644 ASSERT(num_auxv <= sizeof (up->u_auxv) / sizeof (auxv_t)); 645 aux = bigwad->elfargs; 646 for (i = 0; i < num_auxv; i++) { 647 up->u_auxv[i].a_type = aux[i].a_type; 648 up->u_auxv[i].a_un.a_val = (aux_val_t)aux[i].a_un.a_val; 649 } 650 } 651 652 /* 653 * Pass back the starting address so we can set the program counter. 654 */ 655 args->entry = (uintptr_t)(ehdrp->e_entry + voffset); 656 657 if (!uphdr) { 658 if (ehdrp->e_type == ET_DYN) { 659 /* 660 * If we are executing a shared library which doesn't 661 * have a interpreter (probably ld.so.1) then 662 * we don't set the brkbase now. Instead we 663 * delay it's setting until the first call 664 * via grow.c::brk(). This permits ld.so.1 to 665 * initialize brkbase to the tail of the executable it 666 * loads (which is where it needs to be). 667 */ 668 bigwad->exenv.ex_brkbase = (caddr_t)0; 669 bigwad->exenv.ex_bssbase = (caddr_t)0; 670 bigwad->exenv.ex_brksize = 0; 671 } else { 672 bigwad->exenv.ex_brkbase = brkbase; 673 bigwad->exenv.ex_bssbase = bssbase; 674 bigwad->exenv.ex_brksize = brksize; 675 } 676 bigwad->exenv.ex_magic = elfmagic; 677 bigwad->exenv.ex_vp = vp; 678 setexecenv(&bigwad->exenv); 679 } 680 681 ASSERT(error == 0); 682 goto out; 683 684 bad: 685 if (fd != -1) /* did we open the a.out yet */ 686 (void) execclose(fd); 687 688 psignal(p, SIGKILL); 689 690 if (error == 0) 691 error = ENOEXEC; 692 out: 693 if (phdrbase != NULL) 694 kmem_free(phdrbase, phdrsize); 695 kmem_free(bigwad, sizeof (struct bigwad)); 696 return (error); 697 } 698 699 /* 700 * Compute the memory size requirement for the ELF file. 701 */ 702 static size_t 703 elfsize(Ehdr *ehdrp, int nphdrs, caddr_t phdrbase, uintptr_t *lddata) 704 { 705 size_t len; 706 Phdr *phdrp = (Phdr *)phdrbase; 707 int hsize = ehdrp->e_phentsize; 708 int first = 1; 709 int dfirst = 1; /* first data segment */ 710 uintptr_t loaddr = 0; 711 uintptr_t hiaddr = 0; 712 uintptr_t lo, hi; 713 int i; 714 715 for (i = nphdrs; i > 0; i--) { 716 if (phdrp->p_type == PT_LOAD) { 717 lo = phdrp->p_vaddr; 718 hi = lo + phdrp->p_memsz; 719 if (first) { 720 loaddr = lo; 721 hiaddr = hi; 722 first = 0; 723 } else { 724 if (loaddr > lo) 725 loaddr = lo; 726 if (hiaddr < hi) 727 hiaddr = hi; 728 } 729 730 /* 731 * save the address of the first data segment 732 * of a object - used for the AT_SUNW_LDDATA 733 * aux entry. 734 */ 735 if ((lddata != NULL) && dfirst && 736 (phdrp->p_flags & PF_W)) { 737 *lddata = lo; 738 dfirst = 0; 739 } 740 } 741 phdrp = (Phdr *)((caddr_t)phdrp + hsize); 742 } 743 744 len = hiaddr - (loaddr & PAGEMASK); 745 len = roundup(len, PAGESIZE); 746 747 return (len); 748 } 749 750 /* 751 * Read in the ELF header and program header table. 752 * SUSV3 requires: 753 * ENOEXEC File format is not recognized 754 * EINVAL Format recognized but execution not supported 755 */ 756 static int 757 getelfhead(vnode_t *vp, cred_t *credp, Ehdr *ehdr, int *nshdrs, int *shstrndx, 758 int *nphdrs) 759 { 760 int error; 761 ssize_t resid; 762 763 /* 764 * We got here by the first two bytes in ident, 765 * now read the entire ELF header. 766 */ 767 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)ehdr, 768 sizeof (Ehdr), (offset_t)0, UIO_SYSSPACE, 0, 769 (rlim64_t)0, credp, &resid)) != 0) 770 return (error); 771 772 /* 773 * Since a separate version is compiled for handling 32-bit and 774 * 64-bit ELF executables on a 64-bit kernel, the 64-bit version 775 * doesn't need to be able to deal with 32-bit ELF files. 776 */ 777 if (resid != 0 || 778 ehdr->e_ident[EI_MAG2] != ELFMAG2 || 779 ehdr->e_ident[EI_MAG3] != ELFMAG3) 780 return (ENOEXEC); 781 782 if ((ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) || 783 #if defined(_ILP32) || defined(_ELF32_COMPAT) 784 ehdr->e_ident[EI_CLASS] != ELFCLASS32 || 785 #else 786 ehdr->e_ident[EI_CLASS] != ELFCLASS64 || 787 #endif 788 !elfheadcheck(ehdr->e_ident[EI_DATA], ehdr->e_machine, 789 ehdr->e_flags)) 790 return (EINVAL); 791 792 *nshdrs = ehdr->e_shnum; 793 *shstrndx = ehdr->e_shstrndx; 794 *nphdrs = ehdr->e_phnum; 795 796 /* 797 * If e_shnum, e_shstrndx, or e_phnum is its sentinel value, we need 798 * to read in the section header at index zero to acces the true 799 * values for those fields. 