1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License, Version 1.0 only 6 * (the "License"). You may not use this file except in compliance 7 * with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 /* Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */ 28 /* All Rights Reserved */ 29 30 31 #pragma ident "%Z%%M% %I% %E% SMI" 32 33 #include <sys/types.h> 34 #include <sys/param.h> 35 #include <sys/thread.h> 36 #include <sys/sysmacros.h> 37 #include <sys/signal.h> 38 #include <sys/cred.h> 39 #include <sys/user.h> 40 #include <sys/errno.h> 41 #include <sys/vnode.h> 42 #include <sys/mman.h> 43 #include <sys/kmem.h> 44 #include <sys/proc.h> 45 #include <sys/pathname.h> 46 #include <sys/cmn_err.h> 47 #include <sys/systm.h> 48 #include <sys/elf.h> 49 #include <sys/vmsystm.h> 50 #include <sys/debug.h> 51 #include <sys/auxv.h> 52 #include <sys/exec.h> 53 #include <sys/prsystm.h> 54 #include <vm/as.h> 55 #include <vm/rm.h> 56 #include <vm/seg.h> 57 #include <vm/seg_vn.h> 58 #include <sys/modctl.h> 59 #include <sys/systeminfo.h> 60 #include <sys/vmparam.h> 61 #include <sys/machelf.h> 62 #include <sys/shm_impl.h> 63 #include <sys/archsystm.h> 64 #include <sys/fasttrap.h> 65 #include "elf_impl.h" 66 67 extern int at_flags; 68 69 #define ORIGIN_STR "ORIGIN" 70 #define ORIGIN_STR_SIZE 6 71 72 static int getelfhead(vnode_t *, cred_t *, Ehdr *, int *, int *, int *); 73 static int getelfphdr(vnode_t *, cred_t *, const Ehdr *, int, caddr_t *, 74 ssize_t *); 75 static int getelfshdr(vnode_t *, cred_t *, const Ehdr *, int, int, caddr_t *, 76 ssize_t *, caddr_t *, ssize_t *); 77 static size_t elfsize(Ehdr *, int, caddr_t, uintptr_t *); 78 static int mapelfexec(vnode_t *, Ehdr *, int, caddr_t, 79 Phdr **, Phdr **, Phdr **, Phdr **, Phdr *, 80 caddr_t *, caddr_t *, intptr_t *, size_t, long *, size_t *); 81 82 typedef enum { 83 STR_CTF, 84 STR_SYMTAB, 85 STR_DYNSYM, 86 STR_STRTAB, 87 STR_DYNSTR, 88 STR_SHSTRTAB, 89 STR_NUM 90 } shstrtype_t; 91 92 static const char *shstrtab_data[] = { 93 ".SUNW_ctf", 94 ".symtab", 95 ".dynsym", 96 ".strtab", 97 ".dynstr", 98 ".shstrtab" 99 }; 100 101 typedef struct shstrtab { 102 int sst_ndx[STR_NUM]; 103 int sst_cur; 104 } shstrtab_t; 105 106 static void 107 shstrtab_init(shstrtab_t *s) 108 { 109 bzero(&s->sst_ndx, sizeof (s->sst_ndx)); 110 s->sst_cur = 1; 111 } 112 113 static int 114 shstrtab_ndx(shstrtab_t *s, shstrtype_t type) 115 { 116 int ret; 117 118 if ((ret = s->sst_ndx[type]) != 0) 119 return (ret); 120 121 ret = s->sst_ndx[type] = s->sst_cur; 122 s->sst_cur += strlen(shstrtab_data[type]) + 1; 123 124 return (ret); 125 } 126 127 static size_t 128 shstrtab_size(const shstrtab_t *s) 129 { 130 return (s->sst_cur); 131 } 132 133 static void 134 shstrtab_dump(const shstrtab_t *s, char *buf) 135 { 136 int i, ndx; 137 138 *buf = '\0'; 139 for (i = 0; i < STR_NUM; i++) { 140 if ((ndx = s->sst_ndx[i]) != 0) 141 (void) strcpy(buf + ndx, shstrtab_data[i]); 142 } 143 } 144 145 static int 146 dtrace_safe_phdr(Phdr *phdrp, struct uarg *args, uintptr_t base) 147 { 148 ASSERT(phdrp->p_type == PT_SUNWDTRACE); 149 150 /* 151 * See the comment in fasttrap.h for information on how to safely 152 * update this program header. 153 */ 154 if (phdrp->p_memsz < PT_SUNWDTRACE_SIZE || 155 (phdrp->p_flags & (PF_R | PF_W | PF_X)) != (PF_R | PF_W | PF_X)) 156 return (-1); 157 158 args->thrptr = phdrp->p_vaddr + base; 159 160 return (0); 161 } 162 163 /*ARGSUSED*/ 164 int 165 elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap, 166 int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred) 167 { 168 caddr_t phdrbase = NULL; 169 caddr_t bssbase = 0; 170 caddr_t brkbase = 0; 171 size_t brksize = 0; 172 ssize_t dlnsize; 173 aux_entry_t *aux; 174 int error; 175 ssize_t resid; 176 int fd = -1; 177 intptr_t voffset; 178 Phdr *dyphdr = NULL; 179 Phdr *stphdr = NULL; 180 Phdr *uphdr = NULL; 181 Phdr *junk = NULL; 182 size_t len; 183 ssize_t phdrsize; 184 int postfixsize = 0; 185 int i, hsize; 186 Phdr *phdrp; 187 Phdr *dataphdrp = NULL; 188 Phdr *dtrphdr; 189 int hasu = 0; 190 int hasauxv = 0; 191 int hasdy = 0; 192 193 struct proc *p = ttoproc(curthread); 194 struct user *up = PTOU(p); 195 struct bigwad { 196 Ehdr ehdr; 197 aux_entry_t elfargs[__KERN_NAUXV_IMPL]; 198 char dl_name[MAXPATHLEN]; 199 char pathbuf[MAXPATHLEN]; 200 struct vattr vattr; 201 struct execenv exenv; 202 } *bigwad; /* kmem_alloc this behemoth so we don't blow stack */ 203 Ehdr *ehdrp; 204 int nshdrs, shstrndx, nphdrs; 205 char *dlnp; 206 char *pathbufp; 207 rlim64_t limit; 208 rlim64_t roundlimit; 209 210 ASSERT(p->p_model == DATAMODEL_ILP32 || p->p_model == DATAMODEL_LP64); 211 212 bigwad = kmem_alloc(sizeof (struct bigwad), KM_SLEEP); 213 ehdrp = &bigwad->ehdr; 214 dlnp = bigwad->dl_name; 215 pathbufp = bigwad->pathbuf; 216 217 /* 218 * Obtain ELF and program header information. 219 */ 220 if ((error = getelfhead(vp, CRED(), ehdrp, &nshdrs, &shstrndx, 221 &nphdrs)) != 0 || 222 (error = getelfphdr(vp, CRED(), ehdrp, nphdrs, &phdrbase, 223 &phdrsize)) != 0) 224 goto out; 225 226 /* 227 * Put data model that we're exec-ing to into the args passed to 228 * exec_args(), so it will know what it is copying to on new stack. 