xref: /titanic_50/usr/src/uts/common/exec/elf/elf.c (revision 7b2cbac6bdd0f33171865b3ab8e08e8528c60d2c)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
28 /*	  All Rights Reserved  	*/
29 
30 
31 #pragma ident	"%Z%%M%	%I%	%E% SMI"
32 
33 #include <sys/types.h>
34 #include <sys/param.h>
35 #include <sys/thread.h>
36 #include <sys/sysmacros.h>
37 #include <sys/signal.h>
38 #include <sys/cred.h>
39 #include <sys/user.h>
40 #include <sys/errno.h>
41 #include <sys/vnode.h>
42 #include <sys/mman.h>
43 #include <sys/kmem.h>
44 #include <sys/proc.h>
45 #include <sys/pathname.h>
46 #include <sys/cmn_err.h>
47 #include <sys/systm.h>
48 #include <sys/elf.h>
49 #include <sys/vmsystm.h>
50 #include <sys/debug.h>
51 #include <sys/auxv.h>
52 #include <sys/exec.h>
53 #include <sys/prsystm.h>
54 #include <vm/as.h>
55 #include <vm/rm.h>
56 #include <vm/seg.h>
57 #include <vm/seg_vn.h>
58 #include <sys/modctl.h>
59 #include <sys/systeminfo.h>
60 #include <sys/vmparam.h>
61 #include <sys/machelf.h>
62 #include <sys/shm_impl.h>
63 #include <sys/archsystm.h>
64 #include <sys/fasttrap.h>
65 #include <sys/brand.h>
66 #include "elf_impl.h"
67 
68 #include <sys/sdt.h>
69 
70 extern int at_flags;
71 
72 #define	ORIGIN_STR	"ORIGIN"
73 #define	ORIGIN_STR_SIZE	6
74 
75 static int getelfhead(vnode_t *, cred_t *, Ehdr *, int *, int *, int *);
76 static int getelfphdr(vnode_t *, cred_t *, const Ehdr *, int, caddr_t *,
77     ssize_t *);
78 static int getelfshdr(vnode_t *, cred_t *, const Ehdr *, int, int, caddr_t *,
79     ssize_t *, caddr_t *, ssize_t *);
80 static size_t elfsize(Ehdr *, int, caddr_t, uintptr_t *);
81 static int mapelfexec(vnode_t *, Ehdr *, int, caddr_t,
82     Phdr **, Phdr **, Phdr **, Phdr **, Phdr *,
83     caddr_t *, caddr_t *, intptr_t *, intptr_t *, size_t, long *, size_t *);
84 
85 typedef enum {
86 	STR_CTF,
87 	STR_SYMTAB,
88 	STR_DYNSYM,
89 	STR_STRTAB,
90 	STR_DYNSTR,
91 	STR_SHSTRTAB,
92 	STR_NUM
93 } shstrtype_t;
94 
95 static const char *shstrtab_data[] = {
96 	".SUNW_ctf",
97 	".symtab",
98 	".dynsym",
99 	".strtab",
100 	".dynstr",
101 	".shstrtab"
102 };
103 
104 typedef struct shstrtab {
105 	int	sst_ndx[STR_NUM];
106 	int	sst_cur;
107 } shstrtab_t;
108 
109 static void
110 shstrtab_init(shstrtab_t *s)
111 {
112 	bzero(&s->sst_ndx, sizeof (s->sst_ndx));
113 	s->sst_cur = 1;
114 }
115 
116 static int
117 shstrtab_ndx(shstrtab_t *s, shstrtype_t type)
118 {
119 	int ret;
120 
121 	if ((ret = s->sst_ndx[type]) != 0)
122 		return (ret);
123 
124 	ret = s->sst_ndx[type] = s->sst_cur;
125 	s->sst_cur += strlen(shstrtab_data[type]) + 1;
126 
127 	return (ret);
128 }
129 
130 static size_t
131 shstrtab_size(const shstrtab_t *s)
132 {
133 	return (s->sst_cur);
134 }
135 
136 static void
137 shstrtab_dump(const shstrtab_t *s, char *buf)
138 {
139 	int i, ndx;
140 
141 	*buf = '\0';
142 	for (i = 0; i < STR_NUM; i++) {
143 		if ((ndx = s->sst_ndx[i]) != 0)
144 			(void) strcpy(buf + ndx, shstrtab_data[i]);
145 	}
146 }
147 
148 static int
149 dtrace_safe_phdr(Phdr *phdrp, struct uarg *args, uintptr_t base)
150 {
151 	ASSERT(phdrp->p_type == PT_SUNWDTRACE);
152 
153 	/*
154 	 * See the comment in fasttrap.h for information on how to safely
155 	 * update this program header.
156 	 */
157 	if (phdrp->p_memsz < PT_SUNWDTRACE_SIZE ||
158 	    (phdrp->p_flags & (PF_R | PF_W | PF_X)) != (PF_R | PF_W | PF_X))
159 		return (-1);
160 
161 	args->thrptr = phdrp->p_vaddr + base;
162 
163 	return (0);
164 }
165 
166 /*
167  * Map in the executable pointed to by vp. Returns 0 on success.
168  */
169 int
170 mapexec_brand(vnode_t *vp, uarg_t *args, Ehdr *ehdr, Addr *uphdr_vaddr,
171     intptr_t *voffset, caddr_t exec_file, int *interp, caddr_t *bssbase,
172     caddr_t *brkbase, size_t *brksize, uintptr_t *lddatap)
173 {
174 	size_t		len;
175 	struct vattr	vat;
176 	caddr_t		phdrbase = NULL;
177 	ssize_t		phdrsize;
178 	int		nshdrs, shstrndx, nphdrs;
179 	int		error = 0;
180 	Phdr		*uphdr = NULL;
181 	Phdr		*junk = NULL;
182 	Phdr		*dynphdr = NULL;
183 	Phdr		*dtrphdr = NULL;
184 	uintptr_t	lddata;
185 	long		execsz;
186 	intptr_t	minaddr;
187 
188 	if (lddatap != NULL)
189 		*lddatap = NULL;
190 
191 	if (error = execpermissions(vp, &vat, args)) {
192 		uprintf("%s: Cannot execute %s\n", exec_file, args->pathname);
193 		return (error);
194 	}
195 
196 	if ((error = getelfhead(vp, CRED(), ehdr, &nshdrs, &shstrndx,
197 	    &nphdrs)) != 0 ||
198 	    (error = getelfphdr(vp, CRED(), ehdr, nphdrs, &phdrbase,
199 	    &phdrsize)) != 0) {
200 		uprintf("%s: Cannot read %s\n", exec_file, args->pathname);
201 		return (error);
202 	}
203 
204 	if ((len = elfsize(ehdr, nphdrs, phdrbase, &lddata)) == 0) {
205 		uprintf("%s: Nothing to load in %s", exec_file, args->pathname);
206 		kmem_free(phdrbase, phdrsize);
207 		return (ENOEXEC);
208 	}
209 	if (lddatap != NULL)
210 		*lddatap = lddata;
211 
212 	if (error = mapelfexec(vp, ehdr, nphdrs, phdrbase, &uphdr, &dynphdr,
213 	    &junk, &dtrphdr, NULL, bssbase, brkbase, voffset, &minaddr,
214 	    len, &execsz, brksize)) {
215 		uprintf("%s: Cannot map %s\n", exec_file, args->pathname);
216 		kmem_free(phdrbase, phdrsize);
217 		return (error);
218 	}
219 
220 	/*
221 	 * Inform our caller if the executable needs an interpreter.
222 	 */
223 	*interp = (dynphdr == NULL) ? 0 : 1;
224 
225 	/*
226 	 * If this is a statically linked executable, voffset should indicate
227 	 * the address of the executable itself (it normally holds the address
228 	 * of the interpreter).
229 	 */
230 	if (ehdr->e_type == ET_EXEC && *interp == 0)
231 		*voffset = minaddr;
232 
233 	if (uphdr != NULL) {
234 		*uphdr_vaddr = uphdr->p_vaddr;
235 	} else {
236 		*uphdr_vaddr = (Addr)-1;
237 	}
238 
239 	kmem_free(phdrbase, phdrsize);
240 	return (error);
241 }
242 
243 /*ARGSUSED*/
244 int
245 elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
246     int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred,
247     int brand_action)
248 {
249 	caddr_t		phdrbase = NULL;
250 	caddr_t 	bssbase = 0;
251 	caddr_t 	brkbase = 0;
252 	size_t		brksize = 0;
253 	ssize_t		dlnsize;
254 	aux_entry_t	*aux;
255 	int		error;
256 	ssize_t		resid;
257 	int		fd = -1;
258 	intptr_t	voffset;
259 	Phdr		*dyphdr = NULL;
260 	Phdr		*stphdr = NULL;
261 	Phdr		*uphdr = NULL;
262 	Phdr		*junk = NULL;
263 	size_t		len;
264 	ssize_t		phdrsize;
265 	int		postfixsize = 0;
266 	int		i, hsize;
267 	Phdr		*phdrp;
268 	Phdr		*dataphdrp = NULL;
269 	Phdr		*dtrphdr;
270 	int		hasu = 0;
271 	int		hasauxv = 0;
272 	int		hasdy = 0;
273 	int		branded = 0;
274 
275 	struct proc *p = ttoproc(curthread);
276 	struct user *up = PTOU(p);
277 	struct bigwad {
278 		Ehdr	ehdr;
279 		aux_entry_t	elfargs[__KERN_NAUXV_IMPL];
280 		char		dl_name[MAXPATHLEN];
281 		char		pathbuf[MAXPATHLEN];
282 		struct vattr	vattr;
283 		struct execenv	exenv;
284 	} *bigwad;	/* kmem_alloc this behemoth so we don't blow stack */
285 	Ehdr		*ehdrp;
286 	int		nshdrs, shstrndx, nphdrs;
287 	char		*dlnp;
288 	char		*pathbufp;
289 	rlim64_t	limit;
290 	rlim64_t	roundlimit;
291 
292 	ASSERT(p->p_model == DATAMODEL_ILP32 || p->p_model == DATAMODEL_LP64);
293 
294 	bigwad = kmem_alloc(sizeof (struct bigwad), KM_SLEEP);
295 	ehdrp = &bigwad->ehdr;
296 	dlnp = bigwad->dl_name;
297 	pathbufp = bigwad->pathbuf;
298 
299 	/*
300 	 * Obtain ELF and program header information.
