1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved. 24 */ 25 26 /* Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */ 27 /* All Rights Reserved */ 28 /* 29 * Copyright 2016 Joyent, Inc. 30 */ 31 32 #include <sys/types.h> 33 #include <sys/param.h> 34 #include <sys/thread.h> 35 #include <sys/sysmacros.h> 36 #include <sys/signal.h> 37 #include <sys/cred.h> 38 #include <sys/user.h> 39 #include <sys/errno.h> 40 #include <sys/vnode.h> 41 #include <sys/mman.h> 42 #include <sys/kmem.h> 43 #include <sys/proc.h> 44 #include <sys/pathname.h> 45 #include <sys/cmn_err.h> 46 #include <sys/systm.h> 47 #include <sys/elf.h> 48 #include <sys/vmsystm.h> 49 #include <sys/debug.h> 50 #include <sys/auxv.h> 51 #include <sys/exec.h> 52 #include <sys/prsystm.h> 53 #include <vm/as.h> 54 #include <vm/rm.h> 55 #include <vm/seg.h> 56 #include <vm/seg_vn.h> 57 #include <sys/modctl.h> 58 #include <sys/systeminfo.h> 59 #include <sys/vmparam.h> 60 #include <sys/machelf.h> 61 #include <sys/shm_impl.h> 62 #include <sys/archsystm.h> 63 #include <sys/fasttrap.h> 64 #include <sys/brand.h> 65 #include "elf_impl.h" 66 #include <sys/sdt.h> 67 #include <sys/siginfo.h> 68 69 #if defined(__x86) 70 #include <sys/comm_page_util.h> 71 #endif /* defined(__x86) */ 72 73 74 extern int at_flags; 75 76 #define ORIGIN_STR "ORIGIN" 77 #define ORIGIN_STR_SIZE 6 78 79 static int getelfhead(vnode_t *, cred_t *, Ehdr *, int *, int *, int *); 80 static int getelfphdr(vnode_t *, cred_t *, const Ehdr *, int, caddr_t *, 81 ssize_t *); 82 static int getelfshdr(vnode_t *, cred_t *, const Ehdr *, int, int, caddr_t *, 83 ssize_t *, caddr_t *, ssize_t *); 84 static size_t elfsize(Ehdr *, int, caddr_t, uintptr_t *); 85 static int mapelfexec(vnode_t *, Ehdr *, int, caddr_t, 86 Phdr **, Phdr **, Phdr **, Phdr **, Phdr *, 87 caddr_t *, caddr_t *, intptr_t *, intptr_t *, size_t, long *, size_t *); 88 89 typedef enum { 90 STR_CTF, 91 STR_SYMTAB, 92 STR_DYNSYM, 93 STR_STRTAB, 94 STR_DYNSTR, 95 STR_SHSTRTAB, 96 STR_NUM 97 } shstrtype_t; 98 99 static const char *shstrtab_data[] = { 100 ".SUNW_ctf", 101 ".symtab", 102 ".dynsym", 103 ".strtab", 104 ".dynstr", 105 ".shstrtab" 106 }; 107 108 typedef struct shstrtab { 109 int sst_ndx[STR_NUM]; 110 int sst_cur; 111 } shstrtab_t; 112 113 static void 114 shstrtab_init(shstrtab_t *s) 115 { 116 bzero(&s->sst_ndx, sizeof (s->sst_ndx)); 117 s->sst_cur = 1; 118 } 119 120 static int 121 shstrtab_ndx(shstrtab_t *s, shstrtype_t type) 122 { 123 int ret; 124 125 if ((ret = s->sst_ndx[type]) != 0) 126 return (ret); 127 128 ret = s->sst_ndx[type] = s->sst_cur; 129 s->sst_cur += strlen(shstrtab_data[type]) + 1; 130 131 return (ret); 132 } 133 134 static size_t 135 shstrtab_size(const shstrtab_t *s) 136 { 137 return (s->sst_cur); 138 } 139 140 static void 141 shstrtab_dump(const shstrtab_t *s, char *buf) 142 { 143 int i, ndx; 144 145 *buf = '\0'; 146 for (i = 0; i < STR_NUM; i++) { 147 if ((ndx = s->sst_ndx[i]) != 0) 148 (void) strcpy(buf + ndx, shstrtab_data[i]); 149 } 150 } 151 152 static int 153 dtrace_safe_phdr(Phdr *phdrp, struct uarg *args, uintptr_t base) 154 { 155 ASSERT(phdrp->p_type == PT_SUNWDTRACE); 156 157 /* 158 * See the comment in fasttrap.h for information on how to safely 159 * update this program header. 160 */ 161 if (phdrp->p_memsz < PT_SUNWDTRACE_SIZE || 162 (phdrp->p_flags & (PF_R | PF_W | PF_X)) != (PF_R | PF_W | PF_X)) 163 return (-1); 164 165 args->thrptr = phdrp->p_vaddr + base; 166 167 return (0); 168 } 169 170 /* 171 * Map in the executable pointed to by vp. Returns 0 on success. 172 */ 173 int 174 mapexec_brand(vnode_t *vp, uarg_t *args, Ehdr *ehdr, Addr *uphdr_vaddr, 175 intptr_t *voffset, caddr_t exec_file, int *interp, caddr_t *bssbase, 176 caddr_t *brkbase, size_t *brksize, uintptr_t *lddatap) 177 { 178 size_t len; 179 struct vattr vat; 180 caddr_t phdrbase = NULL; 181 ssize_t phdrsize; 182 int nshdrs, shstrndx, nphdrs; 183 int error = 0; 184 Phdr *uphdr = NULL; 185 Phdr *junk = NULL; 186 Phdr *dynphdr = NULL; 187 Phdr *dtrphdr = NULL; 188 uintptr_t lddata; 189 long execsz; 190 intptr_t minaddr; 191 192 if (lddatap != NULL) 193 *lddatap = NULL; 194 195 if (error = execpermissions(vp, &vat, args)) { 196 uprintf("%s: Cannot execute %s\n", exec_file, args->pathname); 197 return (error); 198 } 199 200 if ((error = getelfhead(vp, CRED(), ehdr, &nshdrs, &shstrndx, 201 &nphdrs)) != 0 || 202 (error = getelfphdr(vp, CRED(), ehdr, nphdrs, &phdrbase, 203 &phdrsize)) != 0) { 204 uprintf("%s: Cannot read %s\n", exec_file, args->pathname); 205 return (error); 206 } 207 208 if ((len = elfsize(ehdr, nphdrs, phdrbase, &lddata)) == 0) { 209 uprintf("%s: Nothing to load in %s", exec_file, args->pathname); 210 kmem_free(phdrbase, phdrsize); 211 return (ENOEXEC); 212 } 213 if (lddatap != NULL) 214 *lddatap = lddata; 215 216 if (error = mapelfexec(vp, ehdr, nphdrs, phdrbase, &uphdr, &dynphdr, 217 &junk, &dtrphdr, NULL, bssbase, brkbase, voffset, &minaddr, 218 len, &execsz, brksize)) { 219 uprintf("%s: Cannot map %s\n", exec_file, args->pathname); 220 kmem_free(phdrbase, phdrsize); 221 return (error); 222 } 223 224 /* 225 * Inform our caller if the executable needs an interpreter. 226 */ 227 *interp = (dynphdr == NULL) ? 0 : 1; 228 229 /* 230 * If this is a statically linked executable, voffset should indicate 231 * the address of the executable itself (it normally holds the address 232 * of the interpreter). 233 */ 234 if (ehdr->e_type == ET_EXEC && *interp == 0) 235 *voffset = minaddr; 236 237 if (uphdr != NULL) { 238 *uphdr_vaddr = uphdr->p_vaddr; 239 } else { 240 *uphdr_vaddr = (Addr)-1; 241 } 242 243 kmem_free(phdrbase, phdrsize); 244 return (error); 245 } 246 247 /*ARGSUSED*/ 248 int 249 elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap, 250 int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred, 251 int brand_action) 252 { 253 caddr_t phdrbase = NULL; 254 caddr_t bssbase = 0; 255 caddr_t brkbase = 0; 256 size_t brksize = 0; 257 ssize_t dlnsize; 258 aux_entry_t *aux; 259 int error; 260 ssize_t resid; 261 int fd = -1; 262 intptr_t voffset; 263 Phdr *dyphdr = NULL; 264 Phdr *stphdr = NULL; 265 Phdr *uphdr = NULL; 266 Phdr *junk = NULL; 267 size_t len; 268 ssize_t phdrsize; 269 int postfixsize = 0; 270 int i, hsize; 271 Phdr *phdrp; 272 Phdr *dataphdrp = NULL; 273 Phdr *dtrphdr; 274 Phdr *capphdr = NULL; 275 Cap *cap = NULL; 276 ssize_t capsize; 277 int hasu = 0; 278 int hasauxv = 0; 279 int hasdy = 0; 280 int branded = 0; 281 282 struct proc *p = ttoproc(curthread); 283 struct user *up = PTOU(p); 284 struct bigwad { 285 Ehdr ehdr; 286 aux_entry_t elfargs[__KERN_NAUXV_IMPL]; 287 char dl_name[MAXPATHLEN]; 288 char pathbuf[MAXPATHLEN]; 289 struct vattr vattr; 290 struct execenv exenv; 291 } *bigwad; /* kmem_alloc this behemoth so we don't blow stack */ 292 Ehdr *ehdrp; 293 int nshdrs, shstrndx, nphdrs; 294 char *dlnp; 295 char *pathbufp; 296 rlim64_t limit; 297 rlim64_t roundlimit; 298 299 ASSERT(p->p_model == DATAMODEL_ILP32 || p->p_model == DATAMODEL_LP64); 300 301 bigwad = kmem_alloc(sizeof (struct bigwad), KM_SLEEP); 302 ehdrp = &bigwad->ehdr; 303 dlnp = bigwad->dl_name; 304 pathbufp = bigwad->pathbuf; 305 306 /* 307 * Obtain ELF and program header information. 308 */ 309 if ((error = getelfhead(vp, CRED(), ehdrp, &nshdrs, &shstrndx, 310 &nphdrs)) != 0 || 311 (error = getelfphdr(vp, CRED(), ehdrp, nphdrs, &phdrbase, 312 &phdrsize)) != 0) 313 goto out; 314 315 /* 316 * Prevent executing an ELF file that has no entry point. 317 */ 318 if (ehdrp->e_entry == 0) { 319 uprintf("%s: Bad entry point\n", exec_file); 320 goto bad; 321 } 322 323 /* 324 * Put data model that we're exec-ing to into the args passed to 325 * exec_args(), so it will know what it is copying to on new stack. 