229 * Now that we know whether we are exec-ing a 32-bit or 64-bit 230 * executable, we can set execsz with the appropriate NCARGS. 231 */ 232 #ifdef _LP64 233 if (ehdrp->e_ident[EI_CLASS] == ELFCLASS32) { 234 args->to_model = DATAMODEL_ILP32; 235 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS32-1); 236 } else { 237 args->to_model = DATAMODEL_LP64; 238 args->stk_prot &= ~PROT_EXEC; 239 #if defined(__i386) || defined(__amd64) 240 args->dat_prot &= ~PROT_EXEC; 241 #endif 242 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS64-1); 243 } 244 #else /* _LP64 */ 245 args->to_model = DATAMODEL_ILP32; 246 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS-1); 247 #endif /* _LP64 */ 248 249 /* 250 * Determine aux size now so that stack can be built 251 * in one shot (except actual copyout of aux image), 252 * determine any non-default stack protections, 253 * and still have this code be machine independent. 254 */ 255 hsize = ehdrp->e_phentsize; 256 phdrp = (Phdr *)phdrbase; 257 for (i = nphdrs; i > 0; i--) { 258 switch (phdrp->p_type) { 259 case PT_INTERP: 260 hasauxv = hasdy = 1; 261 break; 262 case PT_PHDR: 263 hasu = 1; 264 break; 265 case PT_SUNWSTACK: 266 args->stk_prot = PROT_USER; 267 if (phdrp->p_flags & PF_R) 268 args->stk_prot |= PROT_READ; 269 if (phdrp->p_flags & PF_W) 270 args->stk_prot |= PROT_WRITE; 271 if (phdrp->p_flags & PF_X) 272 args->stk_prot |= PROT_EXEC; 273 break; 274 case PT_LOAD: 275 dataphdrp = phdrp; 276 break; 277 } 278 phdrp = (Phdr *)((caddr_t)phdrp + hsize); 279 } 280 281 if (ehdrp->e_type != ET_EXEC) { 282 dataphdrp = NULL; 283 hasauxv = 1; 284 } 285 286 /* Copy BSS permissions to args->dat_prot */ 287 if (dataphdrp != NULL) { 288 args->dat_prot = PROT_USER; 289 if (dataphdrp->p_flags & PF_R) 290 args->dat_prot |= PROT_READ; 291 if (dataphdrp->p_flags & PF_W) 292 args->dat_prot |= PROT_WRITE; 293 if (dataphdrp->p_flags & PF_X) 294 args->dat_prot |= PROT_EXEC; 295 } 296 297 /* 298 * If a auxvector will be required - reserve the space for 299 * it now. This may be increased by exec_args if there are 300 * ISA-specific types (included in __KERN_NAUXV_IMPL). 301 */ 302 if (hasauxv) { 303 /* 304 * If a AUX vector is being built - the base AUX 305 * entries are: 306 * 307 * AT_BASE 308 * AT_FLAGS 309 * AT_PAGESZ 310 * AT_SUN_LDSECURE 311 * AT_SUN_HWCAP 312 * AT_SUN_PLATFORM 313 * AT_SUN_EXECNAME 314 * AT_NULL 315 * 316 * total == 8 317 */ 318 if (hasdy && hasu) { 319 /* 320 * Has PT_INTERP & PT_PHDR - the auxvectors that 321 * will be built are: 322 * 323 * AT_PHDR 324 * AT_PHENT 325 * AT_PHNUM 326 * AT_ENTRY 327 * AT_LDDATA 328 * 329 * total = 5 330 */ 331 args->auxsize = (8 + 5) * sizeof (aux_entry_t); 332 } else if (hasdy) { 333 /* 334 * Has PT_INTERP but no PT_PHDR 335 * 336 * AT_EXECFD 337 * AT_LDDATA 338 * 339 * total = 2 340 */ 341 args->auxsize = (8 + 2) * sizeof (aux_entry_t); 342 } else { 343 args->auxsize = 8 * sizeof (aux_entry_t); 344 } 345 } else 346 args->auxsize = 0; 347 348 aux = bigwad->elfargs; 349 /* 350 * Move args to the user's stack. 351 */ 352 if ((error = exec_args(uap, args, idatap, (void **)&aux)) != 0) { 353 if (error == -1) { 354 error = ENOEXEC; 355 goto bad; 356 } 357 goto out; 358 } 359 360 /* 361 * If this is an ET_DYN executable (shared object), 362 * determine its memory size so that mapelfexec() can load it. 363 */ 364 if (ehdrp->e_type == ET_DYN) 365 len = elfsize(ehdrp, nphdrs, phdrbase, NULL); 366 else 367 len = 0; 368 369 dtrphdr = NULL; 370 371 if ((error = mapelfexec(vp, ehdrp, nphdrs, phdrbase, &uphdr, &dyphdr, 372 &stphdr, &dtrphdr, dataphdrp, &bssbase, &brkbase, &voffset, len, 373 execsz, &brksize)) != 0) 374 goto bad; 375 376 if (uphdr != NULL && dyphdr == NULL) 377 goto bad; 378 379 if (dtrphdr != NULL && dtrace_safe_phdr(dtrphdr, args, voffset) != 0) { 380 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, exec_file); 381 goto bad; 382 } 383 384 if (dyphdr != NULL) { 385 size_t len; 386 uintptr_t lddata; 387 char *p; 388 struct vnode *nvp; 389 390 dlnsize = dyphdr->p_filesz; 391 392 if (dlnsize > MAXPATHLEN || dlnsize <= 0) 393 goto bad; 394 395 /* 396 * Read in "interpreter" pathname. 397 */ 398 if ((error = vn_rdwr(UIO_READ, vp, dlnp, dyphdr->p_filesz, 399 (offset_t)dyphdr->p_offset, UIO_SYSSPACE, 0, (rlim64_t)0, 400 CRED(), &resid)) != 0) { 401 uprintf("%s: Cannot obtain interpreter pathname\n", 402 exec_file); 403 goto bad; 404 } 405 406 if (resid != 0 || dlnp[dlnsize - 1] != '\0') 407 goto bad; 408 409 /* 410 * Search for '$ORIGIN' token in interpreter path. 411 * If found, expand it. 412 */ 413 for (p = dlnp; p = strchr(p, '$'); ) { 414 uint_t len, curlen; 415 char *_ptr; 416 417 if (strncmp(++p, ORIGIN_STR, ORIGIN_STR_SIZE)) 418 continue; 419 420 curlen = 0; 421 len = p - dlnp - 1; 422 if (len) { 423 bcopy(dlnp, pathbufp, len); 424 curlen += len; 425 } 426 if (_ptr = strrchr(args->pathname, '/')) { 427 len = _ptr - args->pathname; 428 if ((curlen + len) > MAXPATHLEN) 429 break; 430 431 bcopy(args->pathname, &pathbufp[curlen], len); 432 curlen += len; 433 } else { 434 /* 435 * executable is a basename found in the 436 * current directory. So - just substitue 437 * '.' for ORIGIN. 