301 	 */
302 	if ((error = getelfhead(vp, CRED(), ehdrp, &nshdrs, &shstrndx,
303 	    &nphdrs)) != 0 ||
304 	    (error = getelfphdr(vp, CRED(), ehdrp, nphdrs, &phdrbase,
305 	    &phdrsize)) != 0)
306 		goto out;
307 
308 	/*
309 	 * Prevent executing an ELF file that has no entry point.
310 	 */
311 	if (ehdrp->e_entry == 0) {
312 		uprintf("%s: Bad entry point\n", exec_file);
313 		goto bad;
314 	}
315 
316 	/*
317 	 * Put data model that we're exec-ing to into the args passed to
318 	 * exec_args(), so it will know what it is copying to on new stack.
319 	 * Now that we know whether we are exec-ing a 32-bit or 64-bit
320 	 * executable, we can set execsz with the appropriate NCARGS.
321 	 */
322 #ifdef	_LP64
323 	if (ehdrp->e_ident[EI_CLASS] == ELFCLASS32) {
324 		args->to_model = DATAMODEL_ILP32;
325 		*execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS32-1);
326 	} else {
327 		args->to_model = DATAMODEL_LP64;
328 		args->stk_prot &= ~PROT_EXEC;
329 #if defined(__i386) || defined(__amd64)
330 		args->dat_prot &= ~PROT_EXEC;
331 #endif
332 		*execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS64-1);
333 	}
334 #else	/* _LP64 */
335 	args->to_model = DATAMODEL_ILP32;
336 	*execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS-1);
337 #endif	/* _LP64 */
338 
339 	/*
340 	 * We delay invoking the brand callback until we've figured out
341 	 * what kind of elf binary we're trying to run, 32-bit or 64-bit.
342 	 * We do this because now the brand library can just check
343 	 * args->to_model to see if the target is 32-bit or 64-bit without
344 	 * having do duplicate all the code above.
345 	 */
346 	if ((level < 2) &&
347 	    (brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
348 		error = BROP(p)->b_elfexec(vp, uap, args,
349 		    idatap, level + 1, execsz, setid, exec_file, cred,
350 		    brand_action);
351 		goto out;
352 	}
353 
354 	/*
355 	 * Determine aux size now so that stack can be built
356 	 * in one shot (except actual copyout of aux image),
357 	 * determine any non-default stack protections,
358 	 * and still have this code be machine independent.
359 	 */
360 	hsize = ehdrp->e_phentsize;
361 	phdrp = (Phdr *)phdrbase;
362 	for (i = nphdrs; i > 0; i--) {
363 		switch (phdrp->p_type) {
364 		case PT_INTERP:
365 			hasauxv = hasdy = 1;
366 			break;
367 		case PT_PHDR:
368 			hasu = 1;
369 			break;
370 		case PT_SUNWSTACK:
371 			args->stk_prot = PROT_USER;
372 			if (phdrp->p_flags & PF_R)
373 				args->stk_prot |= PROT_READ;
374 			if (phdrp->p_flags & PF_W)
375 				args->stk_prot |= PROT_WRITE;
376 			if (phdrp->p_flags & PF_X)
377 				args->stk_prot |= PROT_EXEC;
378 			break;
379 		case PT_LOAD:
380 			dataphdrp = phdrp;
381 			break;
382 		}
383 		phdrp = (Phdr *)((caddr_t)phdrp + hsize);
384 	}
385 
386 	if (ehdrp->e_type != ET_EXEC) {
387 		dataphdrp = NULL;
388 		hasauxv = 1;
389 	}
390 
391 	/* Copy BSS permissions to args->dat_prot */
392 	if (dataphdrp != NULL) {
393 		args->dat_prot = PROT_USER;
394 		if (dataphdrp->p_flags & PF_R)
395 			args->dat_prot |= PROT_READ;
396 		if (dataphdrp->p_flags & PF_W)
397 			args->dat_prot |= PROT_WRITE;
398 		if (dataphdrp->p_flags & PF_X)
399 			args->dat_prot |= PROT_EXEC;
400 	}
401 
402 	/*
403 	 * If a auxvector will be required - reserve the space for
404 	 * it now.  This may be increased by exec_args if there are
405 	 * ISA-specific types (included in __KERN_NAUXV_IMPL).
406 	 */
407 	if (hasauxv) {
408 		/*
409 		 * If a AUX vector is being built - the base AUX
410 		 * entries are:
411 		 *
412 		 *	AT_BASE
413 		 *	AT_FLAGS
414 		 *	AT_PAGESZ
415 		 *	AT_SUN_LDSECURE
416 		 *	AT_SUN_HWCAP
417 		 *	AT_SUN_PLATFORM
418 		 *	AT_SUN_EXECNAME
419 		 *	AT_NULL
420 		 *
421 		 * total == 8
422 		 */
423 		if (hasdy && hasu) {
424 			/*
425 			 * Has PT_INTERP & PT_PHDR - the auxvectors that
426 			 * will be built are:
427 			 *
428 			 *	AT_PHDR
429 			 *	AT_PHENT
430 			 *	AT_PHNUM
431 			 *	AT_ENTRY
432 			 *	AT_LDDATA
433 			 *
434 			 * total = 5
435 			 */
436 			args->auxsize = (8 + 5) * sizeof (aux_entry_t);
437 		} else if (hasdy) {
438 			/*
439 			 * Has PT_INTERP but no PT_PHDR
440 			 *
441 			 *	AT_EXECFD
442 			 *	AT_LDDATA
443 			 *
444 			 * total = 2
445 			 */
446 			args->auxsize = (8 + 2) * sizeof (aux_entry_t);
447 		} else {
448 			args->auxsize = 8 * sizeof (aux_entry_t);
449 		}
450 	} else
451 		args->auxsize = 0;
452 
453 	/*
454 	 * If this binary is using an emulator, we need to add an
455 	 * AT_SUN_EMULATOR aux entry.
456 	 */
457 	if (args->emulator != NULL)
458 		args->auxsize += sizeof (aux_entry_t);
459 
460 	if ((brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
461 		branded = 1;
462 		/*
463 		 * We will be adding 4 entries to the aux vectors.  One for
464 		 * the the brandname and 3 for the brand specific aux vectors.
465 		 */
466 		args->auxsize += 4 * sizeof (aux_entry_t);
467 	}
468 
469 	aux = bigwad->elfargs;
470 	/*
471 	 * Move args to the user's stack.
472 	 */
473 	if ((error = exec_args(uap, args, idatap, (void **)&aux)) != 0) {
474 		if (error == -1) {
475 			error = ENOEXEC;
476 			goto bad;
477 		}
478 		goto out;
479 	}
480 	/* we're single threaded after this point */
481 
482 	/*
483 	 * If this is an ET_DYN executable (shared object),
484 	 * determine its memory size so that mapelfexec() can load it.
485 	 */
486 	if (ehdrp->e_type == ET_DYN)
487 		len = elfsize(ehdrp, nphdrs, phdrbase, NULL);
488 	else
489 		len = 0;
490 
491 	dtrphdr = NULL;
492 
493 	if ((error = mapelfexec(vp, ehdrp, nphdrs, phdrbase, &uphdr, &dyphdr,
494 	    &stphdr, &dtrphdr, dataphdrp, &bssbase, &brkbase, &voffset, NULL,
495 	    len, execsz, &brksize)) != 0)
496 		goto bad;
497 
498 	if (uphdr != NULL && dyphdr == NULL)
499 		goto bad;
500 
501 	if (dtrphdr != NULL && dtrace_safe_phdr(dtrphdr, args, voffset) != 0) {
502 		uprintf("%s: Bad DTrace phdr in %s\n", exec_file, exec_file);
503 		goto bad;
504 	}
505 
506 	if (dyphdr != NULL) {
507 		size_t		len;
508 		uintptr_t	lddata;
509 		char		*p;
510 		struct vnode	*nvp;
511 
512 		dlnsize = dyphdr->p_filesz;
513 
514 		if (dlnsize > MAXPATHLEN || dlnsize <= 0)
515 			goto bad;
516 
517 		/*
518 		 * Read in "interpreter" pathname.
519 		 */
520 		if ((error = vn_rdwr(UIO_READ, vp, dlnp, dyphdr->p_filesz,
521 		    (offset_t)dyphdr->p_offset, UIO_SYSSPACE, 0, (rlim64_t)0,
522 		    CRED(), &resid)) != 0) {
523 			uprintf("%s: Cannot obtain interpreter pathname\n",
524 			    exec_file);
525 			goto bad;
526 		}
527 
528 		if (resid != 0 || dlnp[dlnsize - 1] != '\0')
529 			goto bad;
530 
531 		/*
532 		 * Search for '$ORIGIN' token in interpreter path.
533 		 * If found, expand it.
534 		 */
535 		for (p = dlnp; p = strchr(p, '$'); ) {
536 			uint_t	len, curlen;
537 			char	*_ptr;
538 
539 			if (strncmp(++p, ORIGIN_STR, ORIGIN_STR_SIZE))
540 				continue;
541 
542 			curlen = 0;
543 			len = p - dlnp - 1;
544 			if (len) {
545 				bcopy(dlnp, pathbufp, len);
546 				curlen += len;
547 			}
548 			if (_ptr = strrchr(args->pathname, '/')) {
549 				len = _ptr - args->pathname;
550 				if ((curlen + len) > MAXPATHLEN)
551 					break;
552 
553 				bcopy(args->pathname, &pathbufp[curlen], len);
554 				curlen += len;
555 			} else {
556 				/*
557 				 * executable is a basename found in the
558 				 * current directory.  So - just substitue
559 				 * '.' for ORIGIN.