800 */ 801 if ((*nshdrs == 0 && ehdr->e_shoff != 0) || 802 *shstrndx == SHN_XINDEX || *nphdrs == PN_XNUM) { 803 Shdr shdr; 804 805 if (ehdr->e_shoff == 0) 806 return (EINVAL); 807 808 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)&shdr, 809 sizeof (shdr), (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, 810 (rlim64_t)0, credp, &resid)) != 0) 811 return (error); 812 813 if (*nshdrs == 0) 814 *nshdrs = shdr.sh_size; 815 if (*shstrndx == SHN_XINDEX) 816 *shstrndx = shdr.sh_link; 817 if (*nphdrs == PN_XNUM && shdr.sh_info != 0) 818 *nphdrs = shdr.sh_info; 819 } 820 821 return (0); 822 } 823 824 #ifdef _ELF32_COMPAT 825 extern size_t elf_nphdr_max; 826 #else 827 size_t elf_nphdr_max = 1000; 828 #endif 829 830 static int 831 getelfphdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, int nphdrs, 832 caddr_t *phbasep, ssize_t *phsizep) 833 { 834 ssize_t resid, minsize; 835 int err; 836 837 /* 838 * Since we're going to be using e_phentsize to iterate down the 839 * array of program headers, it must be 8-byte aligned or else 840 * a we might cause a misaligned access. We use all members through 841 * p_flags on 32-bit ELF files and p_memsz on 64-bit ELF files so 842 * e_phentsize must be at least large enough to include those 843 * members. 844 */ 845 #if !defined(_LP64) || defined(_ELF32_COMPAT) 846 minsize = offsetof(Phdr, p_flags) + sizeof (((Phdr *)NULL)->p_flags); 847 #else 848 minsize = offsetof(Phdr, p_memsz) + sizeof (((Phdr *)NULL)->p_memsz); 849 #endif 850 if (ehdr->e_phentsize < minsize || (ehdr->e_phentsize & 3)) 851 return (EINVAL); 852 853 *phsizep = nphdrs * ehdr->e_phentsize; 854 855 if (*phsizep > sizeof (Phdr) * elf_nphdr_max) { 856 if ((*phbasep = kmem_alloc(*phsizep, KM_NOSLEEP)) == NULL) 857 return (ENOMEM); 858 } else { 859 *phbasep = kmem_alloc(*phsizep, KM_SLEEP); 860 } 861 862 if ((err = vn_rdwr(UIO_READ, vp, *phbasep, *phsizep, 863 (offset_t)ehdr->e_phoff, UIO_SYSSPACE, 0, (rlim64_t)0, 864 credp, &resid)) != 0) { 865 kmem_free(*phbasep, *phsizep); 866 *phbasep = NULL; 867 return (err); 868 } 869 870 return (0); 871 } 872 873 #ifdef _ELF32_COMPAT 874 extern size_t elf_nshdr_max; 875 extern size_t elf_shstrtab_max; 876 #else 877 size_t elf_nshdr_max = 10000; 878 size_t elf_shstrtab_max = 100 * 1024; 879 #endif 880 881 882 static int 883 getelfshdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, 884 int nshdrs, int shstrndx, caddr_t *shbasep, ssize_t *shsizep, 885 char **shstrbasep, ssize_t *shstrsizep) 886 { 887 ssize_t resid, minsize; 888 int err; 889 Shdr *shdr; 890 891 /* 892 * Since we're going to be using e_shentsize to iterate down the 893 * array of section headers, it must be 8-byte aligned or else 894 * a we might cause a misaligned access. We use all members through 895 * sh_entsize (on both 32- and 64-bit ELF files) so e_shentsize 896 * must be at least large enough to include that member. The index 897 * of the string table section must also be valid. 898 */ 899 minsize = offsetof(Shdr, sh_entsize) + sizeof (shdr->sh_entsize); 900 if (ehdr->e_shentsize < minsize || (ehdr->e_shentsize & 3) || 901 shstrndx >= nshdrs) 902 return (EINVAL); 903 904 *shsizep = nshdrs * ehdr->e_shentsize; 905 906 if (*shsizep > sizeof (Shdr) * elf_nshdr_max) { 907 if ((*shbasep = kmem_alloc(*shsizep, KM_NOSLEEP)) == NULL) 908 return (ENOMEM); 909 } else { 910 *shbasep = kmem_alloc(*shsizep, KM_SLEEP); 911 } 912 913 if ((err = vn_rdwr(UIO_READ, vp, *shbasep, *shsizep, 914 (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, (rlim64_t)0, 915 credp, &resid)) != 0) { 916 kmem_free(*shbasep, *shsizep); 917 return (err); 918 } 919 920 /* 921 * Pull the section string table out of the vnode; fail if the size 922 * is zero. 923 */ 924 shdr = (Shdr *)(*shbasep + shstrndx * ehdr->e_shentsize); 925 if ((*shstrsizep = shdr->sh_size) == 0) { 926 kmem_free(*shbasep, *shsizep); 927 return (EINVAL); 928 } 929 930 if (*shstrsizep > elf_shstrtab_max) { 931 if ((*shstrbasep = kmem_alloc(*shstrsizep, 932 KM_NOSLEEP)) == NULL) { 933 kmem_free(*shbasep, *shsizep); 934 return (ENOMEM); 935 } 936 } else { 937 *shstrbasep = kmem_alloc(*shstrsizep, KM_SLEEP); 938 } 939 940 if ((err = vn_rdwr(UIO_READ, vp, *shstrbasep, *shstrsizep, 941 (offset_t)shdr->sh_offset, UIO_SYSSPACE, 0, (rlim64_t)0, 942 credp, &resid)) != 0) { 943 kmem_free(*shbasep, *shsizep); 944 kmem_free(*shstrbasep, *shstrsizep); 945 return (err); 946 } 947 948 /* 949 * Make sure the strtab is null-terminated to make sure we 950 * don't run off the end of the table. 