438 */ 439 pathbufp[curlen] = '.'; 440 curlen++; 441 } 442 p += ORIGIN_STR_SIZE; 443 len = strlen(p); 444 445 if ((curlen + len) > MAXPATHLEN) 446 break; 447 bcopy(p, &pathbufp[curlen], len); 448 curlen += len; 449 pathbufp[curlen++] = '\0'; 450 bcopy(pathbufp, dlnp, curlen); 451 } 452 453 /* 454 * /usr/lib/ld.so.1 is known to be a symlink to /lib/ld.so.1 455 * (and /usr/lib/64/ld.so.1 is a symlink to /lib/64/ld.so.1). 456 * Just in case /usr is not mounted, change it now. 457 */ 458 if (strcmp(dlnp, USR_LIB_RTLD) == 0) 459 dlnp += 4; 460 error = lookupname(dlnp, UIO_SYSSPACE, FOLLOW, NULLVPP, &nvp); 461 if (error && dlnp != bigwad->dl_name) { 462 /* new kernel, old user-level */ 463 error = lookupname(dlnp -= 4, UIO_SYSSPACE, FOLLOW, 464 NULLVPP, &nvp); 465 } 466 if (error) { 467 uprintf("%s: Cannot find %s\n", exec_file, dlnp); 468 goto bad; 469 } 470 471 /* 472 * Setup the "aux" vector. 473 */ 474 if (uphdr) { 475 if (ehdrp->e_type == ET_DYN) { 476 /* don't use the first page */ 477 bigwad->exenv.ex_brkbase = (caddr_t)PAGESIZE; 478 bigwad->exenv.ex_bssbase = (caddr_t)PAGESIZE; 479 } else { 480 bigwad->exenv.ex_bssbase = bssbase; 481 bigwad->exenv.ex_brkbase = brkbase; 482 } 483 bigwad->exenv.ex_brksize = brksize; 484 bigwad->exenv.ex_magic = elfmagic; 485 bigwad->exenv.ex_vp = vp; 486 setexecenv(&bigwad->exenv); 487 488 ADDAUX(aux, AT_PHDR, uphdr->p_vaddr + voffset) 489 ADDAUX(aux, AT_PHENT, ehdrp->e_phentsize) 490 ADDAUX(aux, AT_PHNUM, nphdrs) 491 ADDAUX(aux, AT_ENTRY, ehdrp->e_entry + voffset) 492 } else { 493 if ((error = execopen(&vp, &fd)) != 0) { 494 VN_RELE(nvp); 495 goto bad; 496 } 497 498 ADDAUX(aux, AT_EXECFD, fd) 499 } 500 501 if ((error = execpermissions(nvp, &bigwad->vattr, args)) != 0) { 502 VN_RELE(nvp); 503 uprintf("%s: Cannot execute %s\n", exec_file, dlnp); 504 goto bad; 505 } 506 507 /* 508 * Now obtain the ELF header along with the entire program 509 * header contained in "nvp". 510 */ 511 kmem_free(phdrbase, phdrsize); 512 phdrbase = NULL; 513 if ((error = getelfhead(nvp, CRED(), ehdrp, &nshdrs, 514 &shstrndx, &nphdrs)) != 0 || 515 (error = getelfphdr(nvp, CRED(), ehdrp, nphdrs, &phdrbase, 516 &phdrsize)) != 0) { 517 VN_RELE(nvp); 518 uprintf("%s: Cannot read %s\n", exec_file, dlnp); 519 goto bad; 520 } 521 522 /* 523 * Determine memory size of the "interpreter's" loadable 524 * sections. This size is then used to obtain the virtual 525 * address of a hole, in the user's address space, large 526 * enough to map the "interpreter". 527 */ 528 if ((len = elfsize(ehdrp, nphdrs, phdrbase, &lddata)) == 0) { 529 VN_RELE(nvp); 530 uprintf("%s: Nothing to load in %s\n", exec_file, dlnp); 531 goto bad; 532 } 533 534 dtrphdr = NULL; 535 536 error = mapelfexec(nvp, ehdrp, nphdrs, phdrbase, &junk, &junk, 537 &junk, &dtrphdr, NULL, NULL, NULL, &voffset, len, execsz, 538 NULL); 539 if (error || junk != NULL) { 540 VN_RELE(nvp); 541 uprintf("%s: Cannot map %s\n", exec_file, dlnp); 542 goto bad; 543 } 544 545 /* 546 * We use the DTrace program header to initialize the 547 * architecture-specific user per-LWP location. The dtrace 548 * fasttrap provider requires ready access to per-LWP scratch 549 * space. We assume that there is only one such program header 550 * in the interpreter. 551 */ 552 if (dtrphdr != NULL && 553 dtrace_safe_phdr(dtrphdr, args, voffset) != 0) { 554 VN_RELE(nvp); 555 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, dlnp); 556 goto bad; 557 } 558 559 VN_RELE(nvp); 560 ADDAUX(aux, AT_SUN_LDDATA, voffset + lddata) 561 } 562 563 if (hasauxv) { 564 int auxf = AF_SUN_HWCAPVERIFY; 565 /* 566 * Note: AT_SUN_PLATFORM was filled in via exec_args() 567 */ 568 ADDAUX(aux, AT_BASE, voffset) 569 ADDAUX(aux, AT_FLAGS, at_flags) 570 ADDAUX(aux, AT_PAGESZ, PAGESIZE) 571 /* 572 * Linker flags. (security) 573 * p_flag not yet set at this time. 574 * We rely on gexec() to provide us with the information. 575 * If the application is set-uid but this is not reflected 576 * in a mismatch between real/effective uids/gids, then 577 * don't treat this as a set-uid exec. So we care about 578 * the EXECSETID_UGIDS flag but not the ...SETID flag. 579 */ 580 setid &= ~EXECSETID_SETID; 581 ADDAUX(aux, AT_SUN_AUXFLAGS, 582 setid ? AF_SUN_SETUGID | auxf : auxf); 583 /* 584 * Hardware capability flag word (performance hints) 585 * Used for choosing faster library routines. 586 * (Potentially different between 32-bit and 64-bit ABIs) 587 */ 588 #if defined(_LP64) 589 if (args->to_model == DATAMODEL_NATIVE) 590 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap) 591 else 592 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap32) 593 #else 594 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap) 595 #endif 596 ADDAUX(aux, AT_NULL, 0) 597 postfixsize = (char *)aux - (char *)bigwad->elfargs; 598 ASSERT(postfixsize == args->auxsize); 599 ASSERT(postfixsize <= __KERN_NAUXV_IMPL * sizeof (aux_entry_t)); 600 } 601 602 /* 603 * For the 64-bit kernel, the limit is big enough that rounding it up 604 * to a page can overflow the 64-bit limit, so we check for btopr() 605 * overflowing here by comparing it with the unrounded limit in pages. 