560 				 */
561 				pathbufp[curlen] = '.';
562 				curlen++;
563 			}
564 			p += ORIGIN_STR_SIZE;
565 			len = strlen(p);
566 
567 			if ((curlen + len) > MAXPATHLEN)
568 				break;
569 			bcopy(p, &pathbufp[curlen], len);
570 			curlen += len;
571 			pathbufp[curlen++] = '\0';
572 			bcopy(pathbufp, dlnp, curlen);
573 		}
574 
575 		/*
576 		 * /usr/lib/ld.so.1 is known to be a symlink to /lib/ld.so.1
577 		 * (and /usr/lib/64/ld.so.1 is a symlink to /lib/64/ld.so.1).
578 		 * Just in case /usr is not mounted, change it now.
579 		 */
580 		if (strcmp(dlnp, USR_LIB_RTLD) == 0)
581 			dlnp += 4;
582 		error = lookupname(dlnp, UIO_SYSSPACE, FOLLOW, NULLVPP, &nvp);
583 		if (error && dlnp != bigwad->dl_name) {
584 			/* new kernel, old user-level */
585 			error = lookupname(dlnp -= 4, UIO_SYSSPACE, FOLLOW,
586 			    NULLVPP, &nvp);
587 		}
588 		if (error) {
589 			uprintf("%s: Cannot find %s\n", exec_file, dlnp);
590 			goto bad;
591 		}
592 
593 		/*
594 		 * Setup the "aux" vector.
595 		 */
596 		if (uphdr) {
597 			if (ehdrp->e_type == ET_DYN) {
598 				/* don't use the first page */
599 				bigwad->exenv.ex_brkbase = (caddr_t)PAGESIZE;
600 				bigwad->exenv.ex_bssbase = (caddr_t)PAGESIZE;
601 			} else {
602 				bigwad->exenv.ex_bssbase = bssbase;
603 				bigwad->exenv.ex_brkbase = brkbase;
604 			}
605 			bigwad->exenv.ex_brksize = brksize;
606 			bigwad->exenv.ex_magic = elfmagic;
607 			bigwad->exenv.ex_vp = vp;
608 			setexecenv(&bigwad->exenv);
609 
610 			ADDAUX(aux, AT_PHDR, uphdr->p_vaddr + voffset)
611 			ADDAUX(aux, AT_PHENT, ehdrp->e_phentsize)
612 			ADDAUX(aux, AT_PHNUM, nphdrs)
613 			ADDAUX(aux, AT_ENTRY, ehdrp->e_entry + voffset)
614 		} else {
615 			if ((error = execopen(&vp, &fd)) != 0) {
616 				VN_RELE(nvp);
617 				goto bad;
618 			}
619 
620 			ADDAUX(aux, AT_EXECFD, fd)
621 		}
622 
623 		if ((error = execpermissions(nvp, &bigwad->vattr, args)) != 0) {
624 			VN_RELE(nvp);
625 			uprintf("%s: Cannot execute %s\n", exec_file, dlnp);
626 			goto bad;
627 		}
628 
629 		/*
630 		 * Now obtain the ELF header along with the entire program
631 		 * header contained in "nvp".
632 		 */
633 		kmem_free(phdrbase, phdrsize);
634 		phdrbase = NULL;
635 		if ((error = getelfhead(nvp, CRED(), ehdrp, &nshdrs,
636 		    &shstrndx, &nphdrs)) != 0 ||
637 		    (error = getelfphdr(nvp, CRED(), ehdrp, nphdrs, &phdrbase,
638 		    &phdrsize)) != 0) {
639 			VN_RELE(nvp);
640 			uprintf("%s: Cannot read %s\n", exec_file, dlnp);
641 			goto bad;
642 		}
643 
644 		/*
645 		 * Determine memory size of the "interpreter's" loadable
646 		 * sections.  This size is then used to obtain the virtual
647 		 * address of a hole, in the user's address space, large
648 		 * enough to map the "interpreter".
649 		 */
650 		if ((len = elfsize(ehdrp, nphdrs, phdrbase, &lddata)) == 0) {
651 			VN_RELE(nvp);
652 			uprintf("%s: Nothing to load in %s\n", exec_file, dlnp);
653 			goto bad;
654 		}
655 
656 		dtrphdr = NULL;
657 
658 		error = mapelfexec(nvp, ehdrp, nphdrs, phdrbase, &junk, &junk,
659 		    &junk, &dtrphdr, NULL, NULL, NULL, &voffset, NULL, len,
660 		    execsz, NULL);
661 		if (error || junk != NULL) {
662 			VN_RELE(nvp);
663 			uprintf("%s: Cannot map %s\n", exec_file, dlnp);
664 			goto bad;
665 		}
666 
667 		/*
668 		 * We use the DTrace program header to initialize the
669 		 * architecture-specific user per-LWP location. The dtrace
670 		 * fasttrap provider requires ready access to per-LWP scratch
671 		 * space. We assume that there is only one such program header
672 		 * in the interpreter.
673 		 */
674 		if (dtrphdr != NULL &&
675 		    dtrace_safe_phdr(dtrphdr, args, voffset) != 0) {
676 			VN_RELE(nvp);
677 			uprintf("%s: Bad DTrace phdr in %s\n", exec_file, dlnp);
678 			goto bad;
679 		}
680 
681 		VN_RELE(nvp);
682 		ADDAUX(aux, AT_SUN_LDDATA, voffset + lddata)
683 	}
684 
685 	if (hasauxv) {
686 		int auxf = AF_SUN_HWCAPVERIFY;
687 		/*
688 		 * Note: AT_SUN_PLATFORM was filled in via exec_args()
689 		 */
690 		ADDAUX(aux, AT_BASE, voffset)
691 		ADDAUX(aux, AT_FLAGS, at_flags)
692 		ADDAUX(aux, AT_PAGESZ, PAGESIZE)
693 		/*
694 		 * Linker flags. (security)
695 		 * p_flag not yet set at this time.
696 		 * We rely on gexec() to provide us with the information.
697 		 * If the application is set-uid but this is not reflected
698 		 * in a mismatch between real/effective uids/gids, then
699 		 * don't treat this as a set-uid exec.  So we care about
700 		 * the EXECSETID_UGIDS flag but not the ...SETID flag.
701 		 */
702 		setid &= ~EXECSETID_SETID;
703 		ADDAUX(aux, AT_SUN_AUXFLAGS,
704 		    setid ? AF_SUN_SETUGID | auxf : auxf);
705 		/*
706 		 * Hardware capability flag word (performance hints)
707 		 * Used for choosing faster library routines.
708 		 * (Potentially different between 32-bit and 64-bit ABIs)
709 		 */
710 #if defined(_LP64)
711 		if (args->to_model == DATAMODEL_NATIVE)
712 			ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap)
713 		else
714 			ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap32)
715 #else
716 		ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap)
717 #endif
718 		if (branded) {
719 			/*
720 			 * Reserve space for the brand-private aux vectors,
721 			 * and record the user addr of that space.
722 			 */
723 			args->auxp_brand =
724 			    (char *)((char *)args->stackend +
725 			    ((char *)&aux->a_type -
726 			    (char *)bigwad->elfargs));
727 			ADDAUX(aux, AT_SUN_BRAND_AUX1, 0)
728 			ADDAUX(aux, AT_SUN_BRAND_AUX2, 0)
729 			ADDAUX(aux, AT_SUN_BRAND_AUX3, 0)
730 		}
731 
732 		ADDAUX(aux, AT_NULL, 0)
733 		postfixsize = (char *)aux - (char *)bigwad->elfargs;
734 		ASSERT(postfixsize == args->auxsize);
735 		ASSERT(postfixsize <= __KERN_NAUXV_IMPL * sizeof (aux_entry_t));
736 	}
737 
738 	/*
739 	 * For the 64-bit kernel, the limit is big enough that rounding it up
740 	 * to a page can overflow the 64-bit limit, so we check for btopr()
741 	 * overflowing here by comparing it with the unrounded limit in pages.
742 	 * If it hasn't overflowed, compare the exec size with the rounded up
743 	 * limit in pages.  Otherwise, just compare with the unrounded limit.
744 	 */
745 	limit = btop(p->p_vmem_ctl);
746 	roundlimit = btopr(p->p_vmem_ctl);
747 	if ((roundlimit > limit && *execsz > roundlimit) ||
748 	    (roundlimit < limit && *execsz > limit)) {
749 		mutex_enter(&p->p_lock);
750 		(void) rctl_action(rctlproc_legacy[RLIMIT_VMEM], p->p_rctls, p,
751 		    RCA_SAFE);
752 		mutex_exit(&p->p_lock);
753 		error = ENOMEM;
754 		goto bad;
755 	}
756 
757 	bzero(up->u_auxv, sizeof (up->u_auxv));
758 	if (postfixsize) {
759 		int num_auxv;
760 
761 		/*
762 		 * Copy the aux vector to the user stack.
763 		 */
764 		error = execpoststack(args, bigwad->elfargs, postfixsize);
765 		if (error)
766 			goto bad;
767 
768 		/*
769 		 * Copy auxv to the process's user structure for use by /proc.
770 		 * If this is a branded process, the brand's exec routine will
771 		 * copy it's private entries to the user structure later. It
772 		 * relies on the fact that the blank entries are at the end.
773 		 */
774 		num_auxv = postfixsize / sizeof (aux_entry_t);
775 		ASSERT(num_auxv <= sizeof (up->u_auxv) / sizeof (auxv_t));
776 		aux = bigwad->elfargs;
777 		for (i = 0; i < num_auxv; i++) {
778 			up->u_auxv[i].a_type = aux[i].a_type;
779 			up->u_auxv[i].a_un.a_val = (aux_val_t)aux[i].a_un.a_val;
780 		}
781 	}
782 
783 	/*
784 	 * Pass back the starting address so we can set the program counter.