951 */ 952 (*shstrbasep)[*shstrsizep - 1] = '\0'; 953 954 return (0); 955 } 956 957 static int 958 mapelfexec( 959 vnode_t *vp, 960 Ehdr *ehdr, 961 int nphdrs, 962 caddr_t phdrbase, 963 Phdr **uphdr, 964 Phdr **dyphdr, 965 Phdr **stphdr, 966 Phdr **dtphdr, 967 Phdr *dataphdrp, 968 caddr_t *bssbase, 969 caddr_t *brkbase, 970 intptr_t *voffset, 971 size_t len, 972 long *execsz, 973 size_t *brksize) 974 { 975 Phdr *phdr; 976 int i, prot, error; 977 caddr_t addr; 978 size_t zfodsz; 979 int ptload = 0; 980 int page; 981 off_t offset; 982 int hsize = ehdr->e_phentsize; 983 984 if (ehdr->e_type == ET_DYN) { 985 /* 986 * Obtain the virtual address of a hole in the 987 * address space to map the "interpreter". 988 */ 989 map_addr(&addr, len, (offset_t)0, 1, 0); 990 if (addr == NULL) 991 return (ENOMEM); 992 *voffset = (intptr_t)addr; 993 } else { 994 *voffset = 0; 995 } 996 phdr = (Phdr *)phdrbase; 997 for (i = nphdrs; i > 0; i--) { 998 switch (phdr->p_type) { 999 case PT_LOAD: 1000 if ((*dyphdr != NULL) && (*uphdr == NULL)) 1001 return (0); 1002 1003 ptload = 1; 1004 prot = PROT_USER; 1005 if (phdr->p_flags & PF_R) 1006 prot |= PROT_READ; 1007 if (phdr->p_flags & PF_W) 1008 prot |= PROT_WRITE; 1009 if (phdr->p_flags & PF_X) 1010 prot |= PROT_EXEC; 1011 1012 addr = (caddr_t)((uintptr_t)phdr->p_vaddr + *voffset); 1013 zfodsz = (size_t)phdr->p_memsz - phdr->p_filesz; 1014 1015 offset = phdr->p_offset; 1016 if (((uintptr_t)offset & PAGEOFFSET) == 1017 ((uintptr_t)addr & PAGEOFFSET) && 1018 (!(vp->v_flag & VNOMAP))) { 1019 page = 1; 1020 } else { 1021 page = 0; 1022 } 1023 1024 if (curproc->p_brkpageszc != 0 && phdr == dataphdrp && 1025 (prot & PROT_WRITE)) { 1026 /* 1027 * segvn only uses large pages for segments 1028 * that have the requested large page size 1029 * aligned base and size. To insure the part 1030 * of bss that starts at heap large page size 1031 * boundary gets mapped by large pages create 1032 * 2 bss segvn segments which is accomplished 1033 * by calling execmap twice. First execmap 1034 * will create the bss segvn segment that is 1035 * before the large page boundary and it will 1036 * be mapped with base pages. If bss start is 1037 * already large page aligned only 1 bss 1038 * segment will be created. The second bss 1039 * segment's size is large page size aligned 1040 * so that segvn uses large pages for that 1041 * segment and it also makes the heap that 1042 * starts right after bss to start at large 1043 * page boundary. 1044 */ 1045 uint_t szc = curproc->p_brkpageszc; 1046 size_t pgsz = page_get_pagesize(szc); 1047 caddr_t zaddr = addr + phdr->p_filesz; 1048 size_t zlen = P2NPHASE((uintptr_t)zaddr, pgsz); 1049 1050 ASSERT(pgsz > PAGESIZE); 1051 1052 if (error = execmap(vp, addr, phdr->p_filesz, 1053 zlen, phdr->p_offset, prot, page, szc)) 1054 goto bad; 1055 if (zfodsz > zlen) { 1056 zfodsz -= zlen; 1057 zaddr += zlen; 1058 zlen = P2ROUNDUP(zfodsz, pgsz); 1059 if (error = execmap(vp, zaddr, 0, zlen, 1060 phdr->p_offset, prot, page, szc)) 1061 goto bad; 1062 } 1063 if (brksize != NULL) 1064 *brksize = zlen - zfodsz; 1065 } else { 1066 if (error = execmap(vp, addr, phdr->p_filesz, 1067 zfodsz, phdr->p_offset, prot, page, 0)) 1068 goto bad; 1069 } 1070 1071 if (bssbase != NULL && addr >= *bssbase && 1072 phdr == dataphdrp) { 1073 *bssbase = addr + phdr->p_filesz; 1074 } 1075 if (brkbase != NULL && addr >= *brkbase) { 1076 *brkbase = addr + phdr->p_memsz; 1077 } 1078 1079 *execsz += btopr(phdr->p_memsz); 1080 break; 1081 1082 case PT_INTERP: 1083 if (ptload) 1084 goto bad; 1085 *dyphdr = phdr; 1086 break; 1087 1088 case PT_SHLIB: 1089 *stphdr = phdr; 1090 break; 1091 1092 case PT_PHDR: 1093 if (ptload) 1094 goto bad; 1095 *uphdr = phdr; 1096 break; 1097 1098 case PT_NULL: 1099 case PT_DYNAMIC: 1100 case PT_NOTE: 1101 break; 1102 1103 case PT_SUNWDTRACE: 1104 if (dtphdr != NULL) 1105 *dtphdr = phdr; 1106 break; 1107 1108 default: 1109 break; 1110 } 1111 phdr = (Phdr *)((caddr_t)phdr + hsize); 1112 } 1113 return (0); 1114 bad: 1115 if (error == 0) 1116 error = EINVAL; 1117 return (error); 1118 } 1119 1120 int 1121 elfnote(vnode_t *vp, offset_t *offsetp, int type, int descsz, void *desc, 1122 rlim64_t rlimit, cred_t *credp) 1123 { 1124 Note note; 1125 int error; 1126 1127 bzero(¬e, sizeof (note)); 1128 bcopy("CORE", note.name, 4); 1129 note.nhdr.n_type = type; 1130 /* 1131 * The System V ABI states that n_namesz must be the length of the 1132 * string that follows the Nhdr structure including the terminating 1133 * null. The ABI also specifies that sufficient padding should be 1134 * included so that the description that follows the name string 1135 * begins on a 4- or 8-byte boundary for 32- and 64-bit binaries 1136 * respectively. However, since this change was not made correctly 1137 * at the time of the 64-bit port, both 32- and 64-bit binaries 1138 * descriptions are only guaranteed to begin on a 4-byte boundary. 1139 */ 1140 note.nhdr.n_namesz = 5; 1141 note.nhdr.n_descsz = roundup(descsz, sizeof (Word)); 1142 1143 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, ¬e, 1144 sizeof (note), rlimit, credp)) 1145 return (error); 1146 1147 *offsetp += sizeof (note); 1148 1149 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, desc, 1150 note.nhdr.n_descsz, rlimit, credp)) 1151 return (error); 1152 1153 *offsetp += note.nhdr.n_descsz; 1154 return (0); 1155 } 1156 1157 /* 1158 * Copy the section data from one vnode to the section of another vnode. 1159 */ 1160 static void 1161 copy_scn(Shdr *src, vnode_t *src_vp, Shdr *dst, vnode_t *dst_vp, Off *doffset, 1162 void *buf, size_t size, cred_t *credp, rlim64_t rlimit) 1163 { 1164 ssize_t resid; 1165 size_t len, n = src->sh_size; 1166 offset_t off = 0; 1167 1168 while (n != 0) { 1169 len = MIN(size, n); 1170 if (vn_rdwr(UIO_READ, src_vp, buf, len, src->sh_offset + off, 1171 UIO_SYSSPACE, 0, (rlim64_t)0, credp, &resid) != 0 || 1172 resid >= len || 1173 core_write(dst_vp, UIO_SYSSPACE, *doffset + off, 1174 buf, len - resid, rlimit, credp) != 0) { 1175 dst->sh_size = 0; 1176 dst->sh_offset = 0; 1177 return; 1178 } 1179 1180 ASSERT(n >= len - resid); 1181 1182 n -= len - resid; 1183 off += len - resid; 1184 } 1185 1186 *doffset += src->sh_size; 1187 } 1188 1189 #ifdef _ELF32_COMPAT 1190 extern size_t elf_datasz_max; 1191 #else 1192 size_t elf_datasz_max = 1 * 1024 * 1024; 1193 #endif 1194 1195 /* 1196 * This function processes mappings that correspond to load objects to 1197 * examine their respective sections for elfcore(). It's called once with 1198 * v set to NULL to count the number of sections that we're going to need 1199 * and then again with v set to some allocated buffer that we fill in with 1200 * all the section data. 1201 */ 1202 static int 1203 process_scns(core_content_t content, proc_t *p, cred_t *credp, vnode_t *vp, 1204 Shdr *v, int nv, rlim64_t rlimit, Off *doffsetp, int *nshdrsp) 1205 { 1206 vnode_t *lastvp = NULL; 1207 struct seg *seg; 1208 int i, j; 1209 void *data = NULL; 1210 size_t datasz = 0; 1211 shstrtab_t shstrtab; 1212 struct as *as = p->p_as; 1213 int error = 0; 1214 1215 if (v != NULL) 1216 shstrtab_init(&shstrtab); 1217 1218 i = 1; 1219 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) { 1220 uint_t prot; 1221 vnode_t *mvp; 1222 void *tmp = NULL; 1223 caddr_t saddr = seg->s_base; 1224 caddr_t naddr; 1225 caddr_t eaddr; 1226 size_t segsize; 1227 1228 Ehdr ehdr; 1229 int nshdrs, shstrndx, nphdrs; 1230 caddr_t shbase; 1231 ssize_t shsize; 1232 char *shstrbase; 1233 ssize_t shstrsize; 1234 1235 Shdr *shdr; 1236 const char *name; 1237 size_t sz; 1238 uintptr_t off; 1239 1240 int ctf_ndx = 0; 1241 int symtab_ndx = 0; 1242 1243 /* 1244 * Since we're just looking for text segments of load 1245 * objects, we only care about the protection bits; we don't 1246 * care about the actual size of the segment so we use the 1247 * reserved size. If the segment's size is zero, there's 1248 * something fishy going on so we ignore this segment. 