606 * If it hasn't overflowed, compare the exec size with the rounded up 607 * limit in pages. Otherwise, just compare with the unrounded limit. 608 */ 609 limit = btop(p->p_vmem_ctl); 610 roundlimit = btopr(p->p_vmem_ctl); 611 if ((roundlimit > limit && *execsz > roundlimit) || 612 (roundlimit < limit && *execsz > limit)) { 613 mutex_enter(&p->p_lock); 614 (void) rctl_action(rctlproc_legacy[RLIMIT_VMEM], p->p_rctls, p, 615 RCA_SAFE); 616 mutex_exit(&p->p_lock); 617 error = ENOMEM; 618 goto bad; 619 } 620 621 bzero(up->u_auxv, sizeof (up->u_auxv)); 622 if (postfixsize) { 623 int num_auxv; 624 625 /* 626 * Copy the aux vector to the user stack. 627 */ 628 error = execpoststack(args, bigwad->elfargs, postfixsize); 629 if (error) 630 goto bad; 631 632 /* 633 * Copy auxv to the process's user structure for use by /proc. 634 */ 635 num_auxv = postfixsize / sizeof (aux_entry_t); 636 ASSERT(num_auxv <= sizeof (up->u_auxv) / sizeof (auxv_t)); 637 aux = bigwad->elfargs; 638 for (i = 0; i < num_auxv; i++) { 639 up->u_auxv[i].a_type = aux[i].a_type; 640 up->u_auxv[i].a_un.a_val = (aux_val_t)aux[i].a_un.a_val; 641 } 642 } 643 644 /* 645 * Pass back the starting address so we can set the program counter. 646 */ 647 args->entry = (uintptr_t)(ehdrp->e_entry + voffset); 648 649 if (!uphdr) { 650 if (ehdrp->e_type == ET_DYN) { 651 /* 652 * If we are executing a shared library which doesn't 653 * have a interpreter (probably ld.so.1) then 654 * we don't set the brkbase now. Instead we 655 * delay it's setting until the first call 656 * via grow.c::brk(). This permits ld.so.1 to 657 * initialize brkbase to the tail of the executable it 658 * loads (which is where it needs to be). 659 */ 660 bigwad->exenv.ex_brkbase = (caddr_t)0; 661 bigwad->exenv.ex_bssbase = (caddr_t)0; 662 bigwad->exenv.ex_brksize = 0; 663 } else { 664 bigwad->exenv.ex_brkbase = brkbase; 665 bigwad->exenv.ex_bssbase = bssbase; 666 bigwad->exenv.ex_brksize = brksize; 667 } 668 bigwad->exenv.ex_magic = elfmagic; 669 bigwad->exenv.ex_vp = vp; 670 setexecenv(&bigwad->exenv); 671 } 672 673 ASSERT(error == 0); 674 goto out; 675 676 bad: 677 if (fd != -1) /* did we open the a.out yet */ 678 (void) execclose(fd); 679 680 psignal(p, SIGKILL); 681 682 if (error == 0) 683 error = ENOEXEC; 684 out: 685 if (phdrbase != NULL) 686 kmem_free(phdrbase, phdrsize); 687 kmem_free(bigwad, sizeof (struct bigwad)); 688 return (error); 689 } 690 691 /* 692 * Compute the memory size requirement for the ELF file. 693 */ 694 static size_t 695 elfsize(Ehdr *ehdrp, int nphdrs, caddr_t phdrbase, uintptr_t *lddata) 696 { 697 size_t len; 698 Phdr *phdrp = (Phdr *)phdrbase; 699 int hsize = ehdrp->e_phentsize; 700 int first = 1; 701 int dfirst = 1; /* first data segment */ 702 uintptr_t loaddr = 0; 703 uintptr_t hiaddr = 0; 704 uintptr_t lo, hi; 705 int i; 706 707 for (i = nphdrs; i > 0; i--) { 708 if (phdrp->p_type == PT_LOAD) { 709 lo = phdrp->p_vaddr; 710 hi = lo + phdrp->p_memsz; 711 if (first) { 712 loaddr = lo; 713 hiaddr = hi; 714 first = 0; 715 } else { 716 if (loaddr > lo) 717 loaddr = lo; 718 if (hiaddr < hi) 719 hiaddr = hi; 720 } 721 722 /* 723 * save the address of the first data segment 724 * of a object - used for the AT_SUNW_LDDATA 725 * aux entry. 726 */ 727 if ((lddata != NULL) && dfirst && 728 (phdrp->p_flags & PF_W)) { 729 *lddata = lo; 730 dfirst = 0; 731 } 732 } 733 phdrp = (Phdr *)((caddr_t)phdrp + hsize); 734 } 735 736 len = hiaddr - (loaddr & PAGEMASK); 737 len = roundup(len, PAGESIZE); 738 739 return (len); 740 } 741 742 /* 743 * Read in the ELF header and program header table. 744 * SUSV3 requires: 745 * ENOEXEC File format is not recognized 746 * EINVAL Format recognized but execution not supported 747 */ 748 static int 749 getelfhead(vnode_t *vp, cred_t *credp, Ehdr *ehdr, int *nshdrs, int *shstrndx, 750 int *nphdrs) 751 { 752 int error; 753 ssize_t resid; 754 755 /* 756 * We got here by the first two bytes in ident, 757 * now read the entire ELF header. 758 */ 759 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)ehdr, 760 sizeof (Ehdr), (offset_t)0, UIO_SYSSPACE, 0, 761 (rlim64_t)0, credp, &resid)) != 0) 762 return (error); 763 764 /* 765 * Since a separate version is compiled for handling 32-bit and 766 * 64-bit ELF executables on a 64-bit kernel, the 64-bit version 767 * doesn't need to be able to deal with 32-bit ELF files. 