785 	 */
786 	args->entry = (uintptr_t)(ehdrp->e_entry + voffset);
787 
788 	if (!uphdr) {
789 		if (ehdrp->e_type == ET_DYN) {
790 			/*
791 			 * If we are executing a shared library which doesn't
792 			 * have a interpreter (probably ld.so.1) then
793 			 * we don't set the brkbase now.  Instead we
794 			 * delay it's setting until the first call
795 			 * via grow.c::brk().  This permits ld.so.1 to
796 			 * initialize brkbase to the tail of the executable it
797 			 * loads (which is where it needs to be).
798 			 */
799 			bigwad->exenv.ex_brkbase = (caddr_t)0;
800 			bigwad->exenv.ex_bssbase = (caddr_t)0;
801 			bigwad->exenv.ex_brksize = 0;
802 		} else {
803 			bigwad->exenv.ex_brkbase = brkbase;
804 			bigwad->exenv.ex_bssbase = bssbase;
805 			bigwad->exenv.ex_brksize = brksize;
806 		}
807 		bigwad->exenv.ex_magic = elfmagic;
808 		bigwad->exenv.ex_vp = vp;
809 		setexecenv(&bigwad->exenv);
810 	}
811 
812 	ASSERT(error == 0);
813 	goto out;
814 
815 bad:
816 	if (fd != -1)		/* did we open the a.out yet */
817 		(void) execclose(fd);
818 
819 	psignal(p, SIGKILL);
820 
821 	if (error == 0)
822 		error = ENOEXEC;
823 out:
824 	if (phdrbase != NULL)
825 		kmem_free(phdrbase, phdrsize);
826 	kmem_free(bigwad, sizeof (struct bigwad));
827 	return (error);
828 }
829 
830 /*
831  * Compute the memory size requirement for the ELF file.
832  */
833 static size_t
834 elfsize(Ehdr *ehdrp, int nphdrs, caddr_t phdrbase, uintptr_t *lddata)
835 {
836 	size_t	len;
837 	Phdr	*phdrp = (Phdr *)phdrbase;
838 	int	hsize = ehdrp->e_phentsize;
839 	int	first = 1;
840 	int	dfirst = 1;	/* first data segment */
841 	uintptr_t loaddr = 0;
842 	uintptr_t hiaddr = 0;
843 	uintptr_t lo, hi;
844 	int	i;
845 
846 	for (i = nphdrs; i > 0; i--) {
847 		if (phdrp->p_type == PT_LOAD) {
848 			lo = phdrp->p_vaddr;
849 			hi = lo + phdrp->p_memsz;
850 			if (first) {
851 				loaddr = lo;
852 				hiaddr = hi;
853 				first = 0;
854 			} else {
855 				if (loaddr > lo)
856 					loaddr = lo;
857 				if (hiaddr < hi)
858 					hiaddr = hi;
859 			}
860 
861 			/*
862 			 * save the address of the first data segment
863 			 * of a object - used for the AT_SUNW_LDDATA
864 			 * aux entry.
865 			 */
866 			if ((lddata != NULL) && dfirst &&
867 			    (phdrp->p_flags & PF_W)) {
868 				*lddata = lo;
869 				dfirst = 0;
870 			}
871 		}
872 		phdrp = (Phdr *)((caddr_t)phdrp + hsize);
873 	}
874 
875 	len = hiaddr - (loaddr & PAGEMASK);
876 	len = roundup(len, PAGESIZE);
877 
878 	return (len);
879 }
880 
881 /*
882  * Read in the ELF header and program header table.
883  * SUSV3 requires:
884  *	ENOEXEC	File format is not recognized
885  *	EINVAL	Format recognized but execution not supported
886  */
887 static int
888 getelfhead(vnode_t *vp, cred_t *credp, Ehdr *ehdr, int *nshdrs, int *shstrndx,
889     int *nphdrs)
890 {
891 	int error;
892 	ssize_t resid;
893 
894 	/*
895 	 * We got here by the first two bytes in ident,
896 	 * now read the entire ELF header.
897 	 */
898 	if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)ehdr,
899 	    sizeof (Ehdr), (offset_t)0, UIO_SYSSPACE, 0,
900 	    (rlim64_t)0, credp, &resid)) != 0)
901 		return (error);
902 
903 	/*
904 	 * Since a separate version is compiled for handling 32-bit and
905 	 * 64-bit ELF executables on a 64-bit kernel, the 64-bit version
906 	 * doesn't need to be able to deal with 32-bit ELF files.
907 	 */
908 	if (resid != 0 ||
909 	    ehdr->e_ident[EI_MAG2] != ELFMAG2 ||
910 	    ehdr->e_ident[EI_MAG3] != ELFMAG3)
911 		return (ENOEXEC);
912 
913 	if ((ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) ||
914 #if defined(_ILP32) || defined(_ELF32_COMPAT)
915 	    ehdr->e_ident[EI_CLASS] != ELFCLASS32 ||
916 #else
917 	    ehdr->e_ident[EI_CLASS] != ELFCLASS64 ||
918 #endif
919 	    !elfheadcheck(ehdr->e_ident[EI_DATA], ehdr->e_machine,
920 	    ehdr->e_flags))
921 		return (EINVAL);
922 
923 	*nshdrs = ehdr->e_shnum;
924 	*shstrndx = ehdr->e_shstrndx;
925 	*nphdrs = ehdr->e_phnum;
926 
927 	/*
928 	 * If e_shnum, e_shstrndx, or e_phnum is its sentinel value, we need
929 	 * to read in the section header at index zero to acces the true
930 	 * values for those fields.
931 	 */
932 	if ((*nshdrs == 0 && ehdr->e_shoff != 0) ||
933 	    *shstrndx == SHN_XINDEX || *nphdrs == PN_XNUM) {
934 		Shdr shdr;
935 
936 		if (ehdr->e_shoff == 0)
937 			return (EINVAL);
938 
939 		if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)&shdr,
940 		    sizeof (shdr), (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0,
941 		    (rlim64_t)0, credp, &resid)) != 0)
942 			return (error);
943 
944 		if (*nshdrs == 0)
945 			*nshdrs = shdr.sh_size;
946 		if (*shstrndx == SHN_XINDEX)
947 			*shstrndx = shdr.sh_link;
948 		if (*nphdrs == PN_XNUM && shdr.sh_info != 0)
949 			*nphdrs = shdr.sh_info;
950 	}
951 
952 	return (0);
953 }
954 
955 #ifdef _ELF32_COMPAT
956 extern size_t elf_nphdr_max;
957 #else
958 size_t elf_nphdr_max = 1000;
959 #endif
960 
961 static int
962 getelfphdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, int nphdrs,
963     caddr_t *phbasep, ssize_t *phsizep)
964 {
965 	ssize_t resid, minsize;
966 	int err;
967 
968 	/*
969 	 * Since we're going to be using e_phentsize to iterate down the
970 	 * array of program headers, it must be 8-byte aligned or else
971 	 * a we might cause a misaligned access. We use all members through
972 	 * p_flags on 32-bit ELF files and p_memsz on 64-bit ELF files so
973 	 * e_phentsize must be at least large enough to include those
974 	 * members.
975 	 */
976 #if !defined(_LP64) || defined(_ELF32_COMPAT)
977 	minsize = offsetof(Phdr, p_flags) + sizeof (((Phdr *)NULL)->p_flags);
978 #else
979 	minsize = offsetof(Phdr, p_memsz) + sizeof (((Phdr *)NULL)->p_memsz);
980 #endif
981 	if (ehdr->e_phentsize < minsize || (ehdr->e_phentsize & 3))
982 		return (EINVAL);
983 
984 	*phsizep = nphdrs * ehdr->e_phentsize;
985 
986 	if (*phsizep > sizeof (Phdr) * elf_nphdr_max) {
987 		if ((*phbasep = kmem_alloc(*phsizep, KM_NOSLEEP)) == NULL)
988 			return (ENOMEM);
989 	} else {
990 		*phbasep = kmem_alloc(*phsizep, KM_SLEEP);
991 	}
992 
993 	if ((err = vn_rdwr(UIO_READ, vp, *phbasep, *phsizep,
994 	    (offset_t)ehdr->e_phoff, UIO_SYSSPACE, 0, (rlim64_t)0,
995 	    credp, &resid)) != 0) {
996 		kmem_free(*phbasep, *phsizep);
997 		*phbasep = NULL;
998 		return (err);
999 	}
1000 
1001 	return (0);
1002 }
1003 
1004 #ifdef _ELF32_COMPAT
1005 extern size_t elf_nshdr_max;
1006 extern size_t elf_shstrtab_max;
1007 #else
1008 size_t elf_nshdr_max = 10000;
1009 size_t elf_shstrtab_max = 100 * 1024;
1010 #endif
1011 
1012 
1013 static int
1014 getelfshdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr,
1015     int nshdrs, int shstrndx, caddr_t *shbasep, ssize_t *shsizep,
1016     char **shstrbasep, ssize_t *shstrsizep)
1017 {
1018 	ssize_t resid, minsize;
1019 	int err;
1020 	Shdr *shdr;
1021 
1022 	/*
1023 	 * Since we're going to be using e_shentsize to iterate down the
1024 	 * array of section headers, it must be 8-byte aligned or else
1025 	 * a we might cause a misaligned access. We use all members through
1026 	 * sh_entsize (on both 32- and 64-bit ELF files) so e_shentsize
1027 	 * must be at least large enough to include that member. The index
1028 	 * of the string table section must also be valid.
1029 	 */
1030 	minsize = offsetof(Shdr, sh_entsize) + sizeof (shdr->sh_entsize);
1031 	if (ehdr->e_shentsize < minsize || (ehdr->e_shentsize & 3) ||
1032 	    shstrndx >= nshdrs)
1033 		return (EINVAL);
1034 
1035 	*shsizep = nshdrs * ehdr->e_shentsize;
1036 
1037 	if (*shsizep > sizeof (Shdr) * elf_nshdr_max) {
1038 		if ((*shbasep = kmem_alloc(*shsizep, KM_NOSLEEP)) == NULL)
1039 			return (ENOMEM);
1040 	} else {
1041 		*shbasep = kmem_alloc(*shsizep, KM_SLEEP);
1042 	}
1043 
1044 	if ((err = vn_rdwr(UIO_READ, vp, *shbasep, *shsizep,
1045 	    (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, (rlim64_t)0,
1046 	    credp, &resid)) != 0) {
1047 		kmem_free(*shbasep, *shsizep);
1048 		return (err);
1049 	}
1050 
1051 	/*
1052 	 * Pull the section string table out of the vnode; fail if the size
1053 	 * is zero.