326 * Now that we know whether we are exec-ing a 32-bit or 64-bit 327 * executable, we can set execsz with the appropriate NCARGS. 328 */ 329 #ifdef _LP64 330 if (ehdrp->e_ident[EI_CLASS] == ELFCLASS32) { 331 args->to_model = DATAMODEL_ILP32; 332 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS32-1); 333 } else { 334 args->to_model = DATAMODEL_LP64; 335 args->stk_prot &= ~PROT_EXEC; 336 #if defined(__i386) || defined(__amd64) 337 args->dat_prot &= ~PROT_EXEC; 338 #endif 339 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS64-1); 340 } 341 #else /* _LP64 */ 342 args->to_model = DATAMODEL_ILP32; 343 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS-1); 344 #endif /* _LP64 */ 345 346 /* 347 * We delay invoking the brand callback until we've figured out 348 * what kind of elf binary we're trying to run, 32-bit or 64-bit. 349 * We do this because now the brand library can just check 350 * args->to_model to see if the target is 32-bit or 64-bit without 351 * having do duplicate all the code above. 352 */ 353 if ((level < 2) && 354 (brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) { 355 error = BROP(p)->b_elfexec(vp, uap, args, 356 idatap, level + 1, execsz, setid, exec_file, cred, 357 brand_action); 358 goto out; 359 } 360 361 /* 362 * Determine aux size now so that stack can be built 363 * in one shot (except actual copyout of aux image), 364 * determine any non-default stack protections, 365 * and still have this code be machine independent. 366 */ 367 hsize = ehdrp->e_phentsize; 368 phdrp = (Phdr *)phdrbase; 369 for (i = nphdrs; i > 0; i--) { 370 switch (phdrp->p_type) { 371 case PT_INTERP: 372 hasauxv = hasdy = 1; 373 break; 374 case PT_PHDR: 375 hasu = 1; 376 break; 377 case PT_SUNWSTACK: 378 args->stk_prot = PROT_USER; 379 if (phdrp->p_flags & PF_R) 380 args->stk_prot |= PROT_READ; 381 if (phdrp->p_flags & PF_W) 382 args->stk_prot |= PROT_WRITE; 383 if (phdrp->p_flags & PF_X) 384 args->stk_prot |= PROT_EXEC; 385 break; 386 case PT_LOAD: 387 dataphdrp = phdrp; 388 break; 389 case PT_SUNWCAP: 390 capphdr = phdrp; 391 break; 392 } 393 phdrp = (Phdr *)((caddr_t)phdrp + hsize); 394 } 395 396 if (ehdrp->e_type != ET_EXEC) { 397 dataphdrp = NULL; 398 hasauxv = 1; 399 } 400 401 /* Copy BSS permissions to args->dat_prot */ 402 if (dataphdrp != NULL) { 403 args->dat_prot = PROT_USER; 404 if (dataphdrp->p_flags & PF_R) 405 args->dat_prot |= PROT_READ; 406 if (dataphdrp->p_flags & PF_W) 407 args->dat_prot |= PROT_WRITE; 408 if (dataphdrp->p_flags & PF_X) 409 args->dat_prot |= PROT_EXEC; 410 } 411 412 /* 413 * If a auxvector will be required - reserve the space for 414 * it now. This may be increased by exec_args if there are 415 * ISA-specific types (included in __KERN_NAUXV_IMPL). 416 */ 417 if (hasauxv) { 418 /* 419 * If a AUX vector is being built - the base AUX 420 * entries are: 421 * 422 * AT_BASE 423 * AT_FLAGS 424 * AT_PAGESZ 425 * AT_SUN_AUXFLAGS 426 * AT_SUN_HWCAP 427 * AT_SUN_HWCAP2 428 * AT_SUN_PLATFORM (added in stk_copyout) 429 * AT_SUN_EXECNAME (added in stk_copyout) 430 * AT_NULL 431 * 432 * total == 9 433 */ 434 if (hasdy && hasu) { 435 /* 436 * Has PT_INTERP & PT_PHDR - the auxvectors that 437 * will be built are: 438 * 439 * AT_PHDR 440 * AT_PHENT 441 * AT_PHNUM 442 * AT_ENTRY 443 * AT_LDDATA 444 * 445 * total = 5 446 */ 447 args->auxsize = (9 + 5) * sizeof (aux_entry_t); 448 } else if (hasdy) { 449 /* 450 * Has PT_INTERP but no PT_PHDR 451 * 452 * AT_EXECFD 453 * AT_LDDATA 454 * 455 * total = 2 456 */ 457 args->auxsize = (9 + 2) * sizeof (aux_entry_t); 458 } else { 459 args->auxsize = 9 * sizeof (aux_entry_t); 460 } 461 } else { 462 args->auxsize = 0; 463 } 464 465 /* 466 * If this binary is using an emulator, we need to add an 467 * AT_SUN_EMULATOR aux entry. 468 */ 469 if (args->emulator != NULL) 470 args->auxsize += sizeof (aux_entry_t); 471 472 /* 473 * On supported kernels (x86_64) make room in the auxv for the 474 * AT_SUN_COMMPAGE entry. This will go unpopulated on i86xpv systems 475 * which do not provide such functionality. 476 */ 477 #if defined(__amd64) 478 args->auxsize += sizeof (aux_entry_t); 479 #endif /* defined(__amd64) */ 480 481 if ((brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) { 482 branded = 1; 483 /* 484 * We will be adding 4 entries to the aux vectors. One for 485 * the the brandname and 3 for the brand specific aux vectors. 486 */ 487 args->auxsize += 4 * sizeof (aux_entry_t); 488 } 489 490 /* Hardware/Software capabilities */ 491 if (capphdr != NULL && 492 (capsize = capphdr->p_filesz) > 0 && 493 capsize <= 16 * sizeof (*cap)) { 494 int ncaps = capsize / sizeof (*cap); 495 Cap *cp; 496 497 cap = kmem_alloc(capsize, KM_SLEEP); 498 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)cap, 499 capsize, (offset_t)capphdr->p_offset, 500 UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid)) != 0) { 501 uprintf("%s: Cannot read capabilities section\n", 502 exec_file); 503 goto out; 504 } 505 for (cp = cap; cp < cap + ncaps; cp++) { 506 if (cp->c_tag == CA_SUNW_SF_1 && 507 (cp->c_un.c_val & SF1_SUNW_ADDR32)) { 508 if (args->to_model == DATAMODEL_LP64) 509 args->addr32 = 1; 510 break; 511 } 512 } 513 } 514 515 aux = bigwad->elfargs; 516 /* 517 * Move args to the user's stack. 518 * This can fill in the AT_SUN_PLATFORM and AT_SUN_EXECNAME aux entries. 519 */ 520 if ((error = exec_args(uap, args, idatap, (void **)&aux)) != 0) { 521 if (error == -1) { 522 error = ENOEXEC; 523 goto bad; 524 } 525 goto out; 526 } 527 /* we're single threaded after this point */ 528 529 /* 530 * If this is an ET_DYN executable (shared object), 531 * determine its memory size so that mapelfexec() can load it. 532 */ 533 if (ehdrp->e_type == ET_DYN) 534 len = elfsize(ehdrp, nphdrs, phdrbase, NULL); 535 else 536 len = 0; 537 538 dtrphdr = NULL; 539 540 if ((error = mapelfexec(vp, ehdrp, nphdrs, phdrbase, &uphdr, &dyphdr, 541 &stphdr, &dtrphdr, dataphdrp, &bssbase, &brkbase, &voffset, NULL, 542 len, execsz, &brksize)) != 0) 543 goto bad; 544 545 if (uphdr != NULL && dyphdr == NULL) 546 goto bad; 547 548 if (dtrphdr != NULL && dtrace_safe_phdr(dtrphdr, args, voffset) != 0) { 549 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, exec_file); 550 goto bad; 551 } 552 553 if (dyphdr != NULL) { 554 size_t len; 555 uintptr_t lddata; 556 char *p; 557 struct vnode *nvp; 558 559 dlnsize = dyphdr->p_filesz; 560 561 if (dlnsize > MAXPATHLEN || dlnsize <= 0) 562 goto bad; 563 564 /* 565 * Read in "interpreter" pathname. 566 */ 567 if ((error = vn_rdwr(UIO_READ, vp, dlnp, dyphdr->p_filesz, 568 (offset_t)dyphdr->p_offset, UIO_SYSSPACE, 0, (rlim64_t)0, 569 CRED(), &resid)) != 0) { 570 uprintf("%s: Cannot obtain interpreter pathname\n", 571 exec_file); 572 goto bad; 573 } 574 575 if (resid != 0 || dlnp[dlnsize - 1] != '\0') 576 goto bad; 577 578 /* 579 * Search for '$ORIGIN' token in interpreter path. 580 * If found, expand it. 581 */ 582 for (p = dlnp; p = strchr(p, '$'); ) { 583 uint_t len, curlen; 584 char *_ptr; 585 586 if (strncmp(++p, ORIGIN_STR, ORIGIN_STR_SIZE)) 587 continue; 588 589 curlen = 0; 590 len = p - dlnp - 1; 591 if (len) { 592 bcopy(dlnp, pathbufp, len); 593 curlen += len; 594 } 595 if (_ptr = strrchr(args->pathname, '/')) { 596 len = _ptr - args->pathname; 597 if ((curlen + len) > MAXPATHLEN) 598 break; 599 600 bcopy(args->pathname, &pathbufp[curlen], len); 601 curlen += len; 602 } else { 603 /* 604 * executable is a basename found in the 605 * current directory. So - just substitue 606 * '.' for ORIGIN. 