1249 */ 1250 if (seg->s_ops != &segvn_ops || 1251 SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 || 1252 mvp == lastvp || mvp == NULL || mvp->v_type != VREG || 1253 (segsize = pr_getsegsize(seg, 1)) == 0) 1254 continue; 1255 1256 eaddr = saddr + segsize; 1257 prot = pr_getprot(seg, 1, &tmp, &saddr, &naddr, eaddr); 1258 pr_getprot_done(&tmp); 1259 1260 /* 1261 * Skip this segment unless the protection bits look like 1262 * what we'd expect for a text segment. 1263 */ 1264 if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC) 1265 continue; 1266 1267 if (getelfhead(mvp, credp, &ehdr, &nshdrs, &shstrndx, 1268 &nphdrs) != 0 || 1269 getelfshdr(mvp, credp, &ehdr, nshdrs, shstrndx, 1270 &shbase, &shsize, &shstrbase, &shstrsize) != 0) 1271 continue; 1272 1273 off = ehdr.e_shentsize; 1274 for (j = 1; j < nshdrs; j++, off += ehdr.e_shentsize) { 1275 Shdr *symtab = NULL, *strtab; 1276 1277 shdr = (Shdr *)(shbase + off); 1278 1279 if (shdr->sh_name >= shstrsize) 1280 continue; 1281 1282 name = shstrbase + shdr->sh_name; 1283 1284 if (strcmp(name, shstrtab_data[STR_CTF]) == 0) { 1285 if ((content & CC_CONTENT_CTF) == 0 || 1286 ctf_ndx != 0) 1287 continue; 1288 1289 if (shdr->sh_link > 0 && 1290 shdr->sh_link < nshdrs) { 1291 symtab = (Shdr *)(shbase + 1292 shdr->sh_link * ehdr.e_shentsize); 1293 } 1294 1295 if (v != NULL && i < nv - 1) { 1296 if (shdr->sh_size > datasz && 1297 shdr->sh_size <= elf_datasz_max) { 1298 if (data != NULL) 1299 kmem_free(data, datasz); 1300 1301 datasz = shdr->sh_size; 1302 data = kmem_alloc(datasz, 1303 KM_SLEEP); 1304 } 1305 1306 v[i].sh_name = shstrtab_ndx(&shstrtab, 1307 STR_CTF); 1308 v[i].sh_addr = (Addr)(uintptr_t)saddr; 1309 v[i].sh_type = SHT_PROGBITS; 1310 v[i].sh_addralign = 4; 1311 *doffsetp = roundup(*doffsetp, 1312 v[i].sh_addralign); 1313 v[i].sh_offset = *doffsetp; 1314 v[i].sh_size = shdr->sh_size; 1315 if (symtab == NULL) { 1316 v[i].sh_link = 0; 1317 } else if (symtab->sh_type == 1318 SHT_SYMTAB && 1319 symtab_ndx != 0) { 1320 v[i].sh_link = 1321 symtab_ndx; 1322 } else { 1323 v[i].sh_link = i + 1; 1324 } 1325 1326 copy_scn(shdr, mvp, &v[i], vp, 1327 doffsetp, data, datasz, credp, 1328 rlimit); 1329 } 1330 1331 ctf_ndx = i++; 1332 1333 /* 1334 * We've already dumped the symtab. 1335 */ 1336 if (symtab != NULL && 1337 symtab->sh_type == SHT_SYMTAB && 1338 symtab_ndx != 0) 1339 continue; 1340 1341 } else if (strcmp(name, 1342 shstrtab_data[STR_SYMTAB]) == 0) { 1343 if ((content & CC_CONTENT_SYMTAB) == 0 || 1344 symtab != 0) 1345 continue; 1346 1347 symtab = shdr; 1348 } 1349 1350 if (symtab != NULL) { 1351 if ((symtab->sh_type != SHT_DYNSYM && 1352 symtab->sh_type != SHT_SYMTAB) || 1353 symtab->sh_link == 0 || 1354 symtab->sh_link >= nshdrs) 1355 continue; 1356 1357 strtab = (Shdr *)(shbase + 1358 symtab->sh_link * ehdr.e_shentsize); 1359 1360 if (strtab->sh_type != SHT_STRTAB) 1361 continue; 1362 1363 if (v != NULL && i < nv - 2) { 1364 sz = MAX(symtab->sh_size, 1365 strtab->sh_size); 1366 if (sz > datasz && 1367 sz <= elf_datasz_max) { 1368 if (data != NULL) 1369 kmem_free(data, datasz); 1370 1371 datasz = sz; 1372 data = kmem_alloc(datasz, 1373 KM_SLEEP); 1374 } 1375 1376 if (symtab->sh_type == SHT_DYNSYM) { 1377 v[i].sh_name = shstrtab_ndx( 1378 &shstrtab, STR_DYNSYM); 1379 v[i + 1].sh_name = shstrtab_ndx( 1380 &shstrtab, STR_DYNSTR); 1381 } else { 1382 v[i].sh_name = shstrtab_ndx( 1383 &shstrtab, STR_SYMTAB); 1384 v[i + 1].sh_name = shstrtab_ndx( 1385 &shstrtab, STR_STRTAB); 1386 } 1387 1388 v[i].sh_type = symtab->sh_type; 1389 v[i].sh_addr = symtab->sh_addr; 1390 if (ehdr.e_type == ET_DYN || 1391 v[i].sh_addr == 0) 1392 v[i].sh_addr += 1393 (Addr)(uintptr_t)saddr; 1394 v[i].sh_addralign = 1395 symtab->sh_addralign; 1396 *doffsetp = roundup(*doffsetp, 1397 v[i].sh_addralign); 1398 v[i].sh_offset = *doffsetp; 1399 v[i].sh_size = symtab->sh_size; 1400 v[i].sh_link = i + 1; 1401 v[i].sh_entsize = symtab->sh_entsize; 1402 v[i].sh_info = symtab->sh_info; 1403 1404 copy_scn(symtab, mvp, &v[i], vp, 1405 doffsetp, data, datasz, credp, 1406 rlimit); 1407 1408 v[i + 1].sh_type = SHT_STRTAB; 1409 v[i + 1].sh_flags = SHF_STRINGS; 1410 v[i + 1].sh_addr = symtab->sh_addr; 1411 if (ehdr.e_type == ET_DYN || 1412 v[i + 1].sh_addr == 0) 1413 v[i + 1].sh_addr += 1414 (Addr)(uintptr_t)saddr; 1415 v[i + 1].sh_addralign = 1416 strtab->sh_addralign; 1417 *doffsetp = roundup(*doffsetp, 1418 v[i + 1].sh_addralign); 1419 v[i + 1].sh_offset = *doffsetp; 1420 v[i + 1].sh_size = strtab->sh_size; 1421 1422 copy_scn(strtab, mvp, &v[i + 1], vp, 1423 doffsetp, data, datasz, credp, 1424 rlimit); 1425 } 1426 1427 if (symtab->sh_type == SHT_SYMTAB) 1428 symtab_ndx = i; 1429 i += 2; 1430 } 1431 } 1432 1433 kmem_free(shstrbase, shstrsize); 1434 kmem_free(shbase, shsize); 1435 1436 lastvp = mvp; 1437 } 1438 1439 if (v == NULL) { 1440 if (i == 1) 1441 *nshdrsp = 0; 1442 else 1443 *nshdrsp = i + 1; 1444 goto done; 1445 } 1446 1447 if (i != nv - 1) { 1448 cmn_err(CE_WARN, "elfcore: core dump failed for " 1449 "process %d; address space is changing", p->p_pid); 1450 error = EIO; 1451 goto done; 1452 } 1453 1454 v[i].sh_name = shstrtab_ndx(&shstrtab, STR_SHSTRTAB); 1455 v[i].sh_size = shstrtab_size(&shstrtab); 1456 v[i].sh_addralign = 1; 1457 *doffsetp = roundup(*doffsetp, v[i].sh_addralign); 1458 v[i].sh_offset = *doffsetp; 1459 v[i].sh_flags = SHF_STRINGS; 1460 v[i].sh_type = SHT_STRTAB; 1461 1462 if (v[i].sh_size > datasz) { 1463 if (data != NULL) 1464 kmem_free(data, datasz); 1465 1466 datasz = v[i].sh_size; 1467 data = kmem_alloc(datasz, 1468 KM_SLEEP); 1469 } 1470 1471 shstrtab_dump(&shstrtab, data); 1472 1473 if ((error = core_write(vp, UIO_SYSSPACE, *doffsetp, 1474 data, v[i].sh_size, rlimit, credp)) != 0) 1475 goto done; 1476 1477 *doffsetp += v[i].sh_size; 1478 1479 done: 1480 if (data != NULL) 1481 kmem_free(data, datasz); 1482 1483 return (error); 1484 } 1485 1486 int 1487 elfcore(vnode_t *vp, proc_t *p, cred_t *credp, rlim64_t rlimit, int sig, 1488 core_content_t content) 1489 { 1490 offset_t poffset, soffset; 1491 Off doffset; 1492 int error, i, nphdrs, nshdrs; 1493 int overflow = 0; 1494 struct seg *seg; 1495 struct as *as = p->p_as; 1496 union { 1497 Ehdr ehdr; 1498 Phdr phdr[1]; 1499 Shdr shdr[1]; 1500 } *bigwad; 1501 size_t bigsize; 1502 size_t phdrsz, shdrsz; 1503 Ehdr *ehdr; 1504 Phdr *v; 1505 caddr_t brkbase; 1506 size_t brksize; 1507 caddr_t stkbase; 1508 size_t stksize; 1509 int ntries = 0; 1510 1511 top: 1512 /* 1513 * Make sure we have everything we need (registers, etc.). 1514 * All other lwps have already stopped and are in an orderly state. 1515 */ 1516 ASSERT(p == ttoproc(curthread)); 1517 prstop(0, 0); 1518 1519 AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER); 1520 nphdrs = prnsegs(as, 0) + 2; /* two CORE note sections */ 1521 1522 /* 1523 * Count the number of section headers we're going to need. 1524 */ 1525 nshdrs = 0; 1526 if (content & (CC_CONTENT_CTF | CC_CONTENT_SYMTAB)) { 1527 (void) process_scns(content, p, credp, NULL, NULL, NULL, 0, 1528 NULL, &nshdrs); 1529 } 1530 AS_LOCK_EXIT(as, &as->a_lock); 1531 1532 ASSERT(nshdrs == 0 || nshdrs > 1); 1533 1534 /* 1535 * The core file contents may required zero section headers, but if 1536 * we overflow the 16 bits allotted to the program header count in 1537 * the ELF header, we'll need that program header at index zero. 1538 */ 1539 if (nshdrs == 0 && nphdrs >= PN_XNUM) 1540 nshdrs = 1; 1541 1542 phdrsz = nphdrs * sizeof (Phdr); 1543 shdrsz = nshdrs * sizeof (Shdr); 1544 1545 bigsize = MAX(sizeof (*bigwad), MAX(phdrsz, shdrsz)); 1546 bigwad = kmem_alloc(bigsize, KM_SLEEP); 1547 1548 ehdr = &bigwad->ehdr; 1549 bzero(ehdr, sizeof (*ehdr)); 1550 1551 ehdr->e_ident[EI_MAG0] = ELFMAG0; 1552 ehdr->e_ident[EI_MAG1] = ELFMAG1; 1553 ehdr->e_ident[EI_MAG2] = ELFMAG2; 1554 ehdr->e_ident[EI_MAG3] = ELFMAG3; 1555 ehdr->e_ident[EI_CLASS] = ELFCLASS; 1556 ehdr->e_type = ET_CORE; 1557 1558 #if !defined(_LP64) || defined(_ELF32_COMPAT) 1559 1560 #if defined(__sparc) 1561 ehdr->e_ident[EI_DATA] = ELFDATA2MSB; 1562 ehdr->e_machine = EM_SPARC; 1563 #elif defined(__i386) || defined(__i386_COMPAT) 1564 ehdr->e_ident[EI_DATA] = ELFDATA2LSB; 1565 ehdr->e_machine = EM_386; 1566 #else 1567 #error "no recognized machine type is defined" 1568 #endif 1569 1570 #else /* !defined(_LP64) || defined(_ELF32_COMPAT) */ 1571 1572 #if defined(__sparc) 1573 ehdr->e_ident[EI_DATA] = ELFDATA2MSB; 1574 ehdr->e_machine = EM_SPARCV9; 1575 #elif defined(__amd64) 1576 ehdr->e_ident[EI_DATA] = ELFDATA2LSB; 1577 ehdr->e_machine = EM_AMD64; 1578 #else 1579 #error "no recognized 64-bit machine type is defined" 1580 #endif 1581 1582 #endif /* !defined(_LP64) || defined(_ELF32_COMPAT) */ 1583 1584 /* 1585 * If the count of program headers or section headers or the index 1586 * of the section string table can't fit in the mere 16 bits 1587 * shortsightedly allotted to them in the ELF header, we use the 1588 * extended formats and put the real values in the section header 1589 * as index 0. 