1054 	 */
1055 	shdr = (Shdr *)(*shbasep + shstrndx * ehdr->e_shentsize);
1056 	if ((*shstrsizep = shdr->sh_size) == 0) {
1057 		kmem_free(*shbasep, *shsizep);
1058 		return (EINVAL);
1059 	}
1060 
1061 	if (*shstrsizep > elf_shstrtab_max) {
1062 		if ((*shstrbasep = kmem_alloc(*shstrsizep,
1063 		    KM_NOSLEEP)) == NULL) {
1064 			kmem_free(*shbasep, *shsizep);
1065 			return (ENOMEM);
1066 		}
1067 	} else {
1068 		*shstrbasep = kmem_alloc(*shstrsizep, KM_SLEEP);
1069 	}
1070 
1071 	if ((err = vn_rdwr(UIO_READ, vp, *shstrbasep, *shstrsizep,
1072 	    (offset_t)shdr->sh_offset, UIO_SYSSPACE, 0, (rlim64_t)0,
1073 	    credp, &resid)) != 0) {
1074 		kmem_free(*shbasep, *shsizep);
1075 		kmem_free(*shstrbasep, *shstrsizep);
1076 		return (err);
1077 	}
1078 
1079 	/*
1080 	 * Make sure the strtab is null-terminated to make sure we
1081 	 * don't run off the end of the table.
1082 	 */
1083 	(*shstrbasep)[*shstrsizep - 1] = '\0';
1084 
1085 	return (0);
1086 }
1087 
1088 static int
1089 mapelfexec(
1090 	vnode_t *vp,
1091 	Ehdr *ehdr,
1092 	int nphdrs,
1093 	caddr_t phdrbase,
1094 	Phdr **uphdr,
1095 	Phdr **dyphdr,
1096 	Phdr **stphdr,
1097 	Phdr **dtphdr,
1098 	Phdr *dataphdrp,
1099 	caddr_t *bssbase,
1100 	caddr_t *brkbase,
1101 	intptr_t *voffset,
1102 	intptr_t *minaddr,
1103 	size_t len,
1104 	long *execsz,
1105 	size_t *brksize)
1106 {
1107 	Phdr *phdr;
1108 	int i, prot, error;
1109 	caddr_t addr = NULL;
1110 	size_t zfodsz;
1111 	int ptload = 0;
1112 	int page;
1113 	off_t offset;
1114 	int hsize = ehdr->e_phentsize;
1115 	caddr_t mintmp = (caddr_t)-1;
1116 	extern int use_brk_lpg;
1117 
1118 	if (ehdr->e_type == ET_DYN) {
1119 		/*
1120 		 * Obtain the virtual address of a hole in the
1121 		 * address space to map the "interpreter".
1122 		 */
1123 		map_addr(&addr, len, (offset_t)0, 1, 0);
1124 		if (addr == NULL)
1125 			return (ENOMEM);
1126 		*voffset = (intptr_t)addr;
1127 
1128 		/*
1129 		 * Calculate the minimum vaddr so it can be subtracted out.
1130 		 * According to the ELF specification, since PT_LOAD sections
1131 		 * must be sorted by increasing p_vaddr values, this is
1132 		 * guaranteed to be the first PT_LOAD section.
1133 		 */
1134 		phdr = (Phdr *)phdrbase;
1135 		for (i = nphdrs; i > 0; i--) {
1136 			if (phdr->p_type == PT_LOAD) {
1137 				*voffset -= (uintptr_t)phdr->p_vaddr;
1138 				break;
1139 			}
1140 			phdr = (Phdr *)((caddr_t)phdr + hsize);
1141 		}
1142 
1143 	} else {
1144 		*voffset = 0;
1145 	}
1146 	phdr = (Phdr *)phdrbase;
1147 	for (i = nphdrs; i > 0; i--) {
1148 		switch (phdr->p_type) {
1149 		case PT_LOAD:
1150 			if ((*dyphdr != NULL) && (*uphdr == NULL))
1151 				return (0);
1152 
1153 			ptload = 1;
1154 			prot = PROT_USER;
1155 			if (phdr->p_flags & PF_R)
1156 				prot |= PROT_READ;
1157 			if (phdr->p_flags & PF_W)
1158 				prot |= PROT_WRITE;
1159 			if (phdr->p_flags & PF_X)
1160 				prot |= PROT_EXEC;
1161 
1162 			addr = (caddr_t)((uintptr_t)phdr->p_vaddr + *voffset);
1163 
1164 			/*
1165 			 * Keep track of the segment with the lowest starting
1166 			 * address.
1167 			 */
1168 			if (addr < mintmp)
1169 				mintmp = addr;
1170 
1171 			zfodsz = (size_t)phdr->p_memsz - phdr->p_filesz;
1172 
1173 			offset = phdr->p_offset;
1174 			if (((uintptr_t)offset & PAGEOFFSET) ==
1175 			    ((uintptr_t)addr & PAGEOFFSET) &&
1176 			    (!(vp->v_flag & VNOMAP))) {
1177 				page = 1;
1178 			} else {
1179 				page = 0;
1180 			}
1181 
1182 			/*
1183 			 * Set the heap pagesize for OOB when the bss size
1184 			 * is known and use_brk_lpg is not 0.
1185 			 */
1186 			if (brksize != NULL && use_brk_lpg &&
1187 			    zfodsz != 0 && phdr == dataphdrp &&
1188 			    (prot & PROT_WRITE)) {
1189 				size_t tlen = P2NPHASE((uintptr_t)addr +
1190 				    phdr->p_filesz, PAGESIZE);
1191 
1192 				if (zfodsz > tlen) {
1193 					curproc->p_brkpageszc =
1194 					    page_szc(map_pgsz(MAPPGSZ_HEAP,
1195 					    curproc, addr + phdr->p_filesz +
1196 					    tlen, zfodsz - tlen, 0));
1197 				}
1198 			}
1199 
1200 			if (curproc->p_brkpageszc != 0 && phdr == dataphdrp &&
1201 			    (prot & PROT_WRITE)) {
1202 				uint_t	szc = curproc->p_brkpageszc;
1203 				size_t pgsz = page_get_pagesize(szc);
1204 				caddr_t ebss = addr + phdr->p_memsz;
1205 				size_t extra_zfodsz;
1206 
1207 				ASSERT(pgsz > PAGESIZE);
1208 
1209 				extra_zfodsz = P2NPHASE((uintptr_t)ebss, pgsz);
1210 
1211 				if (error = execmap(vp, addr, phdr->p_filesz,
1212 				    zfodsz + extra_zfodsz, phdr->p_offset,
1213 				    prot, page, szc))
1214 					goto bad;
1215 				if (brksize != NULL)
1216 					*brksize = extra_zfodsz;
1217 			} else {
1218 				if (error = execmap(vp, addr, phdr->p_filesz,
1219 				    zfodsz, phdr->p_offset, prot, page, 0))
1220 					goto bad;
1221 			}
1222 
1223 			if (bssbase != NULL && addr >= *bssbase &&
1224 			    phdr == dataphdrp) {
1225 				*bssbase = addr + phdr->p_filesz;
1226 			}
1227 			if (brkbase != NULL && addr >= *brkbase) {
1228 				*brkbase = addr + phdr->p_memsz;
1229 			}
1230 
1231 			*execsz += btopr(phdr->p_memsz);
1232 			break;
1233 
1234 		case PT_INTERP:
1235 			if (ptload)
1236 				goto bad;
1237 			*dyphdr = phdr;
1238 			break;
1239 
1240 		case PT_SHLIB:
1241 			*stphdr = phdr;
1242 			break;
1243 
1244 		case PT_PHDR:
1245 			if (ptload)
1246 				goto bad;
1247 			*uphdr = phdr;
1248 			break;
1249 
1250 		case PT_NULL:
1251 		case PT_DYNAMIC:
1252 		case PT_NOTE:
1253 			break;
1254 
1255 		case PT_SUNWDTRACE:
1256 			if (dtphdr != NULL)
1257 				*dtphdr = phdr;
1258 			break;
1259 
1260 		default:
1261 			break;
1262 		}
1263 		phdr = (Phdr *)((caddr_t)phdr + hsize);
1264 	}
1265 
1266 	if (minaddr != NULL) {
1267 		ASSERT(mintmp != (caddr_t)-1);
1268 		*minaddr = (intptr_t)mintmp;
1269 	}
1270 
1271 	return (0);
1272 bad:
1273 	if (error == 0)
1274 		error = EINVAL;
1275 	return (error);
1276 }
1277 
1278 int
1279 elfnote(vnode_t *vp, offset_t *offsetp, int type, int descsz, void *desc,
1280     rlim64_t rlimit, cred_t *credp)
1281 {
1282 	Note note;
1283 	int error;
1284 
1285 	bzero(&note, sizeof (note));
1286 	bcopy("CORE", note.name, 4);
1287 	note.nhdr.n_type = type;
1288 	/*
1289 	 * The System V ABI states that n_namesz must be the length of the
1290 	 * string that follows the Nhdr structure including the terminating
1291 	 * null. The ABI also specifies that sufficient padding should be
1292 	 * included so that the description that follows the name string
1293 	 * begins on a 4- or 8-byte boundary for 32- and 64-bit binaries
1294 	 * respectively. However, since this change was not made correctly
1295 	 * at the time of the 64-bit port, both 32- and 64-bit binaries
1296 	 * descriptions are only guaranteed to begin on a 4-byte boundary.