607 */ 608 pathbufp[curlen] = '.'; 609 curlen++; 610 } 611 p += ORIGIN_STR_SIZE; 612 len = strlen(p); 613 614 if ((curlen + len) > MAXPATHLEN) 615 break; 616 bcopy(p, &pathbufp[curlen], len); 617 curlen += len; 618 pathbufp[curlen++] = '\0'; 619 bcopy(pathbufp, dlnp, curlen); 620 } 621 622 /* 623 * /usr/lib/ld.so.1 is known to be a symlink to /lib/ld.so.1 624 * (and /usr/lib/64/ld.so.1 is a symlink to /lib/64/ld.so.1). 625 * Just in case /usr is not mounted, change it now. 626 */ 627 if (strcmp(dlnp, USR_LIB_RTLD) == 0) 628 dlnp += 4; 629 error = lookupname(dlnp, UIO_SYSSPACE, FOLLOW, NULLVPP, &nvp); 630 if (error && dlnp != bigwad->dl_name) { 631 /* new kernel, old user-level */ 632 error = lookupname(dlnp -= 4, UIO_SYSSPACE, FOLLOW, 633 NULLVPP, &nvp); 634 } 635 if (error) { 636 uprintf("%s: Cannot find %s\n", exec_file, dlnp); 637 goto bad; 638 } 639 640 /* 641 * Setup the "aux" vector. 642 */ 643 if (uphdr) { 644 if (ehdrp->e_type == ET_DYN) { 645 /* don't use the first page */ 646 bigwad->exenv.ex_brkbase = (caddr_t)PAGESIZE; 647 bigwad->exenv.ex_bssbase = (caddr_t)PAGESIZE; 648 } else { 649 bigwad->exenv.ex_bssbase = bssbase; 650 bigwad->exenv.ex_brkbase = brkbase; 651 } 652 bigwad->exenv.ex_brksize = brksize; 653 bigwad->exenv.ex_magic = elfmagic; 654 bigwad->exenv.ex_vp = vp; 655 setexecenv(&bigwad->exenv); 656 657 ADDAUX(aux, AT_PHDR, uphdr->p_vaddr + voffset) 658 ADDAUX(aux, AT_PHENT, ehdrp->e_phentsize) 659 ADDAUX(aux, AT_PHNUM, nphdrs) 660 ADDAUX(aux, AT_ENTRY, ehdrp->e_entry + voffset) 661 } else { 662 if ((error = execopen(&vp, &fd)) != 0) { 663 VN_RELE(nvp); 664 goto bad; 665 } 666 667 ADDAUX(aux, AT_EXECFD, fd) 668 } 669 670 if ((error = execpermissions(nvp, &bigwad->vattr, args)) != 0) { 671 VN_RELE(nvp); 672 uprintf("%s: Cannot execute %s\n", exec_file, dlnp); 673 goto bad; 674 } 675 676 /* 677 * Now obtain the ELF header along with the entire program 678 * header contained in "nvp". 679 */ 680 kmem_free(phdrbase, phdrsize); 681 phdrbase = NULL; 682 if ((error = getelfhead(nvp, CRED(), ehdrp, &nshdrs, 683 &shstrndx, &nphdrs)) != 0 || 684 (error = getelfphdr(nvp, CRED(), ehdrp, nphdrs, &phdrbase, 685 &phdrsize)) != 0) { 686 VN_RELE(nvp); 687 uprintf("%s: Cannot read %s\n", exec_file, dlnp); 688 goto bad; 689 } 690 691 /* 692 * Determine memory size of the "interpreter's" loadable 693 * sections. This size is then used to obtain the virtual 694 * address of a hole, in the user's address space, large 695 * enough to map the "interpreter". 696 */ 697 if ((len = elfsize(ehdrp, nphdrs, phdrbase, &lddata)) == 0) { 698 VN_RELE(nvp); 699 uprintf("%s: Nothing to load in %s\n", exec_file, dlnp); 700 goto bad; 701 } 702 703 dtrphdr = NULL; 704 705 error = mapelfexec(nvp, ehdrp, nphdrs, phdrbase, &junk, &junk, 706 &junk, &dtrphdr, NULL, NULL, NULL, &voffset, NULL, len, 707 execsz, NULL); 708 if (error || junk != NULL) { 709 VN_RELE(nvp); 710 uprintf("%s: Cannot map %s\n", exec_file, dlnp); 711 goto bad; 712 } 713 714 /* 715 * We use the DTrace program header to initialize the 716 * architecture-specific user per-LWP location. The dtrace 717 * fasttrap provider requires ready access to per-LWP scratch 718 * space. We assume that there is only one such program header 719 * in the interpreter. 720 */ 721 if (dtrphdr != NULL && 722 dtrace_safe_phdr(dtrphdr, args, voffset) != 0) { 723 VN_RELE(nvp); 724 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, dlnp); 725 goto bad; 726 } 727 728 VN_RELE(nvp); 729 ADDAUX(aux, AT_SUN_LDDATA, voffset + lddata) 730 } 731 732 if (hasauxv) { 733 int auxf = AF_SUN_HWCAPVERIFY; 734 735 /* 736 * Note: AT_SUN_PLATFORM and AT_SUN_EXECNAME were filled in via 737 * exec_args() 738 */ 739 ADDAUX(aux, AT_BASE, voffset) 740 ADDAUX(aux, AT_FLAGS, at_flags) 741 ADDAUX(aux, AT_PAGESZ, PAGESIZE) 742 /* 743 * Linker flags. (security) 744 * p_flag not yet set at this time. 745 * We rely on gexec() to provide us with the information. 746 * If the application is set-uid but this is not reflected 747 * in a mismatch between real/effective uids/gids, then 748 * don't treat this as a set-uid exec. So we care about 749 * the EXECSETID_UGIDS flag but not the ...SETID flag. 750 */ 751 if ((setid &= ~EXECSETID_SETID) != 0) 752 auxf |= AF_SUN_SETUGID; 753 754 /* 755 * If we're running a native process from within a branded 756 * zone under pfexec then we clear the AF_SUN_SETUGID flag so 757 * that the native ld.so.1 is able to link with the native 758 * libraries instead of using the brand libraries that are 759 * installed in the zone. We only do this for processes 760 * which we trust because we see they are already running 761 * under pfexec (where uid != euid). This prevents a 762 * malicious user within the zone from crafting a wrapper to 763 * run native suid commands with unsecure libraries interposed. 764 */ 765 if ((brand_action == EBA_NATIVE) && (PROC_IS_BRANDED(p) && 766 (setid &= ~EXECSETID_SETID) != 0)) 767 auxf &= ~AF_SUN_SETUGID; 768 769 /* 770 * Record the user addr of the auxflags aux vector entry 771 * since brands may optionally want to manipulate this field. 772 */ 773 args->auxp_auxflags = 774 (char *)((char *)args->stackend + 775 ((char *)&aux->a_type - 776 (char *)bigwad->elfargs)); 777 ADDAUX(aux, AT_SUN_AUXFLAGS, auxf); 778 /* 779 * Hardware capability flag word (performance hints) 780 * Used for choosing faster library routines. 781 * (Potentially different between 32-bit and 64-bit ABIs) 782 */ 783 #if defined(_LP64) 784 if (args->to_model == DATAMODEL_NATIVE) { 785 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap) 786 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2) 787 } else { 788 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap32) 789 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap32_2) 790 } 791 #else 792 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap) 793 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2) 794 #endif 795 if (branded) { 796 /* 797 * Reserve space for the brand-private aux vectors, 798 * and record the user addr of that space. 799 */ 800 args->auxp_brand = 801 (char *)((char *)args->stackend + 802 ((char *)&aux->a_type - 803 (char *)bigwad->elfargs)); 804 ADDAUX(aux, AT_SUN_BRAND_AUX1, 0) 805 ADDAUX(aux, AT_SUN_BRAND_AUX2, 0) 806 ADDAUX(aux, AT_SUN_BRAND_AUX3, 0) 807 } 808 809 /* 810 * Add the comm page auxv entry, mapping it in if needed. 811 */ 812 #if defined(__amd64) 813 if (args->commpage != NULL || 814 (args->commpage = (uintptr_t)comm_page_mapin()) != NULL) { 815 ADDAUX(aux, AT_SUN_COMMPAGE, args->commpage) 816 } else { 817 /* 818 * If the comm page cannot be mapped, pad out the auxv 819 * to satisfy later size checks. 820 */ 821 ADDAUX(aux, AT_NULL, 0) 822 } 823 #endif /* defined(__amd64) */ 824 825 ADDAUX(aux, AT_NULL, 0) 826 postfixsize = (char *)aux - (char *)bigwad->elfargs; 827 828 /* 829 * We make assumptions above when we determine how many aux 830 * vector entries we will be adding. However, if we have an 831 * invalid elf file, it is possible that mapelfexec might 832 * behave differently (but not return an error), in which case 833 * the number of aux entries we actually add will be different. 834 * We detect that now and error out. 835 */ 836 if (postfixsize != args->auxsize) { 837 DTRACE_PROBE2(elfexec_badaux, int, postfixsize, 838 int, args->auxsize); 839 goto bad; 840 } 841 ASSERT(postfixsize <= __KERN_NAUXV_IMPL * sizeof (aux_entry_t)); 842 } 843 844 /* 845 * For the 64-bit kernel, the limit is big enough that rounding it up 846 * to a page can overflow the 64-bit limit, so we check for btopr() 847 * overflowing here by comparing it with the unrounded limit in pages. 