768 */ 769 if (resid != 0 || 770 ehdr->e_ident[EI_MAG2] != ELFMAG2 || 771 ehdr->e_ident[EI_MAG3] != ELFMAG3) 772 return (ENOEXEC); 773 774 if ((ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) || 775 #if defined(_ILP32) || defined(_ELF32_COMPAT) 776 ehdr->e_ident[EI_CLASS] != ELFCLASS32 || 777 #else 778 ehdr->e_ident[EI_CLASS] != ELFCLASS64 || 779 #endif 780 !elfheadcheck(ehdr->e_ident[EI_DATA], ehdr->e_machine, 781 ehdr->e_flags)) 782 return (EINVAL); 783 784 *nshdrs = ehdr->e_shnum; 785 *shstrndx = ehdr->e_shstrndx; 786 *nphdrs = ehdr->e_phnum; 787 788 /* 789 * If e_shnum, e_shstrndx, or e_phnum is its sentinel value, we need 790 * to read in the section header at index zero to acces the true 791 * values for those fields. 792 */ 793 if ((*nshdrs == 0 && ehdr->e_shoff != 0) || 794 *shstrndx == SHN_XINDEX || *nphdrs == PN_XNUM) { 795 Shdr shdr; 796 797 if (ehdr->e_shoff == 0) 798 return (EINVAL); 799 800 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)&shdr, 801 sizeof (shdr), (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, 802 (rlim64_t)0, credp, &resid)) != 0) 803 return (error); 804 805 if (*nshdrs == 0) 806 *nshdrs = shdr.sh_size; 807 if (*shstrndx == SHN_XINDEX) 808 *shstrndx = shdr.sh_link; 809 if (*nphdrs == PN_XNUM && shdr.sh_info != 0) 810 *nphdrs = shdr.sh_info; 811 } 812 813 return (0); 814 } 815 816 #ifdef _ELF32_COMPAT 817 extern size_t elf_nphdr_max; 818 #else 819 size_t elf_nphdr_max = 1000; 820 #endif 821 822 static int 823 getelfphdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, int nphdrs, 824 caddr_t *phbasep, ssize_t *phsizep) 825 { 826 ssize_t resid, minsize; 827 int err; 828 829 /* 830 * Since we're going to be using e_phentsize to iterate down the 831 * array of program headers, it must be 8-byte aligned or else 832 * a we might cause a misaligned access. We use all members through 833 * p_flags on 32-bit ELF files and p_memsz on 64-bit ELF files so 834 * e_phentsize must be at least large enough to include those 835 * members. 836 */ 837 #if !defined(_LP64) || defined(_ELF32_COMPAT) 838 minsize = offsetof(Phdr, p_flags) + sizeof (((Phdr *)NULL)->p_flags); 839 #else 840 minsize = offsetof(Phdr, p_memsz) + sizeof (((Phdr *)NULL)->p_memsz); 841 #endif 842 if (ehdr->e_phentsize < minsize || (ehdr->e_phentsize & 3)) 843 return (EINVAL); 844 845 *phsizep = nphdrs * ehdr->e_phentsize; 846 847 if (*phsizep > sizeof (Phdr) * elf_nphdr_max) { 848 if ((*phbasep = kmem_alloc(*phsizep, KM_NOSLEEP)) == NULL) 849 return (ENOMEM); 850 } else { 851 *phbasep = kmem_alloc(*phsizep, KM_SLEEP); 852 } 853 854 if ((err = vn_rdwr(UIO_READ, vp, *phbasep, *phsizep, 855 (offset_t)ehdr->e_phoff, UIO_SYSSPACE, 0, (rlim64_t)0, 856 credp, &resid)) != 0) { 857 kmem_free(*phbasep, *phsizep); 858 *phbasep = NULL; 859 return (err); 860 } 861 862 return (0); 863 } 864 865 #ifdef _ELF32_COMPAT 866 extern size_t elf_nshdr_max; 867 extern size_t elf_shstrtab_max; 868 #else 869 size_t elf_nshdr_max = 10000; 870 size_t elf_shstrtab_max = 100 * 1024; 871 #endif 872 873 874 static int 875 getelfshdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, 876 int nshdrs, int shstrndx, caddr_t *shbasep, ssize_t *shsizep, 877 char **shstrbasep, ssize_t *shstrsizep) 878 { 879 ssize_t resid, minsize; 880 int err; 881 Shdr *shdr; 882 883 /* 884 * Since we're going to be using e_shentsize to iterate down the 885 * array of section headers, it must be 8-byte aligned or else 886 * a we might cause a misaligned access. We use all members through 887 * sh_entsize (on both 32- and 64-bit ELF files) so e_shentsize 888 * must be at least large enough to include that member. The index 889 * of the string table section must also be valid. 890 */ 891 minsize = offsetof(Shdr, sh_entsize) + sizeof (shdr->sh_entsize); 892 if (ehdr->e_shentsize < minsize || (ehdr->e_shentsize & 3) || 893 shstrndx >= nshdrs) 894 return (EINVAL); 895 896 *shsizep = nshdrs * ehdr->e_shentsize; 897 898 if (*shsizep > sizeof (Shdr) * elf_nshdr_max) { 899 if ((*shbasep = kmem_alloc(*shsizep, KM_NOSLEEP)) == NULL) 900 return (ENOMEM); 901 } else { 902 *shbasep = kmem_alloc(*shsizep, KM_SLEEP); 903 } 904 905 if ((err = vn_rdwr(UIO_READ, vp, *shbasep, *shsizep, 906 (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, (rlim64_t)0, 907 credp, &resid)) != 0) { 908 kmem_free(*shbasep, *shsizep); 909 return (err); 910 } 911 912 /* 913 * Pull the section string table out of the vnode; fail if the size 914 * is zero. 915 */ 916 shdr = (Shdr *)(*shbasep + shstrndx * ehdr->e_shentsize); 917 if ((*shstrsizep = shdr->sh_size) == 0) { 918 kmem_free(*shbasep, *shsizep); 919 return (EINVAL); 920 } 921 922 if (*shstrsizep > elf_shstrtab_max) { 923 if ((*shstrbasep = kmem_alloc(*shstrsizep, 924 KM_NOSLEEP)) == NULL) { 925 kmem_free(*shbasep, *shsizep); 926 return (ENOMEM); 927 } 928 } else { 929 *shstrbasep = kmem_alloc(*shstrsizep, KM_SLEEP); 930 } 931 932 if ((err = vn_rdwr(UIO_READ, vp, *shstrbasep, *shstrsizep, 933 (offset_t)shdr->sh_offset, UIO_SYSSPACE, 0, (rlim64_t)0, 934 credp, &resid)) != 0) { 935 kmem_free(*shbasep, *shsizep); 936 kmem_free(*shstrbasep, *shstrsizep); 937 return (err); 938 } 939 940 /* 941 * Make sure the strtab is null-terminated to make sure we 942 * don't run off the end of the table. 