1590 */ 1591 ehdr->e_version = EV_CURRENT; 1592 ehdr->e_ehsize = sizeof (Ehdr); 1593 1594 if (nphdrs >= PN_XNUM) 1595 ehdr->e_phnum = PN_XNUM; 1596 else 1597 ehdr->e_phnum = (unsigned short)nphdrs; 1598 1599 ehdr->e_phoff = sizeof (Ehdr); 1600 ehdr->e_phentsize = sizeof (Phdr); 1601 1602 if (nshdrs > 0) { 1603 if (nshdrs >= SHN_LORESERVE) 1604 ehdr->e_shnum = 0; 1605 else 1606 ehdr->e_shnum = (unsigned short)nshdrs; 1607 1608 if (nshdrs - 1 >= SHN_LORESERVE) 1609 ehdr->e_shstrndx = SHN_XINDEX; 1610 else 1611 ehdr->e_shstrndx = (unsigned short)(nshdrs - 1); 1612 1613 ehdr->e_shoff = ehdr->e_phoff + ehdr->e_phentsize * nphdrs; 1614 ehdr->e_shentsize = sizeof (Shdr); 1615 } 1616 1617 if (error = core_write(vp, UIO_SYSSPACE, (offset_t)0, ehdr, 1618 sizeof (Ehdr), rlimit, credp)) 1619 goto done; 1620 1621 poffset = sizeof (Ehdr); 1622 soffset = sizeof (Ehdr) + phdrsz; 1623 doffset = sizeof (Ehdr) + phdrsz + shdrsz; 1624 1625 v = &bigwad->phdr[0]; 1626 bzero(v, phdrsz); 1627 1628 setup_old_note_header(&v[0], p); 1629 v[0].p_offset = doffset = roundup(doffset, sizeof (Word)); 1630 doffset += v[0].p_filesz; 1631 1632 setup_note_header(&v[1], p); 1633 v[1].p_offset = doffset = roundup(doffset, sizeof (Word)); 1634 doffset += v[1].p_filesz; 1635 1636 mutex_enter(&p->p_lock); 1637 1638 brkbase = p->p_brkbase; 1639 brksize = p->p_brksize; 1640 1641 stkbase = p->p_usrstack - p->p_stksize; 1642 stksize = p->p_stksize; 1643 1644 mutex_exit(&p->p_lock); 1645 1646 AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER); 1647 i = 2; 1648 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) { 1649 caddr_t eaddr = seg->s_base + pr_getsegsize(seg, 0); 1650 caddr_t saddr, naddr; 1651 void *tmp = NULL; 1652 extern struct seg_ops segspt_shmops; 1653 1654 for (saddr = seg->s_base; saddr < eaddr; saddr = naddr) { 1655 uint_t prot; 1656 size_t size; 1657 int type; 1658 vnode_t *mvp; 1659 1660 prot = pr_getprot(seg, 0, &tmp, &saddr, &naddr, eaddr); 1661 prot &= PROT_READ | PROT_WRITE | PROT_EXEC; 1662 if ((size = (size_t)(naddr - saddr)) == 0) 1663 continue; 1664 if (i == nphdrs) { 1665 overflow++; 1666 continue; 1667 } 1668 v[i].p_type = PT_LOAD; 1669 v[i].p_vaddr = (Addr)(uintptr_t)saddr; 1670 v[i].p_memsz = size; 1671 if (prot & PROT_READ) 1672 v[i].p_flags |= PF_R; 1673 if (prot & PROT_WRITE) 1674 v[i].p_flags |= PF_W; 1675 if (prot & PROT_EXEC) 1676 v[i].p_flags |= PF_X; 1677 1678 /* 1679 * Figure out which mappings to include in the core. 1680 */ 1681 type = SEGOP_GETTYPE(seg, saddr); 1682 1683 if (saddr == stkbase && size == stksize) { 1684 if (!(content & CC_CONTENT_STACK)) 1685 goto exclude; 1686 1687 } else if (saddr == brkbase && size == brksize) { 1688 if (!(content & CC_CONTENT_HEAP)) 1689 goto exclude; 1690 1691 } else if (seg->s_ops == &segspt_shmops) { 1692 if (type & MAP_NORESERVE) { 1693 if (!(content & CC_CONTENT_DISM)) 1694 goto exclude; 1695 } else { 1696 if (!(content & CC_CONTENT_ISM)) 1697 goto exclude; 1698 } 1699 1700 } else if (seg->s_ops != &segvn_ops) { 1701 goto exclude; 1702 1703 } else if (type & MAP_SHARED) { 1704 if (shmgetid(p, saddr) != SHMID_NONE) { 1705 if (!(content & CC_CONTENT_SHM)) 1706 goto exclude; 1707 1708 } else if (SEGOP_GETVP(seg, seg->s_base, 1709 &mvp) != 0 || mvp == NULL || 1710 mvp->v_type != VREG) { 1711 if (!(content & CC_CONTENT_SHANON)) 1712 goto exclude; 1713 1714 } else { 1715 if (!(content & CC_CONTENT_SHFILE)) 1716 goto exclude; 1717 } 1718 1719 } else if (SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 || 1720 mvp == NULL || mvp->v_type != VREG) { 1721 if (!(content & CC_CONTENT_ANON)) 1722 goto exclude; 1723 1724 } else if (prot == (PROT_READ | PROT_EXEC)) { 1725 if (!(content & CC_CONTENT_TEXT)) 1726 goto exclude; 1727 1728 } else if (prot == PROT_READ) { 1729 if (!(content & CC_CONTENT_RODATA)) 1730 goto exclude; 1731 1732 } else { 1733 if (!