848 * If it hasn't overflowed, compare the exec size with the rounded up 849 * limit in pages. Otherwise, just compare with the unrounded limit. 850 */ 851 limit = btop(p->p_vmem_ctl); 852 roundlimit = btopr(p->p_vmem_ctl); 853 if ((roundlimit > limit && *execsz > roundlimit) || 854 (roundlimit < limit && *execsz > limit)) { 855 mutex_enter(&p->p_lock); 856 (void) rctl_action(rctlproc_legacy[RLIMIT_VMEM], p->p_rctls, p, 857 RCA_SAFE); 858 mutex_exit(&p->p_lock); 859 error = ENOMEM; 860 goto bad; 861 } 862 863 bzero(up->u_auxv, sizeof (up->u_auxv)); 864 up->u_commpagep = args->commpage; 865 if (postfixsize) { 866 int num_auxv; 867 868 /* 869 * Copy the aux vector to the user stack. 870 */ 871 error = execpoststack(args, bigwad->elfargs, postfixsize); 872 if (error) 873 goto bad; 874 875 /* 876 * Copy auxv to the process's user structure for use by /proc. 877 * If this is a branded process, the brand's exec routine will 878 * copy it's private entries to the user structure later. It 879 * relies on the fact that the blank entries are at the end. 880 */ 881 num_auxv = postfixsize / sizeof (aux_entry_t); 882 ASSERT(num_auxv <= sizeof (up->u_auxv) / sizeof (auxv_t)); 883 aux = bigwad->elfargs; 884 for (i = 0; i < num_auxv; i++) { 885 up->u_auxv[i].a_type = aux[i].a_type; 886 up->u_auxv[i].a_un.a_val = (aux_val_t)aux[i].a_un.a_val; 887 } 888 } 889 890 /* 891 * Pass back the starting address so we can set the program counter. 892 */ 893 args->entry = (uintptr_t)(ehdrp->e_entry + voffset); 894 895 if (!uphdr) { 896 if (ehdrp->e_type == ET_DYN) { 897 /* 898 * If we are executing a shared library which doesn't 899 * have a interpreter (probably ld.so.1) then 900 * we don't set the brkbase now. Instead we 901 * delay it's setting until the first call 902 * via grow.c::brk(). This permits ld.so.1 to 903 * initialize brkbase to the tail of the executable it 904 * loads (which is where it needs to be). 905 */ 906 bigwad->exenv.ex_brkbase = (caddr_t)0; 907 bigwad->exenv.ex_bssbase = (caddr_t)0; 908 bigwad->exenv.ex_brksize = 0; 909 } else { 910 bigwad->exenv.ex_brkbase = brkbase; 911 bigwad->exenv.ex_bssbase = bssbase; 912 bigwad->exenv.ex_brksize = brksize; 913 } 914 bigwad->exenv.ex_magic = elfmagic; 915 bigwad->exenv.ex_vp = vp; 916 setexecenv(&bigwad->exenv); 917 } 918 919 ASSERT(error == 0); 920 goto out; 921 922 bad: 923 if (fd != -1) /* did we open the a.out yet */ 924 (void) execclose(fd); 925 926 psignal(p, SIGKILL); 927 928 if (error == 0) 929 error = ENOEXEC; 930 out: 931 if (phdrbase != NULL) 932 kmem_free(phdrbase, phdrsize); 933 if (cap != NULL) 934 kmem_free(cap, capsize); 935 kmem_free(bigwad, sizeof (struct bigwad)); 936 return (error); 937 } 938 939 /* 940 * Compute the memory size requirement for the ELF file. 941 */ 942 static size_t 943 elfsize(Ehdr *ehdrp, int nphdrs, caddr_t phdrbase, uintptr_t *lddata) 944 { 945 size_t len; 946 Phdr *phdrp = (Phdr *)phdrbase; 947 int hsize = ehdrp->e_phentsize; 948 int first = 1; 949 int dfirst = 1; /* first data segment */ 950 uintptr_t loaddr = 0; 951 uintptr_t hiaddr = 0; 952 uintptr_t lo, hi; 953 int i; 954 955 for (i = nphdrs; i > 0; i--) { 956 if (phdrp->p_type == PT_LOAD) { 957 lo = phdrp->p_vaddr; 958 hi = lo + phdrp->p_memsz; 959 if (first) { 960 loaddr = lo; 961 hiaddr = hi; 962 first = 0; 963 } else { 964 if (loaddr > lo) 965 loaddr = lo; 966 if (hiaddr < hi) 967 hiaddr = hi; 968 } 969 970 /* 971 * save the address of the first data segment 972 * of a object - used for the AT_SUNW_LDDATA 973 * aux entry. 974 */ 975 if ((lddata != NULL) && dfirst && 976 (phdrp->p_flags & PF_W)) { 977 *lddata = lo; 978 dfirst = 0; 979 } 980 } 981 phdrp = (Phdr *)((caddr_t)phdrp + hsize); 982 } 983 984 len = hiaddr - (loaddr & PAGEMASK); 985 len = roundup(len, PAGESIZE); 986 987 return (len); 988 } 989 990 /* 991 * Read in the ELF header and program header table. 992 * SUSV3 requires: 993 * ENOEXEC File format is not recognized 994 * EINVAL Format recognized but execution not supported 995 */ 996 static int 997 getelfhead(vnode_t *vp, cred_t *credp, Ehdr *ehdr, int *nshdrs, int *shstrndx, 998 int *nphdrs) 999 { 1000 int error; 1001 ssize_t resid; 1002 1003 /* 1004 * We got here by the first two bytes in ident, 1005 * now read the entire ELF header. 1006 */ 1007 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)ehdr, 1008 sizeof (Ehdr), (offset_t)0, UIO_SYSSPACE, 0, 1009 (rlim64_t)0, credp, &resid)) != 0) 1010 return (error); 1011 1012 /* 1013 * Since a separate version is compiled for handling 32-bit and 1014 * 64-bit ELF executables on a 64-bit kernel, the 64-bit version 1015 * doesn't need to be able to deal with 32-bit ELF files. 1016 */ 1017 if (resid != 0 || 1018 ehdr->e_ident[EI_MAG2] != ELFMAG2 || 1019 ehdr->e_ident[EI_MAG3] != ELFMAG3) 1020 return (ENOEXEC); 1021 1022 if ((ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) || 1023 #if defined(_ILP32) || defined(_ELF32_COMPAT) 1024 ehdr->e_ident[EI_CLASS] != ELFCLASS32 || 1025 #else 1026 ehdr->e_ident[EI_CLASS] != ELFCLASS64 || 1027 #endif 1028 !elfheadcheck(ehdr->e_ident[EI_DATA], ehdr->e_machine, 1029 ehdr->e_flags)) 1030 return (EINVAL); 1031 1032 *nshdrs = ehdr->e_shnum; 1033 *shstrndx = ehdr->e_shstrndx; 1034 *nphdrs = ehdr->e_phnum; 1035 1036 /* 1037 * If e_shnum, e_shstrndx, or e_phnum is its sentinel value, we need 1038 * to read in the section header at index zero to acces the true 1039 * values for those fields. 1040 */ 1041 if ((*nshdrs == 0 && ehdr->e_shoff != 0) || 1042 *shstrndx == SHN_XINDEX || *nphdrs == PN_XNUM) { 1043 Shdr shdr; 1044 1045 if (ehdr->e_shoff == 0) 1046 return (EINVAL); 1047 1048 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)&shdr, 1049 sizeof (shdr), (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, 1050 (rlim64_t)0, credp, &resid)) != 0) 1051 return (error); 1052 1053 if (*nshdrs == 0) 1054 *nshdrs = shdr.sh_size; 1055 if (*shstrndx == SHN_XINDEX) 1056 *shstrndx = shdr.sh_link; 1057 if (*nphdrs == PN_XNUM && shdr.sh_info != 0) 1058 *nphdrs = shdr.sh_info; 1059 } 1060 1061 return (0); 1062 } 1063 1064 #ifdef _ELF32_COMPAT 1065 extern size_t elf_nphdr_max; 1066 #else 1067 size_t elf_nphdr_max = 1000; 1068 #endif 1069 1070 static int 1071 getelfphdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, int nphdrs, 1072 caddr_t *phbasep, ssize_t *phsizep) 1073 { 1074 ssize_t resid, minsize; 1075 int err; 1076 1077 /* 1078 * Since we're going to be using e_phentsize to iterate down the 1079 * array of program headers, it must be 8-byte aligned or else 1080 * a we might cause a misaligned access. We use all members through 1081 * p_flags on 32-bit ELF files and p_memsz on 64-bit ELF files so 1082 * e_phentsize must be at least large enough to include those 1083 * members. 