1297 	 */
1298 	note.nhdr.n_namesz = 5;
1299 	note.nhdr.n_descsz = roundup(descsz, sizeof (Word));
1300 
1301 	if (error = core_write(vp, UIO_SYSSPACE, *offsetp, &note,
1302 	    sizeof (note), rlimit, credp))
1303 		return (error);
1304 
1305 	*offsetp += sizeof (note);
1306 
1307 	if (error = core_write(vp, UIO_SYSSPACE, *offsetp, desc,
1308 	    note.nhdr.n_descsz, rlimit, credp))
1309 		return (error);
1310 
1311 	*offsetp += note.nhdr.n_descsz;
1312 	return (0);
1313 }
1314 
1315 /*
1316  * Copy the section data from one vnode to the section of another vnode.
1317  */
1318 static void
1319 copy_scn(Shdr *src, vnode_t *src_vp, Shdr *dst, vnode_t *dst_vp, Off *doffset,
1320     void *buf, size_t size, cred_t *credp, rlim64_t rlimit)
1321 {
1322 	ssize_t resid;
1323 	size_t len, n = src->sh_size;
1324 	offset_t off = 0;
1325 
1326 	while (n != 0) {
1327 		len = MIN(size, n);
1328 		if (vn_rdwr(UIO_READ, src_vp, buf, len, src->sh_offset + off,
1329 		    UIO_SYSSPACE, 0, (rlim64_t)0, credp, &resid) != 0 ||
1330 		    resid >= len ||
1331 		    core_write(dst_vp, UIO_SYSSPACE, *doffset + off,
1332 		    buf, len - resid, rlimit, credp) != 0) {
1333 			dst->sh_size = 0;
1334 			dst->sh_offset = 0;
1335 			return;
1336 		}
1337 
1338 		ASSERT(n >= len - resid);
1339 
1340 		n -= len - resid;
1341 		off += len - resid;
1342 	}
1343 
1344 	*doffset += src->sh_size;
1345 }
1346 
1347 #ifdef _ELF32_COMPAT
1348 extern size_t elf_datasz_max;
1349 #else
1350 size_t elf_datasz_max = 1 * 1024 * 1024;
1351 #endif
1352 
1353 /*
1354  * This function processes mappings that correspond to load objects to
1355  * examine their respective sections for elfcore(). It's called once with
1356  * v set to NULL to count the number of sections that we're going to need
1357  * and then again with v set to some allocated buffer that we fill in with
1358  * all the section data.
1359  */
1360 static int
1361 process_scns(core_content_t content, proc_t *p, cred_t *credp, vnode_t *vp,
1362     Shdr *v, int nv, rlim64_t rlimit, Off *doffsetp, int *nshdrsp)
1363 {
1364 	vnode_t *lastvp = NULL;
1365 	struct seg *seg;
1366 	int i, j;
1367 	void *data = NULL;
1368 	size_t datasz = 0;
1369 	shstrtab_t shstrtab;
1370 	struct as *as = p->p_as;
1371 	int error = 0;
1372 
1373 	if (v != NULL)
1374 		shstrtab_init(&shstrtab);
1375 
1376 	i = 1;
1377 	for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
1378 		uint_t prot;
1379 		vnode_t *mvp;
1380 		void *tmp = NULL;
1381 		caddr_t saddr = seg->s_base;
1382 		caddr_t naddr;
1383 		caddr_t eaddr;
1384 		size_t segsize;
1385 
1386 		Ehdr ehdr;
1387 		int nshdrs, shstrndx, nphdrs;
1388 		caddr_t shbase;
1389 		ssize_t shsize;
1390 		char *shstrbase;
1391 		ssize_t shstrsize;
1392 
1393 		Shdr *shdr;
1394 		const char *name;
1395 		size_t sz;
1396 		uintptr_t off;
1397 
1398 		int ctf_ndx = 0;
1399 		int symtab_ndx = 0;
1400 
1401 		/*
1402 		 * Since we're just looking for text segments of load
1403 		 * objects, we only care about the protection bits; we don't
1404 		 * care about the actual size of the segment so we use the
1405 		 * reserved size. If the segment's size is zero, there's
1406 		 * something fishy going on so we ignore this segment.
1407 		 */
1408 		if (seg->s_ops != &segvn_ops ||
1409 		    SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 ||
1410 		    mvp == lastvp || mvp == NULL || mvp->v_type != VREG ||
1411 		    (segsize = pr_getsegsize(seg, 1)) == 0)
1412 			continue;
1413 
1414 		eaddr = saddr + segsize;
1415 		prot = pr_getprot(seg, 1, &tmp, &saddr, &naddr, eaddr);
1416 		pr_getprot_done(&tmp);
1417 
1418 		/*
1419 		 * Skip this segment unless the protection bits look like
1420 		 * what we'd expect for a text segment.
1421 		 */
1422 		if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC)
1423 			continue;
1424 
1425 		if (getelfhead(mvp, credp, &ehdr, &nshdrs, &shstrndx,
1426 		    &nphdrs) != 0 ||
1427 		    getelfshdr(mvp, credp, &ehdr, nshdrs, shstrndx,
1428 		    &shbase, &shsize, &shstrbase, &shstrsize) != 0)
1429 			continue;
1430 
1431 		off = ehdr.e_shentsize;
1432 		for (j = 1; j < nshdrs; j++, off += ehdr.e_shentsize) {
1433 			Shdr *symtab = NULL, *strtab;
1434 
1435 			shdr = (Shdr *)(shbase + off);
1436 
1437 			if (shdr->sh_name >= shstrsize)
1438 				continue;
1439 
1440 			name = shstrbase + shdr->sh_name;
1441 
1442 			if (strcmp(name, shstrtab_data[STR_CTF]) == 0) {
1443 				if ((content & CC_CONTENT_CTF) == 0 ||
1444 				    ctf_ndx != 0)
1445 					continue;
1446 
1447 				if (shdr->sh_link > 0 &&
1448 				    shdr->sh_link < nshdrs) {
1449 					symtab = (Shdr *)(shbase +
1450 					    shdr->sh_link * ehdr.e_shentsize);
1451 				}
1452 
1453 				if (v != NULL && i < nv - 1) {
1454 					if (shdr->sh_size > datasz &&
1455 					    shdr->sh_size <= elf_datasz_max) {
1456 						if (data != NULL)
1457 							kmem_free(data, datasz);
1458 
1459 						datasz = shdr->sh_size;
1460 						data = kmem_alloc(datasz,
1461 						    KM_SLEEP);
1462 					}
1463 
1464 					v[i].sh_name = shstrtab_ndx(&shstrtab,
1465 					    STR_CTF);
1466 					v[i].sh_addr = (Addr)(uintptr_t)saddr;
1467 					v[i].sh_type = SHT_PROGBITS;
1468 					v[i].sh_addralign = 4;
1469 					*doffsetp = roundup(*doffsetp,
1470 					    v[i].sh_addralign);
1471 					v[i].sh_offset = *doffsetp;
1472 					v[i].sh_size = shdr->sh_size;
1473 					if (symtab == NULL)  {
1474 						v[i].sh_link = 0;
1475 					} else if (symtab->sh_type ==
1476 					    SHT_SYMTAB &&
1477 					    symtab_ndx != 0) {
1478 						v[i].sh_link =
1479 						    symtab_ndx;
1480 					} else {
1481 						v[i].sh_link = i + 1;
1482 					}
1483 
1484 					copy_scn(shdr, mvp, &v[i], vp,
1485 					    doffsetp, data, datasz, credp,
1486 					    rlimit);
1487 				}
1488 
1489 				ctf_ndx = i++;
1490 
1491 				/*
1492 				 * We've already dumped the symtab.