943 */ 944 (*shstrbasep)[*shstrsizep - 1] = '\0'; 945 946 return (0); 947 } 948 949 static int 950 mapelfexec( 951 vnode_t *vp, 952 Ehdr *ehdr, 953 int nphdrs, 954 caddr_t phdrbase, 955 Phdr **uphdr, 956 Phdr **dyphdr, 957 Phdr **stphdr, 958 Phdr **dtphdr, 959 Phdr *dataphdrp, 960 caddr_t *bssbase, 961 caddr_t *brkbase, 962 intptr_t *voffset, 963 size_t len, 964 long *execsz, 965 size_t *brksize) 966 { 967 Phdr *phdr; 968 int i, prot, error; 969 caddr_t addr; 970 size_t zfodsz; 971 int ptload = 0; 972 int page; 973 off_t offset; 974 int hsize = ehdr->e_phentsize; 975 976 if (ehdr->e_type == ET_DYN) { 977 /* 978 * Obtain the virtual address of a hole in the 979 * address space to map the "interpreter". 980 */ 981 map_addr(&addr, len, (offset_t)0, 1, 0); 982 if (addr == NULL) 983 return (ENOMEM); 984 *voffset = (intptr_t)addr; 985 } else { 986 *voffset = 0; 987 } 988 phdr = (Phdr *)phdrbase; 989 for (i = nphdrs; i > 0; i--) { 990 switch (phdr->p_type) { 991 case PT_LOAD: 992 if ((*dyphdr != NULL) && (*uphdr == NULL)) 993 return (0); 994 995 ptload = 1; 996 prot = PROT_USER; 997 if (phdr->p_flags & PF_R) 998 prot |= PROT_READ; 999 if (phdr->p_flags & PF_W) 1000 prot |= PROT_WRITE; 1001 if (phdr->p_flags & PF_X) 1002 prot |= PROT_EXEC; 1003 1004 addr = (caddr_t)((uintptr_t)phdr->p_vaddr + *voffset); 1005 zfodsz = (size_t)phdr->p_memsz - phdr->p_filesz; 1006 1007 offset = phdr->p_offset; 1008 if (((uintptr_t)offset & PAGEOFFSET) == 1009 ((uintptr_t)addr & PAGEOFFSET) && 1010 (!(vp->v_flag & VNOMAP))) { 1011 page = 1; 1012 } else { 1013 page = 0; 1014 } 1015 1016 if (curproc->p_brkpageszc != 0 && phdr == dataphdrp && 1017 (prot & PROT_WRITE)) { 1018 /* 1019 * segvn only uses large pages for segments 1020 * that have the requested large page size 1021 * aligned base and size. To insure the part 1022 * of bss that starts at heap large page size 1023 * boundary gets mapped by large pages create 1024 * 2 bss segvn segments which is accomplished 1025 * by calling execmap twice. First execmap 1026 * will create the bss segvn segment that is 1027 * before the large page boundary and it will 1028 * be mapped with base pages. If bss start is 1029 * already large page aligned only 1 bss 1030 * segment will be created. The second bss 1031 * segment's size is large page size aligned 1032 * so that segvn uses large pages for that 1033 * segment and it also makes the heap that 1034 * starts right after bss to start at large 1035 * page boundary. 1036 */ 1037 uint_t szc = curproc->p_brkpageszc; 1038 size_t pgsz = page_get_pagesize(szc); 1039 caddr_t zaddr = addr + phdr->p_filesz; 1040 size_t zlen = P2NPHASE((uintptr_t)zaddr, pgsz); 1041 1042 ASSERT(pgsz > PAGESIZE); 1043 1044 if (error = execmap(vp, addr, phdr->p_filesz, 1045 zlen, phdr->p_offset, prot, page, szc)) 1046 goto bad; 1047 if (zfodsz > zlen) { 1048 zfodsz -= zlen; 1049 zaddr += zlen; 1050 zlen = P2ROUNDUP(zfodsz, pgsz); 1051 if (error = execmap(vp, zaddr, 0, zlen, 1052 phdr->p_offset, prot, page, szc)) 1053 goto bad; 1054 } 1055 if (brksize != NULL) 1056 *brksize = zlen - zfodsz; 1057 } else { 1058 if (error = execmap(vp, addr, phdr->p_filesz, 1059 zfodsz, phdr->p_offset, prot, page, 0)) 1060 goto bad; 1061 } 1062 1063 if (bssbase != NULL && addr >= *bssbase && 1064 phdr == dataphdrp) { 1065 *bssbase = addr + phdr->p_filesz; 1066 } 1067 if (brkbase != NULL && addr >= *brkbase) { 1068 *brkbase = addr + phdr->p_memsz; 1069 } 1070 1071 *execsz += btopr(phdr->p_memsz); 1072 break; 1073 1074 case PT_INTERP: 1075 if (ptload) 1076 goto bad; 1077 *dyphdr = phdr; 1078 break; 1079 1080 case PT_SHLIB: 1081 *stphdr = phdr; 1082 break; 1083 1084 case PT_PHDR: 1085 if (ptload) 1086 goto bad; 1087 *uphdr = phdr; 1088 break; 1089 1090 case PT_NULL: 1091 case PT_DYNAMIC: 1092 case PT_NOTE: 1093 break; 1094 1095 case PT_SUNWDTRACE: 1096 if (dtphdr != NULL) 1097 *dtphdr = phdr; 1098 break; 1099 1100 default: 1101 break; 1102 } 1103 phdr = (Phdr *)((caddr_t)phdr + hsize); 1104 } 1105 return (0); 1106 bad: 1107 if (error == 0) 1108 error = EINVAL; 1109 return (error); 1110 } 1111 1112 int 1113 elfnote(vnode_t *vp, offset_t *offsetp, int type, int descsz, void *desc, 1114 rlim64_t rlimit, cred_t *credp) 1115 { 1116 Note note; 1117 int error; 1118 1119 bzero(¬e, sizeof (note)); 1120 bcopy("CORE", note.name, 4); 1121 note.nhdr.n_type = type; 1122 /* 1123 * The System V ABI states that n_namesz must be the length of the 1124 * string that follows the Nhdr structure including the terminating 1125 * null. The ABI also specifies that sufficient padding should be 1126 * included so that the description that follows the name string 1127 * begins on a 4- or 8-byte boundary for 32- and 64-bit binaries 1128 * respectively. However, since this change was not made correctly 1129 * at the time of the 64-bit port, both 32- and 64-bit binaries 1130 * descriptions are only guaranteed to begin on a 4-byte boundary. 