1084 */ 1085 #if !defined(_LP64) || defined(_ELF32_COMPAT) 1086 minsize = offsetof(Phdr, p_flags) + sizeof (((Phdr *)NULL)->p_flags); 1087 #else 1088 minsize = offsetof(Phdr, p_memsz) + sizeof (((Phdr *)NULL)->p_memsz); 1089 #endif 1090 if (ehdr->e_phentsize < minsize || (ehdr->e_phentsize & 3)) 1091 return (EINVAL); 1092 1093 *phsizep = nphdrs * ehdr->e_phentsize; 1094 1095 if (*phsizep > sizeof (Phdr) * elf_nphdr_max) { 1096 if ((*phbasep = kmem_alloc(*phsizep, KM_NOSLEEP)) == NULL) 1097 return (ENOMEM); 1098 } else { 1099 *phbasep = kmem_alloc(*phsizep, KM_SLEEP); 1100 } 1101 1102 if ((err = vn_rdwr(UIO_READ, vp, *phbasep, *phsizep, 1103 (offset_t)ehdr->e_phoff, UIO_SYSSPACE, 0, (rlim64_t)0, 1104 credp, &resid)) != 0) { 1105 kmem_free(*phbasep, *phsizep); 1106 *phbasep = NULL; 1107 return (err); 1108 } 1109 1110 return (0); 1111 } 1112 1113 #ifdef _ELF32_COMPAT 1114 extern size_t elf_nshdr_max; 1115 extern size_t elf_shstrtab_max; 1116 #else 1117 size_t elf_nshdr_max = 10000; 1118 size_t elf_shstrtab_max = 100 * 1024; 1119 #endif 1120 1121 1122 static int 1123 getelfshdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, 1124 int nshdrs, int shstrndx, caddr_t *shbasep, ssize_t *shsizep, 1125 char **shstrbasep, ssize_t *shstrsizep) 1126 { 1127 ssize_t resid, minsize; 1128 int err; 1129 Shdr *shdr; 1130 1131 /* 1132 * Since we're going to be using e_shentsize to iterate down the 1133 * array of section headers, it must be 8-byte aligned or else 1134 * a we might cause a misaligned access. We use all members through 1135 * sh_entsize (on both 32- and 64-bit ELF files) so e_shentsize 1136 * must be at least large enough to include that member. The index 1137 * of the string table section must also be valid. 1138 */ 1139 minsize = offsetof(Shdr, sh_entsize) + sizeof (shdr->sh_entsize); 1140 if (ehdr->e_shentsize < minsize || (ehdr->e_shentsize & 3) || 1141 shstrndx >= nshdrs) 1142 return (EINVAL); 1143 1144 *shsizep = nshdrs * ehdr->e_shentsize; 1145 1146 if (*shsizep > sizeof (Shdr) * elf_nshdr_max) { 1147 if ((*shbasep = kmem_alloc(*shsizep, KM_NOSLEEP)) == NULL) 1148 return (ENOMEM); 1149 } else { 1150 *shbasep = kmem_alloc(*shsizep, KM_SLEEP); 1151 } 1152 1153 if ((err = vn_rdwr(UIO_READ, vp, *shbasep, *shsizep, 1154 (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, (rlim64_t)0, 1155 credp, &resid)) != 0) { 1156 kmem_free(*shbasep, *shsizep); 1157 return (err); 1158 } 1159 1160 /* 1161 * Pull the section string table out of the vnode; fail if the size 1162 * is zero. 1163 */ 1164 shdr = (Shdr *)(*shbasep + shstrndx * ehdr->e_shentsize); 1165 if ((*shstrsizep = shdr->sh_size) == 0) { 1166 kmem_free(*shbasep, *shsizep); 1167 return (EINVAL); 1168 } 1169 1170 if (*shstrsizep > elf_shstrtab_max) { 1171 if ((*shstrbasep = kmem_alloc(*shstrsizep, 1172 KM_NOSLEEP)) == NULL) { 1173 kmem_free(*shbasep, *shsizep); 1174 return (ENOMEM); 1175 } 1176 } else { 1177 *shstrbasep = kmem_alloc(*shstrsizep, KM_SLEEP); 1178 } 1179 1180 if ((err = vn_rdwr(UIO_READ, vp, *shstrbasep, *shstrsizep, 1181 (offset_t)shdr->sh_offset, UIO_SYSSPACE, 0, (rlim64_t)0, 1182 credp, &resid)) != 0) { 1183 kmem_free(*shbasep, *shsizep); 1184 kmem_free(*shstrbasep, *shstrsizep); 1185 return (err); 1186 } 1187 1188 /* 1189 * Make sure the strtab is null-terminated to make sure we 1190 * don't run off the end of the table. 1191 */ 1192 (*shstrbasep)[*shstrsizep - 1] = '\0'; 1193 1194 return (0); 1195 } 1196 1197 static int 1198 mapelfexec( 1199 vnode_t *vp, 1200 Ehdr *ehdr, 1201 int nphdrs, 1202 caddr_t phdrbase, 1203 Phdr **uphdr, 1204 Phdr **dyphdr, 1205 Phdr **stphdr, 1206 Phdr **dtphdr, 1207 Phdr *dataphdrp, 1208 caddr_t *bssbase, 1209 caddr_t *brkbase, 1210 intptr_t *voffset, 1211 intptr_t *minaddr, 1212 size_t len, 1213 long *execsz, 1214 size_t *brksize) 1215 { 1216 Phdr *phdr; 1217 int i, prot, error; 1218 caddr_t addr = NULL; 1219 size_t zfodsz; 1220 int ptload = 0; 1221 int page; 1222 off_t offset; 1223 int hsize = ehdr->e_phentsize; 1224 caddr_t mintmp = (caddr_t)-1; 1225 extern int use_brk_lpg; 1226 1227 if (ehdr->e_type == ET_DYN) { 1228 /* 1229 * Obtain the virtual address of a hole in the 1230 * address space to map the "interpreter". 1231 */ 1232 map_addr(&addr, len, (offset_t)0, 1, 0); 1233 if (addr == NULL) 1234 return (ENOMEM); 1235 *voffset = (intptr_t)addr; 1236 1237 /* 1238 * Calculate the minimum vaddr so it can be subtracted out. 1239 * According to the ELF specification, since PT_LOAD sections 1240 * must be sorted by increasing p_vaddr values, this is 1241 * guaranteed to be the first PT_LOAD section. 1242 */ 1243 phdr = (Phdr *)phdrbase; 1244 for (i = nphdrs; i > 0; i--) { 1245 if (phdr->p_type == PT_LOAD) { 1246 *voffset -= (uintptr_t)phdr->p_vaddr; 1247 break; 1248 } 1249 phdr = (Phdr *)((caddr_t)phdr + hsize); 1250 } 1251 1252 } else { 1253 *voffset = 0; 1254 } 1255 phdr = (Phdr *)phdrbase; 1256 for (i = nphdrs; i > 0; i--) { 1257 switch (phdr->p_type) { 1258 case PT_LOAD: 1259 if ((*dyphdr != NULL) && (*uphdr == NULL)) 1260 return (0); 1261 1262 ptload = 1; 1263 prot = PROT_USER; 1264 if (phdr->p_flags & PF_R) 1265 prot |= PROT_READ; 1266 if (phdr->p_flags & PF_W) 1267 prot |= PROT_WRITE; 1268 if (phdr->p_flags & PF_X) 1269 prot |= PROT_EXEC; 1270 1271 addr = (caddr_t)((uintptr_t)phdr->p_vaddr + *voffset); 1272 1273 /* 1274 * Keep track of the segment with the lowest starting 1275 * address. 1276 */ 1277 if (addr < mintmp) 1278 mintmp = addr; 1279 1280 zfodsz = (size_t)phdr->p_memsz - phdr->p_filesz; 1281 1282 offset = phdr->p_offset; 1283 if (((uintptr_t)offset & PAGEOFFSET) == 1284 ((uintptr_t)addr & PAGEOFFSET) && 1285 (!(vp->v_flag & VNOMAP))) { 1286 page = 1; 1287 } else { 1288 page = 0; 1289 } 1290 1291 /* 1292 * Set the heap pagesize for OOB when the bss size 1293 * is known and use_brk_lpg is not 0. 1294 */ 1295 if (brksize != NULL && use_brk_lpg && 1296 zfodsz != 0 && phdr == dataphdrp && 1297 (prot & PROT_WRITE)) { 1298 size_t tlen = P2NPHASE((uintptr_t)addr + 1299 phdr->p_filesz, PAGESIZE); 1300 1301 if (zfodsz > tlen) { 1302 curproc->p_brkpageszc = 1303 page_szc(map_pgsz(MAPPGSZ_HEAP, 1304 curproc, addr + phdr->p_filesz + 1305 tlen, zfodsz - tlen, 0)); 1306 } 1307 } 1308 1309 if (curproc->p_brkpageszc != 0 && phdr == dataphdrp && 1310 (prot & PROT_WRITE)) { 1311 uint_t szc = curproc->p_brkpageszc; 1312 size_t pgsz = page_get_pagesize(szc); 1313 caddr_t ebss = addr + phdr->p_memsz; 1314 size_t extra_zfodsz; 1315 1316 ASSERT(pgsz > PAGESIZE); 1317 1318 extra_zfodsz = P2NPHASE((uintptr_t)ebss, pgsz); 1319 1320 if (error = execmap(vp, addr, phdr->p_filesz, 1321 zfodsz + extra_zfodsz, phdr->p_offset, 1322 prot, page, szc)) 1323 goto bad; 1324 if (brksize != NULL) 1325 *brksize = extra_zfodsz; 1326 } else { 1327 if (error = execmap(vp, addr, phdr->p_filesz, 1328 zfodsz, phdr->p_offset, prot, page, 0)) 1329 goto bad; 1330 } 1331 1332 if (bssbase != NULL && addr >= *bssbase && 1333 phdr == dataphdrp) { 1334 *bssbase = addr + phdr->p_filesz; 1335 } 1336 if (brkbase != NULL && addr >= *brkbase) { 1337 *brkbase = addr + phdr->p_memsz; 1338 } 1339 1340 *execsz += btopr(phdr->p_memsz); 1341 break; 1342 1343 case PT_INTERP: 1344 if (ptload) 1345 goto bad; 1346 *dyphdr = phdr; 1347 break; 1348 1349 case PT_SHLIB: 1350 *stphdr = phdr; 1351 break; 1352 1353 case PT_PHDR: 1354 if (ptload) 1355 goto bad; 1356 *uphdr = phdr; 1357 break; 1358 1359 case PT_NULL: 1360 case PT_DYNAMIC: 1361 case PT_NOTE: 1362 break; 1363 1364 case PT_SUNWDTRACE: 1365 if (dtphdr != NULL) 1366 *dtphdr = phdr; 1367 break; 1368 1369 default: 1370 break; 1371 } 1372 phdr = (Phdr *)((caddr_t)phdr + hsize); 1373 } 1374 1375 if (minaddr != NULL) { 1376 ASSERT(mintmp != (caddr_t)-1); 1377 *minaddr = (intptr_t)mintmp; 1378 } 1379 1380 return (0); 1381 bad: 1382 if (error == 0) 1383 error = EINVAL; 1384 return (error); 1385 } 1386 1387 int 1388 elfnote(vnode_t *vp, offset_t *offsetp, int type, int descsz, void *desc, 1389 rlim64_t rlimit, cred_t *credp) 1390 { 1391 Note note; 1392 int error; 1393 1394 bzero(¬e, sizeof (note)); 1395 bcopy("CORE", note.name, 4); 1396 note.nhdr.n_type = type; 1397 /* 1398 * The System V ABI states that n_namesz must be the length of the 1399 * string that follows the Nhdr structure including the terminating 1400 * null. The ABI also specifies that sufficient padding should be 1401 * included so that the description that follows the name string 1402 * begins on a 4- or 8-byte boundary for 32- and 64-bit binaries 1403 * respectively. However, since this change was not made correctly 1404 * at the time of the 64-bit port, both 32- and 64-bit binaries 1405 * descriptions are only guaranteed to begin on a 4-byte boundary. 