1493 				 */
1494 				if (symtab != NULL &&
1495 				    symtab->sh_type == SHT_SYMTAB &&
1496 				    symtab_ndx != 0)
1497 					continue;
1498 
1499 			} else if (strcmp(name,
1500 			    shstrtab_data[STR_SYMTAB]) == 0) {
1501 				if ((content & CC_CONTENT_SYMTAB) == 0 ||
1502 				    symtab != 0)
1503 					continue;
1504 
1505 				symtab = shdr;
1506 			}
1507 
1508 			if (symtab != NULL) {
1509 				if ((symtab->sh_type != SHT_DYNSYM &&
1510 				    symtab->sh_type != SHT_SYMTAB) ||
1511 				    symtab->sh_link == 0 ||
1512 				    symtab->sh_link >= nshdrs)
1513 					continue;
1514 
1515 				strtab = (Shdr *)(shbase +
1516 				    symtab->sh_link * ehdr.e_shentsize);
1517 
1518 				if (strtab->sh_type != SHT_STRTAB)
1519 					continue;
1520 
1521 				if (v != NULL && i < nv - 2) {
1522 					sz = MAX(symtab->sh_size,
1523 					    strtab->sh_size);
1524 					if (sz > datasz &&
1525 					    sz <= elf_datasz_max) {
1526 						if (data != NULL)
1527 							kmem_free(data, datasz);
1528 
1529 						datasz = sz;
1530 						data = kmem_alloc(datasz,
1531 						    KM_SLEEP);
1532 					}
1533 
1534 					if (symtab->sh_type == SHT_DYNSYM) {
1535 						v[i].sh_name = shstrtab_ndx(
1536 						    &shstrtab, STR_DYNSYM);
1537 						v[i + 1].sh_name = shstrtab_ndx(
1538 						    &shstrtab, STR_DYNSTR);
1539 					} else {
1540 						v[i].sh_name = shstrtab_ndx(
1541 						    &shstrtab, STR_SYMTAB);
1542 						v[i + 1].sh_name = shstrtab_ndx(
1543 						    &shstrtab, STR_STRTAB);
1544 					}
1545 
1546 					v[i].sh_type = symtab->sh_type;
1547 					v[i].sh_addr = symtab->sh_addr;
1548 					if (ehdr.e_type == ET_DYN ||
1549 					    v[i].sh_addr == 0)
1550 						v[i].sh_addr +=
1551 						    (Addr)(uintptr_t)saddr;
1552 					v[i].sh_addralign =
1553 					    symtab->sh_addralign;
1554 					*doffsetp = roundup(*doffsetp,
1555 					    v[i].sh_addralign);
1556 					v[i].sh_offset = *doffsetp;
1557 					v[i].sh_size = symtab->sh_size;
1558 					v[i].sh_link = i + 1;
1559 					v[i].sh_entsize = symtab->sh_entsize;
1560 					v[i].sh_info = symtab->sh_info;
1561 
1562 					copy_scn(symtab, mvp, &v[i], vp,
1563 					    doffsetp, data, datasz, credp,
1564 					    rlimit);
1565 
1566 					v[i + 1].sh_type = SHT_STRTAB;
1567 					v[i + 1].sh_flags = SHF_STRINGS;
1568 					v[i + 1].sh_addr = symtab->sh_addr;
1569 					if (ehdr.e_type == ET_DYN ||
1570 					    v[i + 1].sh_addr == 0)
1571 						v[i + 1].sh_addr +=
1572 						    (Addr)(uintptr_t)saddr;
1573 					v[i + 1].sh_addralign =
1574 					    strtab->sh_addralign;
1575 					*doffsetp = roundup(*doffsetp,
1576 					    v[i + 1].sh_addralign);
1577 					v[i + 1].sh_offset = *doffsetp;
1578 					v[i + 1].sh_size = strtab->sh_size;
1579 
1580 					copy_scn(strtab, mvp, &v[i + 1], vp,
1581 					    doffsetp, data, datasz, credp,
1582 					    rlimit);
1583 				}
1584 
1585 				if (symtab->sh_type == SHT_SYMTAB)
1586 					symtab_ndx = i;
1587 				i += 2;
1588 			}
1589 		}
1590 
1591 		kmem_free(shstrbase, shstrsize);
1592 		kmem_free(shbase, shsize);
1593 
1594 		lastvp = mvp;
1595 	}
1596 
1597 	if (v == NULL) {
1598 		if (i == 1)
1599 			*nshdrsp = 0;
1600 		else
1601 			*nshdrsp = i + 1;
1602 		goto done;
1603 	}
1604 
1605 	if (i != nv - 1) {
1606 		cmn_err(CE_WARN, "elfcore: core dump failed for "
1607 		    "process %d; address space is changing", p->p_pid);
1608 		error = EIO;
1609 		goto done;
1610 	}
1611 
1612 	v[i].sh_name = shstrtab_ndx(&shstrtab, STR_SHSTRTAB);
1613 	v[i].sh_size = shstrtab_size(&shstrtab);
1614 	v[i].sh_addralign = 1;
1615 	*doffsetp = roundup(*doffsetp, v[i].sh_addralign);
1616 	v[i].sh_offset = *doffsetp;
1617 	v[i].sh_flags = SHF_STRINGS;
1618 	v[i].sh_type = SHT_STRTAB;
1619 
1620 	if (v[i].sh_size > datasz) {
1621 		if (data != NULL)
1622 			kmem_free(data, datasz);
1623 
1624 		datasz = v[i].sh_size;
1625 		data = kmem_alloc(datasz,
1626 		    KM_SLEEP);
1627 	}
1628 
1629 	shstrtab_dump(&shstrtab, data);
1630 
1631 	if ((error = core_write(vp, UIO_SYSSPACE, *doffsetp,
1632 	    data, v[i].sh_size, rlimit, credp)) != 0)
1633 		goto done;
1634 
1635 	*doffsetp += v[i].sh_size;
1636 
1637 done:
1638 	if (data != NULL)
1639 		kmem_free(data, datasz);
1640 
1641 	return (error);
1642 }
1643 
1644 int
1645 elfcore(vnode_t *vp, proc_t *p, cred_t *credp, rlim64_t rlimit, int sig,
1646     core_content_t content)
1647 {
1648 	offset_t poffset, soffset;
1649 	Off doffset;
1650 	int error, i, nphdrs, nshdrs;
1651 	int overflow = 0;
1652 	struct seg *seg;
1653 	struct as *as = p->p_as;
1654 	union {
1655 		Ehdr ehdr;
1656 		Phdr phdr[1];
1657 		Shdr shdr[1];
1658 	} *bigwad;
1659 	size_t bigsize;
1660 	size_t phdrsz, shdrsz;
1661 	Ehdr *ehdr;
1662 	Phdr *v;
1663 	caddr_t brkbase;
1664 	size_t brksize;
1665 	caddr_t stkbase;
1666 	size_t stksize;
1667 	int ntries = 0;
1668 
1669 top:
1670 	/*
1671 	 * Make sure we have everything we need (registers, etc.).
1672 	 * All other lwps have already stopped and are in an orderly state.
1673 	 */
1674 	ASSERT(p == ttoproc(curthread));
1675 	prstop(0, 0);
1676 
1677 	AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER);
1678 	nphdrs = prnsegs(as, 0) + 2;		/* two CORE note sections */
1679 
1680 	/*
1681 	 * Count the number of section headers we're going to need.
1682 	 */
1683 	nshdrs = 0;
1684 	if (content & (CC_CONTENT_CTF | CC_CONTENT_SYMTAB)) {
1685 		(void) process_scns(content, p, credp, NULL, NULL, NULL, 0,
1686 		    NULL, &nshdrs);
1687 	}
1688 	AS_LOCK_EXIT(as, &as->a_lock);
1689 
1690 	ASSERT(nshdrs == 0 || nshdrs > 1);
1691 
1692 	/*
1693 	 * The core file contents may required zero section headers, but if
1694 	 * we overflow the 16 bits allotted to the program header count in
1695 	 * the ELF header, we'll need that program header at index zero.
1696 	 */
1697 	if (nshdrs == 0 && nphdrs >= PN_XNUM)
1698 		nshdrs = 1;
1699 
1700 	phdrsz = nphdrs * sizeof (Phdr);
1701 	shdrsz = nshdrs * sizeof (Shdr);
1702 
1703 	bigsize = MAX(sizeof (*bigwad), MAX(phdrsz, shdrsz));
1704 	bigwad = kmem_alloc(bigsize, KM_SLEEP);
1705 
1706 	ehdr = &bigwad->ehdr;
1707 	bzero(ehdr, sizeof (*ehdr));
1708 
1709 	ehdr->e_ident[EI_MAG0] = ELFMAG0;
1710 	ehdr->e_ident[EI_MAG1] = ELFMAG1;
1711 	ehdr->e_ident[EI_MAG2] = ELFMAG2;
1712 	ehdr->e_ident[EI_MAG3] = ELFMAG3;
1713 	ehdr->e_ident[EI_CLASS] = ELFCLASS;
1714 	ehdr->e_type = ET_CORE;
1715 
1716 #if !defined(_LP64) || defined(_ELF32_COMPAT)
1717 
1718 #if defined(__sparc)
1719 	ehdr->e_ident[EI_DATA] = ELFDATA2MSB;
1720 	ehdr->e_machine = EM_SPARC;
1721 #elif defined(__i386) || defined(__i386_COMPAT)
1722 	ehdr->e_ident[EI_DATA] = ELFDATA2LSB;
1723 	ehdr->e_machine = EM_386;
1724 #else
1725 #error "no recognized machine type is defined"
1726 #endif
1727 
1728 #else	/* !defined(_LP64) || defined(_ELF32_COMPAT) */
1729 
1730 #if defined(__sparc)
1731 	ehdr->e_ident[EI_DATA] = ELFDATA2MSB;
1732 	ehdr->e_machine = EM_SPARCV9;
1733 #elif defined(__amd64)
1734 	ehdr->e_ident[EI_DATA] = ELFDATA2LSB;
1735 	ehdr->e_machine = EM_AMD64;
1736 #else
1737 #error "no recognized 64-bit machine type is defined"
1738 #endif
1739 
1740 #endif	/* !defined(_LP64) || defined(_ELF32_COMPAT) */
1741 
1742 	/*
1743 	 * If the count of program headers or section headers or the index
1744 	 * of the section string table can't fit in the mere 16 bits
1745 	 * shortsightedly allotted to them in the ELF header, we use the
1746 	 * extended formats and put the real values in the section header
1747 	 * as index 0.
1748 	 */
1749 	ehdr->e_version = EV_CURRENT;
1750 	ehdr->e_ehsize = sizeof (Ehdr);
1751 
1752 	if (nphdrs >= PN_XNUM)
1753 		ehdr->e_phnum = PN_XNUM;
1754 	else
1755 		ehdr->e_phnum = (unsigned short)nphdrs;
1756 
1757 	ehdr->e_phoff = sizeof (Ehdr);
1758 	ehdr->e_phentsize = sizeof (Phdr);
1759 
1760 	if (nshdrs > 0) {
1761 		if (nshdrs >= SHN_LORESERVE)
1762 			ehdr->e_shnum = 0;
1763 		else
1764 			ehdr->e_shnum = (unsigned short)nshdrs;
1765 
1766 		if (nshdrs - 1 >= SHN_LORESERVE)
1767 			ehdr->e_shstrndx = SHN_XINDEX;
1768 		else
1769 			ehdr->e_shstrndx = (unsigned short)(nshdrs - 1);
1770 
1771 		ehdr->e_shoff = ehdr->e_phoff + ehdr->e_phentsize * nphdrs;
1772 		ehdr->e_shentsize = sizeof (Shdr);
1773 	}
1774 
1775 	if (error = core_write(vp, UIO_SYSSPACE, (offset_t)0, ehdr,
1776 	    sizeof (Ehdr), rlimit, credp))
1777 		goto done;
1778 
1779 	poffset = sizeof (Ehdr);
1780 	soffset = sizeof (Ehdr) + phdrsz;
1781 	doffset = sizeof (Ehdr) + phdrsz + shdrsz;
1782 
1783 	v = &bigwad->phdr[0];
1784 	bzero(v, phdrsz);
1785 
1786 	setup_old_note_header(&v[0], p);
1787 	v[0].p_offset = doffset = roundup(doffset, sizeof (Word));
1788 	doffset += v[0].p_filesz;
1789 
1790 	setup_note_header(&v[1], p);
1791 	v[1].p_offset = doffset = roundup(doffset, sizeof (Word));
1792 	doffset += v[1].p_filesz;
1793 
1794 	mutex_enter(&p->p_lock);
1795 
1796 	brkbase = p->p_brkbase;
1797 	brksize = p->p_brksize;
1798 
1799 	stkbase = p->p_usrstack - p->p_stksize;
1800 	stksize = p->p_stksize;
1801 
1802 	mutex_exit(&p->p_lock);
1803 
1804 	AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER);
1805 	i = 2;
1806 	for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
1807 		caddr_t eaddr = seg->s_base + pr_getsegsize(seg, 0);
1808 		caddr_t saddr, naddr;
1809 		void *tmp = NULL;
1810 		extern struct seg_ops segspt_shmops;
1811 
1812 		for (saddr = seg->s_base; saddr < eaddr; saddr = naddr) {
1813 			uint_t prot;
1814 			size_t size;
1815 			int type;
1816 			vnode_t *mvp;
1817 
1818 			prot = pr_getprot(seg, 0, &tmp, &saddr, &naddr, eaddr);
1819 			prot &= PROT_READ | PROT_WRITE | PROT_EXEC;
1820 			if ((size = (size_t)(naddr - saddr)) == 0)
1821 				continue;
1822 			if (i == nphdrs) {
1823 				overflow++;
1824 				continue;
1825 			}
1826 			v[i].p_type = PT_LOAD;
1827 			v[i].p_vaddr = (Addr)(uintptr_t)saddr;
1828 			v[i].p_memsz = size;
1829 			if (prot & PROT_READ)
1830 				v[i].p_flags |= PF_R;
1831 			if (prot & PROT_WRITE)
1832 				v[i].p_flags |= PF_W;
1833 			if (prot & PROT_EXEC)
1834 				v[i].p_flags |= PF_X;
1835 
1836 			/*
1837 			 * Figure out which mappings to include in the core.