1131 */ 1132 note.nhdr.n_namesz = 5; 1133 note.nhdr.n_descsz = roundup(descsz, sizeof (Word)); 1134 1135 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, ¬e, 1136 sizeof (note), rlimit, credp)) 1137 return (error); 1138 1139 *offsetp += sizeof (note); 1140 1141 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, desc, 1142 note.nhdr.n_descsz, rlimit, credp)) 1143 return (error); 1144 1145 *offsetp += note.nhdr.n_descsz; 1146 return (0); 1147 } 1148 1149 /* 1150 * Copy the section data from one vnode to the section of another vnode. 1151 */ 1152 static void 1153 copy_scn(Shdr *src, vnode_t *src_vp, Shdr *dst, vnode_t *dst_vp, Off *doffset, 1154 void *buf, size_t size, cred_t *credp, rlim64_t rlimit) 1155 { 1156 ssize_t resid; 1157 size_t len, n = src->sh_size; 1158 offset_t off = 0; 1159 1160 while (n != 0) { 1161 len = MIN(size, n); 1162 if (vn_rdwr(UIO_READ, src_vp, buf, len, src->sh_offset + off, 1163 UIO_SYSSPACE, 0, (rlim64_t)0, credp, &resid) != 0 || 1164 resid >= len || 1165 core_write(dst_vp, UIO_SYSSPACE, *doffset + off, 1166 buf, len - resid, rlimit, credp) != 0) { 1167 dst->sh_size = 0; 1168 dst->sh_offset = 0; 1169 return; 1170 } 1171 1172 ASSERT(n >= len - resid); 1173 1174 n -= len - resid; 1175 off += len - resid; 1176 } 1177 1178 *doffset += src->sh_size; 1179 } 1180 1181 #ifdef _ELF32_COMPAT 1182 extern size_t elf_datasz_max; 1183 #else 1184 size_t elf_datasz_max = 1 * 1024 * 1024; 1185 #endif 1186 1187 /* 1188 * This function processes mappings that correspond to load objects to 1189 * examine their respective sections for elfcore(). It's called once with 1190 * v set to NULL to count the number of sections that we're going to need 1191 * and then again with v set to some allocated buffer that we fill in with 1192 * all the section data. 1193 */ 1194 static int 1195 process_scns(core_content_t content, proc_t *p, cred_t *credp, vnode_t *vp, 1196 Shdr *v, int nshdrs, rlim64_t rlimit, Off *doffsetp, int *nshdrsp) 1197 { 1198 vnode_t *lastvp = NULL; 1199 struct seg *seg; 1200 int i, j; 1201 void *data = NULL; 1202 size_t datasz = 0; 1203 shstrtab_t shstrtab; 1204 struct as *as = p->p_as; 1205 int error = 0; 1206 1207 if (v != NULL) 1208 shstrtab_init(&shstrtab); 1209 1210 i = 1; 1211 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) { 1212 uint_t prot; 1213 vnode_t *mvp; 1214 void *tmp = NULL; 1215 caddr_t saddr = seg->s_base; 1216 caddr_t naddr; 1217 caddr_t eaddr; 1218 size_t segsize; 1219 1220 Ehdr ehdr; 1221 int nshdrs, shstrndx, nphdrs; 1222 caddr_t shbase; 1223 ssize_t shsize; 1224 char *shstrbase; 1225 ssize_t shstrsize; 1226 1227 Shdr *shdr; 1228 const char *name; 1229 size_t sz; 1230 uintptr_t off; 1231 1232 int ctf_ndx = 0; 1233 int symtab_ndx = 0; 1234 1235 /* 1236 * Since we're just looking for text segments of load 1237 * objects, we only care about the protection bits; we don't 1238 * care about the actual size of the segment so we use the 1239 * reserved size. If the segment's size is zero, there's 1240 * something fishy going on so we ignore this segment. 1241 */ 1242 if (seg->s_ops != &segvn_ops || 1243 SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 || 1244 mvp == lastvp || mvp == NULL || mvp->v_type != VREG || 1245 (segsize = pr_getsegsize(seg, 1)) == 0) 1246 continue; 1247 1248 eaddr = saddr + segsize; 1249 prot = pr_getprot(seg, 1, &tmp, &saddr, &naddr, eaddr); 1250 pr_getprot_done(&tmp); 1251 1252 /* 1253 * Skip this segment unless the protection bits look like 1254 * what we'd expect for a text segment. 1255 */ 1256 if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC) 1257 continue; 1258 1259 if (getelfhead(mvp, credp, &ehdr, &nshdrs, &shstrndx, 1260 &nphdrs) != 0 || 1261 getelfshdr(mvp, credp, &ehdr, nshdrs, shstrndx, 1262 &shbase, &shsize, &shstrbase, &shstrsize) != 0) 1263 continue; 1264 1265 off = ehdr.e_shentsize; 1266 for (j = 1; j < nshdrs; j++, off += ehdr.e_shentsize) { 1267 Shdr *symtab = NULL, *strtab; 1268 1269 shdr = (Shdr *)(shbase + off); 1270 1271 if (shdr->sh_name >= shstrsize) 1272 continue; 1273 1274 name = shstrbase + shdr->sh_name; 1275 1276 if (strcmp(name, shstrtab_data[STR_CTF]) == 0) { 1277 if ((content & CC_CONTENT_CTF) == 0 || 1278 ctf_ndx != 0) 1279 continue; 1280 1281 if (shdr->sh_link > 0 && 1282 shdr->sh_link < nshdrs) { 1283 symtab = (Shdr *)(shbase + 1284 shdr->sh_link * ehdr.e_shentsize); 1285 } 1286 1287 if (v != NULL && i < nshdrs - 1) { 1288 if (shdr->sh_size > datasz && 1289 shdr->sh_size <= elf_datasz_max) { 1290 if (data != NULL) 1291 kmem_free(data, datasz); 1292 1293 datasz = shdr->sh_size; 1294 data = kmem_alloc(datasz, 1295 KM_SLEEP); 1296 } 1297 1298 v[i].sh_name = shstrtab_ndx(&shstrtab, 1299 STR_CTF); 1300 v[i].sh_addr = (Addr)(uintptr_t)saddr; 1301 v[i].sh_type = SHT_PROGBITS; 1302 v[i].sh_addralign = 4; 1303 *doffsetp = roundup(*doffsetp, 1304 v[i].sh_addralign); 1305 v[i].sh_offset = *doffsetp; 1306 v[i].sh_size = shdr->sh_size; 1307 if (symtab == NULL) { 1308 v[i].sh_link = 0; 1309 } else if (symtab->sh_type == 1310 SHT_SYMTAB && 1311 symtab_ndx != 0) { 1312 v[i].sh_link = 1313 symtab_ndx; 1314 } else { 1315 v[i].sh_link = i + 1; 1316 } 1317 1318 copy_scn(shdr, mvp, &v[i], vp, 1319 doffsetp, data, datasz, credp, 1320 rlimit); 1321 } 1322 1323 ctf_ndx = i++; 1324 1325 /* 1326 * We've already dumped the symtab. 