1406 */ 1407 note.nhdr.n_namesz = 5; 1408 note.nhdr.n_descsz = roundup(descsz, sizeof (Word)); 1409 1410 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, ¬e, 1411 sizeof (note), rlimit, credp)) 1412 return (error); 1413 1414 *offsetp += sizeof (note); 1415 1416 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, desc, 1417 note.nhdr.n_descsz, rlimit, credp)) 1418 return (error); 1419 1420 *offsetp += note.nhdr.n_descsz; 1421 return (0); 1422 } 1423 1424 /* 1425 * Copy the section data from one vnode to the section of another vnode. 1426 */ 1427 static void 1428 copy_scn(Shdr *src, vnode_t *src_vp, Shdr *dst, vnode_t *dst_vp, Off *doffset, 1429 void *buf, size_t size, cred_t *credp, rlim64_t rlimit) 1430 { 1431 ssize_t resid; 1432 size_t len, n = src->sh_size; 1433 offset_t off = 0; 1434 1435 while (n != 0) { 1436 len = MIN(size, n); 1437 if (vn_rdwr(UIO_READ, src_vp, buf, len, src->sh_offset + off, 1438 UIO_SYSSPACE, 0, (rlim64_t)0, credp, &resid) != 0 || 1439 resid >= len || 1440 core_write(dst_vp, UIO_SYSSPACE, *doffset + off, 1441 buf, len - resid, rlimit, credp) != 0) { 1442 dst->sh_size = 0; 1443 dst->sh_offset = 0; 1444 return; 1445 } 1446 1447 ASSERT(n >= len - resid); 1448 1449 n -= len - resid; 1450 off += len - resid; 1451 } 1452 1453 *doffset += src->sh_size; 1454 } 1455 1456 #ifdef _ELF32_COMPAT 1457 extern size_t elf_datasz_max; 1458 #else 1459 size_t elf_datasz_max = 1 * 1024 * 1024; 1460 #endif 1461 1462 /* 1463 * This function processes mappings that correspond to load objects to 1464 * examine their respective sections for elfcore(). It's called once with 1465 * v set to NULL to count the number of sections that we're going to need 1466 * and then again with v set to some allocated buffer that we fill in with 1467 * all the section data. 1468 */ 1469 static int 1470 process_scns(core_content_t content, proc_t *p, cred_t *credp, vnode_t *vp, 1471 Shdr *v, int nv, rlim64_t rlimit, Off *doffsetp, int *nshdrsp) 1472 { 1473 vnode_t *lastvp = NULL; 1474 struct seg *seg; 1475 int i, j; 1476 void *data = NULL; 1477 size_t datasz = 0; 1478 shstrtab_t shstrtab; 1479 struct as *as = p->p_as; 1480 int error = 0; 1481 1482 if (v != NULL) 1483 shstrtab_init(&shstrtab); 1484 1485 i = 1; 1486 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) { 1487 uint_t prot; 1488 vnode_t *mvp; 1489 void *tmp = NULL; 1490 caddr_t saddr = seg->s_base; 1491 caddr_t naddr; 1492 caddr_t eaddr; 1493 size_t segsize; 1494 1495 Ehdr ehdr; 1496 int nshdrs, shstrndx, nphdrs; 1497 caddr_t shbase; 1498 ssize_t shsize; 1499 char *shstrbase; 1500 ssize_t shstrsize; 1501 1502 Shdr *shdr; 1503 const char *name; 1504 size_t sz; 1505 uintptr_t off; 1506 1507 int ctf_ndx = 0; 1508 int symtab_ndx = 0; 1509 1510 /* 1511 * Since we're just looking for text segments of load 1512 * objects, we only care about the protection bits; we don't 1513 * care about the actual size of the segment so we use the 1514 * reserved size. If the segment's size is zero, there's 1515 * something fishy going on so we ignore this segment. 1516 */ 1517 if (seg->s_ops != &segvn_ops || 1518 SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 || 1519 mvp == lastvp || mvp == NULL || mvp->v_type != VREG || 1520 (segsize = pr_getsegsize(seg, 1)) == 0) 1521 continue; 1522 1523 eaddr = saddr + segsize; 1524 prot = pr_getprot(seg, 1, &tmp, &saddr, &naddr, eaddr); 1525 pr_getprot_done(&tmp); 1526 1527 /* 1528 * Skip this segment unless the protection bits look like 1529 * what we'd expect for a text segment. 1530 */ 1531 if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC) 1532 continue; 1533 1534 if (getelfhead(mvp, credp, &ehdr, &nshdrs, &shstrndx, 1535 &nphdrs) != 0 || 1536 getelfshdr(mvp, credp, &ehdr, nshdrs, shstrndx, 1537 &shbase, &shsize, &shstrbase, &shstrsize) != 0) 1538 continue; 1539 1540 off = ehdr.e_shentsize; 1541 for (j = 1; j < nshdrs; j++, off += ehdr.e_shentsize) { 1542 Shdr *symtab = NULL, *strtab; 1543 1544 shdr = (Shdr *)(shbase + off); 1545 1546 if (shdr->sh_name >= shstrsize) 1547 continue; 1548 1549 name = shstrbase + shdr->sh_name; 1550 1551 if (strcmp(name, shstrtab_data[STR_CTF]) == 0) { 1552 if ((content & CC_CONTENT_CTF) == 0 || 1553 ctf_ndx != 0) 1554 continue; 1555 1556 if (shdr->sh_link > 0 && 1557 shdr->sh_link < nshdrs) { 1558 symtab = (Shdr *)(shbase + 1559 shdr->sh_link * ehdr.e_shentsize); 1560 } 1561 1562 if (v != NULL && i < nv - 1) { 1563 if (shdr->sh_size > datasz && 1564 shdr->sh_size <= elf_datasz_max) { 1565 if (data != NULL) 1566 kmem_free(data, datasz); 1567 1568 datasz = shdr->sh_size; 1569 data = kmem_alloc(datasz, 1570 KM_SLEEP); 1571 } 1572 1573 v[i].sh_name = shstrtab_ndx(&shstrtab, 1574 STR_CTF); 1575 v[i].sh_addr = (Addr)(uintptr_t)saddr; 1576 v[i].sh_type = SHT_PROGBITS; 1577 v[i].sh_addralign = 4; 1578 *doffsetp = roundup(*doffsetp, 1579 v[i].sh_addralign); 1580 v[i].sh_offset = *doffsetp; 1581 v[i].sh_size = shdr->sh_size; 1582 if (symtab == NULL) { 1583 v[i].sh_link = 0; 1584 } else if (symtab->sh_type == 1585 SHT_SYMTAB && 1586 symtab_ndx != 0) { 1587 v[i].sh_link = 1588 symtab_ndx; 1589 } else { 1590 v[i].sh_link = i + 1; 1591 } 1592 1593 copy_scn(shdr, mvp, &v[i], vp, 1594 doffsetp, data, datasz, credp, 1595 rlimit); 1596 } 1597 1598 ctf_ndx = i++; 1599 1600 /* 1601 * We've already dumped the symtab. 1602 */ 1603 if (symtab != NULL && 1604 symtab->sh_type == SHT_SYMTAB && 1605 symtab_ndx != 0) 1606 continue; 1607 1608 } else if (strcmp(name, 1609 shstrtab_data[STR_SYMTAB]) == 0) { 1610 if ((content & CC_CONTENT_SYMTAB) == 0 || 1611 symtab != 0) 1612 continue; 1613 1614 symtab = shdr; 1615 } 1616 1617 if (symtab != NULL) { 1618 if ((symtab->sh_type != SHT_DYNSYM && 1619 symtab->sh_type != SHT_SYMTAB) || 1620 symtab->sh_link == 0 || 1621 symtab->sh_link >= nshdrs) 1622 continue; 1623 1624 strtab = (Shdr *)(shbase + 1625 symtab->sh_link * ehdr.e_shentsize); 1626 1627 if (strtab->sh_type != SHT_STRTAB) 1628 continue; 1629 1630 if (v != NULL && i < nv - 2) { 1631 sz = MAX(symtab->sh_size, 1632 strtab->sh_size); 1633 if (sz > datasz && 1634 sz <= elf_datasz_max) { 1635 if (data != NULL) 1636 kmem_free(data, datasz); 1637 1638 datasz = sz; 1639 data = kmem_alloc(datasz, 1640 KM_SLEEP); 1641 } 1642 1643 if (symtab->sh_type == SHT_DYNSYM) { 1644 v[i].sh_name = shstrtab_ndx( 1645 &shstrtab, STR_DYNSYM); 1646 v[i + 1].sh_name = shstrtab_ndx( 1647 &shstrtab, STR_DYNSTR); 1648 } else { 1649 v[i].sh_name = shstrtab_ndx( 1650 &shstrtab, STR_SYMTAB); 1651 v[i + 1].sh_name = shstrtab_ndx( 1652 &shstrtab, STR_STRTAB); 1653 } 1654 1655 v[i].sh_type = symtab->sh_type; 1656 v[i].sh_addr = symtab->sh_addr; 1657 if (ehdr.e_type == ET_DYN || 1658 v[i].sh_addr == 0) 1659 v[i].sh_addr += 1660 (Addr)(uintptr_t)saddr; 1661 v[i].sh_addralign = 1662 symtab->sh_addralign; 1663 *doffsetp = roundup(*doffsetp, 1664 v[i].sh_addralign); 1665 v[i].sh_offset = *doffsetp; 1666 v[i].sh_size = symtab->sh_size; 1667 v[i].sh_link = i + 1; 1668 v[i].sh_entsize = symtab->sh_entsize; 1669 v[i].sh_info = symtab->sh_info; 1670 1671 copy_scn(symtab, mvp, &v[i], vp, 1672 doffsetp, data, datasz, credp, 1673 rlimit); 1674 1675 v[i + 1].sh_type = SHT_STRTAB; 1676 v[i + 1].sh_flags = SHF_STRINGS; 1677 v[i + 1].sh_addr = symtab->sh_addr; 1678 if (ehdr.e_type == ET_DYN || 1679 v[i + 1].sh_addr == 0) 1680 v[i + 1].sh_addr += 1681 (Addr)(uintptr_t)saddr; 1682 v[i + 1].sh_addralign = 1683 strtab->sh_addralign; 1684 *doffsetp = roundup(*doffsetp, 1685 v[i + 1].sh_addralign); 1686 v[i + 1].sh_offset = *doffsetp; 1687 v[i + 1].sh_size = strtab->sh_size; 1688 1689 copy_scn(strtab, mvp, &v[i + 1], vp, 1690 doffsetp, data, datasz, credp, 1691 rlimit); 1692 } 1693 1694 if (symtab->sh_type == SHT_SYMTAB) 1695 symtab_ndx = i; 1696 i += 2; 1697 } 1698 } 1699 1700 kmem_free(shstrbase, shstrsize); 1701 kmem_free(shbase, shsize); 1702 1703 lastvp = mvp; 1704 } 1705 1706 if (v == NULL) { 1707 if (i == 1) 1708 *nshdrsp = 0; 1709 else 1710 *nshdrsp = i + 1; 1711 goto done; 1712 } 1713 1714 if (i != nv - 1) { 1715 cmn_err(CE_WARN, "elfcore: core dump failed for " 1716 "process %d; address space is changing", p->p_pid); 1717 error = EIO; 1718 goto done; 1719 } 1720 1721 v[i].sh_name = shstrtab_ndx(&shstrtab, STR_SHSTRTAB); 1722 v[i].sh_size = shstrtab_size(&shstrtab); 1723 v[i].sh_addralign = 1; 1724 *doffsetp = roundup(*doffsetp, v[i].sh_addralign); 1725 v[i].sh_offset = *doffsetp; 1726 v[i].sh_flags = SHF_STRINGS; 1727 v[i].sh_type = SHT_STRTAB; 1728 1729 if (v[i].sh_size > datasz) { 1730 if (data != NULL) 1731 kmem_free(data, datasz); 1732 1733 datasz = v[i].sh_size; 1734 data = kmem_alloc(datasz, 1735 KM_SLEEP); 1736 } 1737 1738 shstrtab_dump(&shstrtab, data); 1739 1740 if ((error = core_write(vp, UIO_SYSSPACE, *doffsetp, 1741 data, v[i].sh_size, rlimit, credp)) != 0) 1742 goto done; 1743 1744 *doffsetp += v[i].sh_size; 1745 1746 done: 1747 if (data != NULL) 1748 kmem_free(data, datasz); 1749 1750 return (error); 1751 } 1752 1753 int 1754 elfcore(vnode_t *vp, proc_t *p, cred_t *credp, rlim64_t rlimit, int sig, 1755 core_content_t content) 1756 { 1757 offset_t poffset, soffset; 1758 Off doffset; 1759 int error, i, nphdrs, nshdrs; 1760 int overflow = 0; 1761 struct seg *seg; 1762 struct as *as = p->p_as; 1763 union { 1764 Ehdr ehdr; 1765 Phdr phdr[1]; 1766 Shdr shdr[1]; 1767 } *bigwad; 1768 size_t bigsize; 1769 size_t phdrsz, shdrsz; 1770 Ehdr *ehdr; 1771 Phdr *v; 1772 caddr_t brkbase; 1773 size_t brksize; 1774 caddr_t stkbase; 1775 size_t stksize; 1776 int ntries = 0; 1777 klwp_t *lwp = ttolwp(curthread); 1778 1779 top: 1780 /* 1781 * Make sure we have everything we need (registers, etc.). 1782 * All other lwps have already stopped and are in an orderly state. 1783 */ 1784 ASSERT(p == ttoproc(curthread)); 1785 prstop(0, 0); 1786 1787 AS_LOCK_ENTER(as, RW_WRITER); 1788 nphdrs = prnsegs(as, 0) + 2; /* two CORE note sections */ 1789 1790 /* 1791 * Count the number of section headers we're going to need. 1792 */ 1793 nshdrs = 0; 1794 if (content & (CC_CONTENT_CTF | CC_CONTENT_SYMTAB)) { 1795 (void) process_scns(content, p, credp, NULL, NULL, NULL, 0, 1796 NULL, &nshdrs); 1797 } 1798 AS_LOCK_EXIT(as); 1799 1800 ASSERT(nshdrs == 0 || nshdrs > 1); 1801 1802 /* 1803 * The core file contents may required zero section headers, but if 1804 * we overflow the 16 bits allotted to the program header count in 1805 * the ELF header, we'll need that program header at index zero. 1806 */ 1807 if (nshdrs == 0 && nphdrs >= PN_XNUM) 1808 nshdrs = 1; 1809 1810 phdrsz = nphdrs * sizeof (Phdr); 1811 shdrsz = nshdrs * sizeof (Shdr); 1812 1813 bigsize = MAX(sizeof (*bigwad), MAX(phdrsz, shdrsz)); 1814 bigwad = kmem_alloc(bigsize, KM_SLEEP); 1815 1816 ehdr = &bigwad->ehdr; 1817 bzero(ehdr, sizeof (*ehdr)); 1818 1819 ehdr->e_ident[EI_MAG0] = ELFMAG0; 1820 ehdr->e_ident[EI_MAG1] = ELFMAG1; 1821 ehdr->e_ident[EI_MAG2] = ELFMAG2; 1822 ehdr->e_ident[EI_MAG3] = ELFMAG3; 1823 ehdr->e_ident[EI_CLASS] = ELFCLASS; 1824 ehdr->e_type = ET_CORE; 1825 1826 #if !defined(_LP64) || defined(_ELF32_COMPAT) 1827 1828 #if defined(__sparc) 1829 ehdr->e_ident[EI_DATA] = ELFDATA2MSB; 1830 ehdr->e_machine = EM_SPARC; 1831 #elif defined(__i386) || defined(__i386_COMPAT) 1832 ehdr->e_ident[EI_DATA] = ELFDATA2LSB; 1833 ehdr->e_machine = EM_386; 1834 #else 1835 #error "no recognized machine type is defined" 1836 #endif 1837 1838 #else /* !defined(_LP64) || defined(_ELF32_COMPAT) */ 1839 1840 #if defined(__sparc) 1841 ehdr->e_ident[EI_DATA] = ELFDATA2MSB; 1842 ehdr->e_machine = EM_SPARCV9; 1843 #elif defined(__amd64) 1844 ehdr->e_ident[EI_DATA] = ELFDATA2LSB; 1845 ehdr->e_machine = EM_AMD64; 1846 #else 1847 #error "no recognized 64-bit machine type is defined" 1848 #endif 1849 1850 #endif /* !defined(_LP64) || defined(_ELF32_COMPAT) */ 1851 1852 /* 1853 * If the count of program headers or section headers or the index 1854 * of the section string table can't fit in the mere 16 bits 1855 * shortsightedly allotted to them in the ELF header, we use the 1856 * extended formats and put the real values in the section header 1857 * as index 0. 1858 */ 1859 ehdr->e_version = EV_CURRENT; 1860 ehdr->e_ehsize = sizeof (Ehdr); 1861 1862 if (nphdrs >= PN_XNUM) 1863 ehdr->e_phnum = PN_XNUM; 1864 else 1865 ehdr->e_phnum = (unsigned short)nphdrs; 1866 1867 ehdr->e_phoff = sizeof (Ehdr); 1868 ehdr->e_phentsize = sizeof (Phdr); 1869 1870 if (nshdrs > 0) { 1871 if (nshdrs >= SHN_LORESERVE) 1872 ehdr->e_shnum = 0; 1873 else 1874 ehdr->e_shnum = (unsigned short)nshdrs; 1875 1876 if (nshdrs - 1 >= SHN_LORESERVE) 1877 ehdr->e_shstrndx = SHN_XINDEX; 1878 else 1879 ehdr->e_shstrndx = (unsigned short)(nshdrs - 1); 1880 1881 ehdr->e_shoff = ehdr->e_phoff + ehdr->e_phentsize * nphdrs; 1882 ehdr->e_shentsize = sizeof (Shdr); 1883 } 1884 1885 if (error = core_write(vp, UIO_SYSSPACE, (offset_t)0, ehdr, 1886 sizeof (Ehdr), rlimit, credp)) 1887 goto done; 1888 1889 poffset = sizeof (Ehdr); 1890 soffset = sizeof (Ehdr) + phdrsz; 1891 doffset = sizeof (Ehdr) + phdrsz + shdrsz; 1892 1893 v = &bigwad->phdr[0]; 1894 bzero(v, phdrsz); 1895 1896 setup_old_note_header(&v[0], p); 1897 v[0].p_offset = doffset = roundup(doffset, sizeof (Word)); 1898 doffset += v[0].p_filesz; 1899 1900 setup_note_header(&v[1], p); 1901 v[1].p_offset = doffset = roundup(doffset, sizeof (Word)); 1902 doffset += v[1].p_filesz; 1903 1904 mutex_enter(&p->p_lock); 1905 1906 brkbase = p->p_brkbase; 1907 brksize = p->p_brksize; 1908 1909 stkbase = p->p_usrstack - p->p_stksize; 1910 stksize = p->p_stksize; 1911 1912 mutex_exit(&p->p_lock); 1913 1914 AS_LOCK_ENTER(as, RW_WRITER); 1915 i = 2; 1916 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) { 1917 caddr_t eaddr = seg->s_base + pr_getsegsize(seg, 0); 1918 caddr_t saddr, naddr; 1919 void *tmp = NULL; 1920 extern struct seg_ops segspt_shmops; 1921 1922 for (saddr = seg->s_base; saddr < eaddr; saddr = naddr) { 1923 uint_t prot; 1924 size_t size; 1925 int type; 1926 vnode_t *mvp; 1927 1928 prot = pr_getprot(seg, 0, &tmp, &saddr, &naddr, eaddr); 1929 prot &= PROT_READ | PROT_WRITE | PROT_EXEC; 1930 if ((size = (size_t)(naddr - saddr)) == 0) 1931 continue; 1932 if (i == nphdrs) { 1933 overflow++; 1934 continue; 1935 } 1936 v[i].p_type = PT_LOAD; 1937 v[i].p_vaddr = (Addr)(uintptr_t)saddr; 1938 v[i].p_memsz = size; 1939 if (prot & PROT_READ) 1940 v[i].p_flags |= PF_R; 1941 if (prot & PROT_WRITE) 1942 v[i].p_flags |= PF_W; 1943 if (prot & PROT_EXEC) 1944 v[i].p_flags |= PF_X; 1945 1946 /* 1947 * Figure out which mappings to include in the core. 1948 */ 1949 type = SEGOP_GETTYPE(seg, saddr); 1950 1951 if (saddr == stkbase && size == stksize) { 1952 if (!(content & CC_CONTENT_STACK)) 1953 goto exclude; 1954 1955 } else if (saddr == brkbase && size == brksize) { 1956 if (!(content & CC_CONTENT_HEAP)) 1957 goto exclude; 1958 1959 } else if (seg->s_ops == &segspt_shmops) { 1960 if (type & MAP_NORESERVE) { 1961 if (!