(content & CC_CONTENT_DATA)) 1734 goto exclude; 1735 } 1736 1737 doffset = roundup(doffset, sizeof (Word)); 1738 v[i].p_offset = doffset; 1739 v[i].p_filesz = size; 1740 doffset += size; 1741 exclude: 1742 i++; 1743 } 1744 ASSERT(tmp == NULL); 1745 } 1746 AS_LOCK_EXIT(as, &as->a_lock); 1747 1748 if (overflow || i != nphdrs) { 1749 if (ntries++ == 0) { 1750 kmem_free(bigwad, bigsize); 1751 goto top; 1752 } 1753 cmn_err(CE_WARN, "elfcore: core dump failed for " 1754 "process %d; address space is changing", p->p_pid); 1755 error = EIO; 1756 goto done; 1757 } 1758 1759 if ((error = core_write(vp, UIO_SYSSPACE, poffset, 1760 v, phdrsz, rlimit, credp)) != 0) 1761 goto done; 1762 1763 if ((error = write_old_elfnotes(p, sig, vp, v[0].p_offset, rlimit, 1764 credp)) != 0) 1765 goto done; 1766 1767 if ((error = write_elfnotes(p, sig, vp, v[1].p_offset, rlimit, 1768 credp, content)) != 0) 1769 goto done; 1770 1771 for (i = 2; i < nphdrs; i++) { 1772 if (v[i].p_filesz == 0) 1773 continue; 1774 1775 /* 1776 * If dumping out this segment fails, rather than failing 1777 * the core dump entirely, we reset the size of the mapping 1778 * to zero to indicate that the data is absent from the core 1779 * file and or in the PF_SUNW_FAILURE flag to differentiate 1780 * this from mappings that were excluded due to the core file 1781 * content settings. 1782 */ 1783 if ((error = core_seg(p, vp, v[i].p_offset, 1784 (caddr_t)(uintptr_t)v[i].p_vaddr, v[i].p_filesz, 1785 rlimit, credp)) != 0) { 1786 1787 /* 1788 * Since the space reserved for the segment is now 1789 * unused, we stash the errno in the first four 1790 * bytes. This undocumented interface will let us 1791 * understand the nature of the failure. 1792 */ 1793 (void) core_write(vp, UIO_SYSSPACE, v[i].p_offset, 1794 &error, sizeof (error), rlimit, credp); 1795 1796 v[i].p_filesz = 0; 1797 v[i].p_flags |= PF_SUNW_FAILURE; 1798 if ((error = core_write(vp, UIO_SYSSPACE, 1799 poffset + sizeof (v[i]) * i, &v[i], sizeof (v[i]), 1800 rlimit, credp)) != 0) 1801 goto done; 1802 } 1803 } 1804 1805 if (nshdrs > 0) { 1806 bzero(&bigwad->shdr[0], shdrsz); 1807 1808 if (nshdrs >= SHN_LORESERVE) 1809 bigwad->shdr[0].sh_size = nshdrs; 1810 1811 if (nshdrs - 1 >= SHN_LORESERVE) 1812 bigwad->shdr[0].sh_link = nshdrs - 1; 1813 1814 if (nphdrs >= PN_XNUM) 1815 bigwad->shdr[0].sh_info = nphdrs; 1816 1817 if (nshdrs > 1) { 1818 AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER); 1819 if ((error = process_scns(content, p, credp, vp, 1820 &bigwad->shdr[0], nshdrs, rlimit, &doffset, 1821 NULL)) != 0) { 1822 AS_LOCK_EXIT(as, &as->a_lock); 1823 goto done; 1824 } 1825 AS_LOCK_EXIT(as, &as->a_lock); 1826 } 1827 1828 if ((error = core_write(vp, UIO_SYSSPACE, soffset, 1829 &bigwad->shdr[0], shdrsz, rlimit, credp)) != 0) 1830 goto done; 1831 } 1832 1833 done: 1834 kmem_free(bigwad, bigsize); 1835 return (error); 1836 } 1837 1838 #ifndef _ELF32_COMPAT 1839 1840 static struct execsw esw = { 1841 #ifdef _LP64 1842 elf64magicstr, 1843 #else /* _LP64 */ 1844 elf32magicstr, 1845 #endif /* _LP64 */ 1846 0, 1847 5, 1848 elfexec, 1849 elfcore 1850 }; 1851 1852 static struct modlexec modlexec = { 1853 &mod_execops, "exec module for elf", &esw 1854 }; 1855 1856 #ifdef _LP64 1857 extern int elf32exec(vnode_t *vp, execa_t *uap, uarg_t *args, 1858 intpdata_t *idatap, int level, long *execsz, 1859 int setid, caddr_t exec_file, cred_t *cred); 1860 extern int elf32core(vnode_t *vp, proc_t *p, cred_t *credp, 1861 rlim64_t rlimit, int sig, core_content_t content); 1862 1863 static struct execsw esw32 = { 1864 elf32magicstr, 1865 0, 1866 5, 1867 elf32exec, 1868 elf32core 1869 }; 1870 1871 static struct modlexec modlexec32 = { 1872 &mod_execops, "32-bit exec module for elf", &esw32 1873 }; 1874 #endif /* _LP64 */ 1875 1876 static struct modlinkage modlinkage = { 1877 MODREV_1, 1878 (void *)&modlexec, 1879 #ifdef _LP64 1880 (void *)&modlexec32, 1881 #endif /* _LP64 */ 1882 NULL 1883 }; 1884 1885 int 1886 _init(void) 1887 { 1888 return (mod_install(&modlinkage)); 1889 } 1890 1891 int 1892 _fini(void) 1893 { 1894 return (mod_remove(&modlinkage)); 1895 } 1896 1897 int 1898 _info(struct modinfo *modinfop) 1899 { 1900 return (mod_info(&modlinkage, modinfop)); 1901 } 1902 1903 #endif /* !_ELF32_COMPAT */ 1904