1838 			 */
1839 			type = SEGOP_GETTYPE(seg, saddr);
1840 
1841 			if (saddr == stkbase && size == stksize) {
1842 				if (!(content & CC_CONTENT_STACK))
1843 					goto exclude;
1844 
1845 			} else if (saddr == brkbase && size == brksize) {
1846 				if (!(content & CC_CONTENT_HEAP))
1847 					goto exclude;
1848 
1849 			} else if (seg->s_ops == &segspt_shmops) {
1850 				if (type & MAP_NORESERVE) {
1851 					if (!(content & CC_CONTENT_DISM))
1852 						goto exclude;
1853 				} else {
1854 					if (!(content & CC_CONTENT_ISM))
1855 						goto exclude;
1856 				}
1857 
1858 			} else if (seg->s_ops != &segvn_ops) {
1859 				goto exclude;
1860 
1861 			} else if (type & MAP_SHARED) {
1862 				if (shmgetid(p, saddr) != SHMID_NONE) {
1863 					if (!(content & CC_CONTENT_SHM))
1864 						goto exclude;
1865 
1866 				} else if (SEGOP_GETVP(seg, seg->s_base,
1867 				    &mvp) != 0 || mvp == NULL ||
1868 				    mvp->v_type != VREG) {
1869 					if (!(content & CC_CONTENT_SHANON))
1870 						goto exclude;
1871 
1872 				} else {
1873 					if (!(content & CC_CONTENT_SHFILE))
1874 						goto exclude;
1875 				}
1876 
1877 			} else if (SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 ||
1878 			    mvp == NULL || mvp->v_type != VREG) {
1879 				if (!(content & CC_CONTENT_ANON))
1880 					goto exclude;
1881 
1882 			} else if (prot == (PROT_READ | PROT_EXEC)) {
1883 				if (!(content & CC_CONTENT_TEXT))
1884 					goto exclude;
1885 
1886 			} else if (prot == PROT_READ) {
1887 				if (!(content & CC_CONTENT_RODATA))
1888 					goto exclude;
1889 
1890 			} else {
1891 				if (!(content & CC_CONTENT_DATA))
1892 					goto exclude;
1893 			}
1894 
1895 			doffset = roundup(doffset, sizeof (Word));
1896 			v[i].p_offset = doffset;
1897 			v[i].p_filesz = size;
1898 			doffset += size;
1899 exclude:
1900 			i++;
1901 		}
1902 		ASSERT(tmp == NULL);
1903 	}
1904 	AS_LOCK_EXIT(as, &as->a_lock);
1905 
1906 	if (overflow || i != nphdrs) {
1907 		if (ntries++ == 0) {
1908 			kmem_free(bigwad, bigsize);
1909 			goto top;
1910 		}
1911 		cmn_err(CE_WARN, "elfcore: core dump failed for "
1912 		    "process %d; address space is changing", p->p_pid);
1913 		error = EIO;
1914 		goto done;
1915 	}
1916 
1917 	if ((error = core_write(vp, UIO_SYSSPACE, poffset,
1918 	    v, phdrsz, rlimit, credp)) != 0)
1919 		goto done;
1920 
1921 	if ((error = write_old_elfnotes(p, sig, vp, v[0].p_offset, rlimit,
1922 	    credp)) != 0)
1923 		goto done;
1924 
1925 	if ((error = write_elfnotes(p, sig, vp, v[1].p_offset, rlimit,
1926 	    credp, content)) != 0)
1927 		goto done;
1928 
1929 	for (i = 2; i < nphdrs; i++) {
1930 		if (v[i].p_filesz == 0)
1931 			continue;
1932 
1933 		/*
1934 		 * If dumping out this segment fails, rather than failing
1935 		 * the core dump entirely, we reset the size of the mapping
1936 		 * to zero to indicate that the data is absent from the core
1937 		 * file and or in the PF_SUNW_FAILURE flag to differentiate
1938 		 * this from mappings that were excluded due to the core file
1939 		 * content settings.
1940 		 */
1941 		if ((error = core_seg(p, vp, v[i].p_offset,
1942 		    (caddr_t)(uintptr_t)v[i].p_vaddr, v[i].p_filesz,
1943 		    rlimit, credp)) != 0) {
1944 
1945 			/*
1946 			 * Since the space reserved for the segment is now
1947 			 * unused, we stash the errno in the first four
1948 			 * bytes. This undocumented interface will let us
1949 			 * understand the nature of the failure.
1950 			 */
1951 			(void) core_write(vp, UIO_SYSSPACE, v[i].p_offset,
1952 			    &error, sizeof (error), rlimit, credp);
1953 
1954 			v[i].p_filesz = 0;
1955 			v[i].p_flags |= PF_SUNW_FAILURE;
1956 			if ((error = core_write(vp, UIO_SYSSPACE,
1957 			    poffset + sizeof (v[i]) * i, &v[i], sizeof (v[i]),
1958 			    rlimit, credp)) != 0)
1959 				goto done;
1960 		}
1961 	}
1962 
1963 	if (nshdrs > 0) {
1964 		bzero(&bigwad->shdr[0], shdrsz);
1965 
1966 		if (nshdrs >= SHN_LORESERVE)
1967 			bigwad->shdr[0].sh_size = nshdrs;
1968 
1969 		if (nshdrs - 1 >= SHN_LORESERVE)
1970 			bigwad->shdr[0].sh_link = nshdrs - 1;
1971 
1972 		if (nphdrs >= PN_XNUM)
1973 			bigwad->shdr[0].sh_info = nphdrs;
1974 
1975 		if (nshdrs > 1) {
1976 			AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER);
1977 			if ((error = process_scns(content, p, credp, vp,
1978 			    &bigwad->shdr[0], nshdrs, rlimit, &doffset,
1979 			    NULL)) != 0) {
1980 				AS_LOCK_EXIT(as, &as->a_lock);
1981 				goto done;
1982 			}
1983 			AS_LOCK_EXIT(as, &as->a_lock);
1984 		}
1985 
1986 		if ((error = core_write(vp, UIO_SYSSPACE, soffset,
1987 		    &bigwad->shdr[0], shdrsz, rlimit, credp)) != 0)
1988 			goto done;
1989 	}
1990 
1991 done:
1992 	kmem_free(bigwad, bigsize);
1993 	return (error);
1994 }
1995 
1996 #ifndef	_ELF32_COMPAT
1997 
1998 static struct execsw esw = {
1999 #ifdef	_LP64
2000 	elf64magicstr,
2001 #else	/* _LP64 */
2002 	elf32magicstr,
2003 #endif	/* _LP64 */
2004 	0,
2005 	5,
2006 	elfexec,
2007 	elfcore
2008 };
2009 
2010 static struct modlexec modlexec = {
2011 	&mod_execops, "exec module for elf %I%", &esw
2012 };
2013 
2014 #ifdef	_LP64
2015 extern int elf32exec(vnode_t *vp, execa_t *uap, uarg_t *args,
2016 			intpdata_t *idatap, int level, long *execsz,
2017 			int setid, caddr_t exec_file, cred_t *cred,
2018 			int brand_action);
2019 extern int elf32core(vnode_t *vp, proc_t *p, cred_t *credp,
2020 			rlim64_t rlimit, int sig, core_content_t content);
2021 
2022 static struct execsw esw32 = {
2023 	elf32magicstr,
2024 	0,
2025 	5,
2026 	elf32exec,
2027 	elf32core
2028 };
2029 
2030 static struct modlexec modlexec32 = {
2031 	&mod_execops, "32-bit exec module for elf", &esw32
2032 };
2033 #endif	/* _LP64 */
2034 
2035 static struct modlinkage modlinkage = {
2036 	MODREV_1,
2037 	(void *)&modlexec,
2038 #ifdef	_LP64
2039 	(void *)&modlexec32,
2040 #endif	/* _LP64 */
2041 	NULL
2042 };
2043 
2044 int
2045 _init(void)
2046 {
2047 	return (mod_install(&modlinkage));
2048 }
2049 
2050 int
2051 _fini(void)
2052 {
2053 	return (mod_remove(&modlinkage));
2054 }
2055 
2056 int
2057 _info(struct modinfo *modinfop)
2058 {
2059 	return (mod_info(&modlinkage, modinfop));
2060 }
2061 
2062 #endif	/* !_ELF32_COMPAT */
2063