(content & CC_CONTENT_DISM)) 1962 goto exclude; 1963 } else { 1964 if (!(content & CC_CONTENT_ISM)) 1965 goto exclude; 1966 } 1967 1968 } else if (seg->s_ops != &segvn_ops) { 1969 goto exclude; 1970 1971 } else if (type & MAP_SHARED) { 1972 if (shmgetid(p, saddr) != SHMID_NONE) { 1973 if (!(content & CC_CONTENT_SHM)) 1974 goto exclude; 1975 1976 } else if (SEGOP_GETVP(seg, seg->s_base, 1977 &mvp) != 0 || mvp == NULL || 1978 mvp->v_type != VREG) { 1979 if (!(content & CC_CONTENT_SHANON)) 1980 goto exclude; 1981 1982 } else { 1983 if (!(content & CC_CONTENT_SHFILE)) 1984 goto exclude; 1985 } 1986 1987 } else if (SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 || 1988 mvp == NULL || mvp->v_type != VREG) { 1989 if (!(content & CC_CONTENT_ANON)) 1990 goto exclude; 1991 1992 } else if (prot == (PROT_READ | PROT_EXEC)) { 1993 if (!(content & CC_CONTENT_TEXT)) 1994 goto exclude; 1995 1996 } else if (prot == PROT_READ) { 1997 if (!(content & CC_CONTENT_RODATA)) 1998 goto exclude; 1999 2000 } else { 2001 if (!(content & CC_CONTENT_DATA)) 2002 goto exclude; 2003 } 2004 2005 doffset = roundup(doffset, sizeof (Word)); 2006 v[i].p_offset = doffset; 2007 v[i].p_filesz = size; 2008 doffset += size; 2009 exclude: 2010 i++; 2011 } 2012 ASSERT(tmp == NULL); 2013 } 2014 AS_LOCK_EXIT(as); 2015 2016 if (overflow || i != nphdrs) { 2017 if (ntries++ == 0) { 2018 kmem_free(bigwad, bigsize); 2019 overflow = 0; 2020 goto top; 2021 } 2022 cmn_err(CE_WARN, "elfcore: core dump failed for " 2023 "process %d; address space is changing", p->p_pid); 2024 error = EIO; 2025 goto done; 2026 } 2027 2028 if ((error = core_write(vp, UIO_SYSSPACE, poffset, 2029 v, phdrsz, rlimit, credp)) != 0) 2030 goto done; 2031 2032 if ((error = write_old_elfnotes(p, sig, vp, v[0].p_offset, rlimit, 2033 credp)) != 0) 2034 goto done; 2035 2036 if ((error = write_elfnotes(p, sig, vp, v[1].p_offset, rlimit, 2037 credp, content)) != 0) 2038 goto done; 2039 2040 for (i = 2; i < nphdrs; i++) { 2041 prkillinfo_t killinfo; 2042 sigqueue_t *sq; 2043 int sig, j; 2044 2045 if (v[i].p_filesz == 0) 2046 continue; 2047 2048 /* 2049 * If dumping out this segment fails, rather than failing 2050 * the core dump entirely, we reset the size of the mapping 2051 * to zero to indicate that the data is absent from the core 2052 * file and or in the PF_SUNW_FAILURE flag to differentiate 2053 * this from mappings that were excluded due to the core file 2054 * content settings. 2055 */ 2056 if ((error = core_seg(p, vp, v[i].p_offset, 2057 (caddr_t)(uintptr_t)v[i].p_vaddr, v[i].p_filesz, 2058 rlimit, credp)) == 0) { 2059 continue; 2060 } 2061 2062 if ((sig = lwp->lwp_cursig) == 0) { 2063 /* 2064 * We failed due to something other than a signal. 2065 * Since the space reserved for the segment is now 2066 * unused, we stash the errno in the first four 2067 * bytes. This undocumented interface will let us 2068 * understand the nature of the failure. 2069 */ 2070 (void) core_write(vp, UIO_SYSSPACE, v[i].p_offset, 2071 &error, sizeof (error), rlimit, credp); 2072 2073 v[i].p_filesz = 0; 2074 v[i].p_flags |= PF_SUNW_FAILURE; 2075 if ((error = core_write(vp, UIO_SYSSPACE, 2076 poffset + sizeof (v[i]) * i, &v[i], sizeof (v[i]), 2077 rlimit, credp)) != 0) 2078 goto done; 2079 2080 continue; 2081 } 2082 2083 /* 2084 * We took a signal. We want to abort the dump entirely, but 2085 * we also want to indicate what failed and why. We therefore 2086 * use the space reserved for the first failing segment to 2087 * write our error (which, for purposes of compatability with 2088 * older core dump readers, we set to EINTR) followed by any 2089 * siginfo associated with the signal. 2090 */ 2091 bzero(&killinfo, sizeof (killinfo)); 2092 killinfo.prk_error = EINTR; 2093 2094 sq = sig == SIGKILL ? curproc->p_killsqp : lwp->lwp_curinfo; 2095 2096 if (sq != NULL) { 2097 bcopy(&sq->sq_info, &killinfo.prk_info, 2098 sizeof (sq->sq_info)); 2099 } else { 2100 killinfo.prk_info.si_signo = lwp->lwp_cursig; 2101 killinfo.prk_info.si_code = SI_NOINFO; 2102 } 2103 2104 #if (defined(_SYSCALL32_IMPL) || defined(_LP64)) 2105 /* 2106 * If this is a 32-bit process, we need to translate from the 2107 * native siginfo to the 32-bit variant. (Core readers must 2108 * always have the same data model as their target or must 2109 * be aware of -- and compensate for -- data model differences.) 2110 */ 2111 if (curproc->p_model == DATAMODEL_ILP32) { 2112 siginfo32_t si32; 2113 2114 siginfo_kto32((k_siginfo_t *)&killinfo.prk_info, &si32); 2115 bcopy(&si32, &killinfo.prk_info, sizeof (si32)); 2116 } 2117 #endif 2118 2119 (void) core_write(vp, UIO_SYSSPACE, v[i].p_offset, 2120 &killinfo, sizeof (killinfo), rlimit, credp); 2121 2122 /* 2123 * For the segment on which we took the signal, indicate that 2124 * its data now refers to a siginfo. 2125 */ 2126 v[i].p_filesz = 0; 2127 v[i].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED | 2128 PF_SUNW_SIGINFO; 2129 2130 /* 2131 * And for every other segment, indicate that its absence 2132 * is due to a signal. 2133 */ 2134 for (j = i + 1; j < nphdrs; j++) { 2135 v[j].p_filesz = 0; 2136 v[j].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED; 2137 } 2138 2139 /* 2140 * Finally, write out our modified program headers. 2141 */ 2142 if ((error = core_write(vp, UIO_SYSSPACE, 2143 poffset + sizeof (v[i]) * i, &v[i], 2144 sizeof (v[i]) * (nphdrs - i), rlimit, credp)) != 0) 2145 goto done; 2146 2147 break; 2148 } 2149 2150 if (nshdrs > 0) { 2151 bzero(&bigwad->shdr[0], shdrsz); 2152 2153 if (nshdrs >= SHN_LORESERVE) 2154 bigwad->shdr[0].sh_size = nshdrs; 2155 2156 if (nshdrs - 1 >= SHN_LORESERVE) 2157 bigwad->shdr[0].sh_link = nshdrs - 1; 2158 2159 if (nphdrs >= PN_XNUM) 2160 bigwad->shdr[0].sh_info = nphdrs; 2161 2162 if (nshdrs > 1) { 2163 AS_LOCK_ENTER(as, RW_WRITER); 2164 if ((error = process_scns(content, p, credp, vp, 2165 &bigwad->shdr[0], nshdrs, rlimit, &doffset, 2166 NULL)) != 0) { 2167 AS_LOCK_EXIT(as); 2168 goto done; 2169 } 2170 AS_LOCK_EXIT(as); 2171 } 2172 2173 if ((error = core_write(vp, UIO_SYSSPACE, soffset, 2174 &bigwad->shdr[0], shdrsz, rlimit, credp)) != 0) 2175 goto done; 2176 } 2177 2178 done: 2179 kmem_free(bigwad, bigsize); 2180 return (error); 2181 } 2182 2183 #ifndef _ELF32_COMPAT 2184 2185 static struct execsw esw = { 2186 #ifdef _LP64 2187 elf64magicstr, 2188 #else /* _LP64 */ 2189 elf32magicstr, 2190 #endif /* _LP64 */ 2191 0, 2192 5, 2193 elfexec, 2194 elfcore 2195 }; 2196 2197 static struct modlexec modlexec = { 2198 &mod_execops, "exec module for elf", &esw 2199 }; 2200 2201 #ifdef _LP64 2202 extern int elf32exec(vnode_t *vp, execa_t *uap, uarg_t *args, 2203 intpdata_t *idatap, int level, long *execsz, 2204 int setid, caddr_t exec_file, cred_t *cred, 2205 int brand_action); 2206 extern int elf32core(vnode_t *vp, proc_t *p, cred_t *credp, 2207 rlim64_t rlimit, int sig, core_content_t content); 2208 2209 static struct execsw esw32 = { 2210 elf32magicstr, 2211 0, 2212 5, 2213 elf32exec, 2214 elf32core 2215 }; 2216 2217 static struct modlexec modlexec32 = { 2218 &mod_execops, "32-bit exec module for elf", &esw32 2219 }; 2220 #endif /* _LP64 */ 2221 2222 static struct modlinkage modlinkage = { 2223 MODREV_1, 2224 (void *)&modlexec, 2225 #ifdef _LP64 2226 (void *)&modlexec32, 2227 #endif /* _LP64 */ 2228 NULL 2229 }; 2230 2231 int 2232 _init(void) 2233 { 2234 return (mod_install(&modlinkage)); 2235 } 2236 2237 int 2238 _fini(void) 2239 { 2240 return (mod_remove(&modlinkage)); 2241 } 2242 2243 int 2244 _info(struct modinfo *modinfop) 2245 { 2246 return (mod_info(&modlinkage, modinfop)); 2247 } 2248 2249 #endif /* !_ELF32_COMPAT */ 2250