1327 */ 1328 if (symtab != NULL && 1329 symtab->sh_type == SHT_SYMTAB && 1330 symtab_ndx != 0) 1331 continue; 1332 1333 } else if (strcmp(name, 1334 shstrtab_data[STR_SYMTAB]) == 0) { 1335 if ((content & CC_CONTENT_SYMTAB) == 0 || 1336 symtab != 0) 1337 continue; 1338 1339 symtab = shdr; 1340 } 1341 1342 if (symtab != NULL) { 1343 if ((symtab->sh_type != SHT_DYNSYM && 1344 symtab->sh_type != SHT_SYMTAB) || 1345 symtab->sh_link == 0 || 1346 symtab->sh_link >= nshdrs) 1347 continue; 1348 1349 strtab = (Shdr *)(shbase + 1350 symtab->sh_link * ehdr.e_shentsize); 1351 1352 if (strtab->sh_type != SHT_STRTAB) 1353 continue; 1354 1355 if (v != NULL && i < nshdrs - 2) { 1356 sz = MAX(symtab->sh_size, 1357 strtab->sh_size); 1358 if (sz > datasz && 1359 sz <= elf_datasz_max) { 1360 if (data != NULL) 1361 kmem_free(data, datasz); 1362 1363 datasz = sz; 1364 data = kmem_alloc(datasz, 1365 KM_SLEEP); 1366 } 1367 1368 if (symtab->sh_type == SHT_DYNSYM) { 1369 v[i].sh_name = shstrtab_ndx( 1370 &shstrtab, STR_DYNSYM); 1371 v[i + 1].sh_name = shstrtab_ndx( 1372 &shstrtab, STR_DYNSTR); 1373 } else { 1374 v[i].sh_name = shstrtab_ndx( 1375 &shstrtab, STR_SYMTAB); 1376 v[i + 1].sh_name = shstrtab_ndx( 1377 &shstrtab, STR_STRTAB); 1378 } 1379 1380 v[i].sh_type = symtab->sh_type; 1381 v[i].sh_addr = symtab->sh_addr; 1382 if (ehdr.e_type == ET_DYN || 1383 v[i].sh_addr == 0) 1384 v[i].sh_addr += 1385 (Addr)(uintptr_t)saddr; 1386 v[i].sh_addralign = 1387 symtab->sh_addralign; 1388 *doffsetp = roundup(*doffsetp, 1389 v[i].sh_addralign); 1390 v[i].sh_offset = *doffsetp; 1391 v[i].sh_size = symtab->sh_size; 1392 v[i].sh_link = i + 1; 1393 v[i].sh_entsize = symtab->sh_entsize; 1394 v[i].sh_info = symtab->sh_info; 1395 1396 copy_scn(symtab, mvp, &v[i], vp, 1397 doffsetp, data, datasz, credp, 1398 rlimit); 1399 1400 v[i + 1].sh_type = SHT_STRTAB; 1401 v[i + 1].sh_flags = SHF_STRINGS; 1402 v[i + 1].sh_addr = symtab->sh_addr; 1403 if (ehdr.e_type == ET_DYN || 1404 v[i + 1].sh_addr == 0) 1405 v[i + 1].sh_addr += 1406 (Addr)(uintptr_t)saddr; 1407 v[i + 1].sh_addralign = 1408 strtab->sh_addralign; 1409 *doffsetp = roundup(*doffsetp, 1410 v[i + 1].sh_addralign); 1411 v[i + 1].sh_offset = *doffsetp; 1412 v[i + 1].sh_size = strtab->sh_size; 1413 1414 copy_scn(strtab, mvp, &v[i + 1], vp, 1415 doffsetp, data, datasz, credp, 1416 rlimit); 1417 } 1418 1419 if (symtab->sh_type == SHT_SYMTAB) 1420 symtab_ndx = i; 1421 i += 2; 1422 } 1423 } 1424 1425 kmem_free(shstrbase, shstrsize); 1426 kmem_free(shbase, shsize); 1427 1428 lastvp = mvp; 1429 } 1430 1431 if (v == NULL) { 1432 if (i == 1) 1433 *nshdrsp = 0; 1434 else 1435 *nshdrsp = i + 1; 1436 goto done; 1437 } 1438 1439 if (i != nshdrs - 1) { 1440 cmn_err(CE_WARN, "elfcore: core dump failed for " 1441 "process %d; address space is changing", p->p_pid); 1442 error = EIO; 1443 goto done; 1444 } 1445 1446 v[i].sh_name = shstrtab_ndx(&shstrtab, STR_SHSTRTAB); 1447 v[i].sh_size = shstrtab_size(&shstrtab); 1448 v[i].sh_addralign = 1; 1449 *doffsetp = roundup(*doffsetp, v[i].sh_addralign); 1450 v[i].sh_offset = *doffsetp; 1451 v[i].sh_flags = SHF_STRINGS; 1452 v[i].sh_type = SHT_STRTAB; 1453 1454 if (v[i].sh_size > datasz) { 1455 if (data != NULL) 1456 kmem_free(data, datasz); 1457 1458 datasz = v[i].sh_size; 1459 data = kmem_alloc(datasz, 1460 KM_SLEEP); 1461 } 1462 1463 shstrtab_dump(&shstrtab, data); 1464 1465 if ((error = core_write(vp, UIO_SYSSPACE, *doffsetp, 1466 data, v[i].sh_size, rlimit, credp)) != 0) 1467 goto done; 1468 1469 *doffsetp += v[i].sh_size; 1470 1471 done: 1472 if (data != NULL) 1473 kmem_free(data, datasz); 1474 1475 return (error); 1476 } 1477 1478 int 1479 elfcore(vnode_t *vp, proc_t *p, cred_t *credp, rlim64_t rlimit, int sig, 1480 core_content_t content) 1481 { 1482 offset_t poffset, soffset; 1483 Off doffset; 1484 int error, i, nphdrs, nshdrs; 1485 int overflow = 0; 1486 struct seg *seg; 1487 struct as *as = p->p_as; 1488 union { 1489 Ehdr ehdr; 1490 Phdr phdr[1]; 1491 Shdr shdr[1]; 1492 } *bigwad; 1493 size_t bigsize; 1494 size_t phdrsz, shdrsz; 1495 Ehdr *ehdr; 1496 Phdr *v; 1497 caddr_t brkbase; 1498 size_t brksize; 1499 caddr_t stkbase; 1500 size_t stksize; 1501 int ntries = 0; 1502 1503 top: 1504 /* 1505 * Make sure we have everything we need (registers, etc.). 1506 * All other lwps have already stopped and are in an orderly state. 1507 */ 1508 ASSERT(p == ttoproc(curthread)); 1509 prstop(0, 0); 1510 1511 AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER); 1512 nphdrs = prnsegs(as, 0) + 2; /* two CORE note sections */ 1513 1514 /* 1515 * Count the number of section headers we're going to need. 1516 */ 1517 nshdrs = 0; 1518 if (content & (CC_CONTENT_CTF | CC_CONTENT_SYMTAB)) { 1519 (void) process_scns(content, p, credp, NULL, NULL, NULL, 0, 1520 NULL, &nshdrs); 1521 } 1522 AS_LOCK_EXIT(as, &as->a_lock); 1523 1524 ASSERT(nshdrs == 0 || nshdrs > 1); 1525 1526 /* 1527 * The core file contents may required zero section headers, but if 1528 * we overflow the 16 bits allotted to the program header count in 1529 * the ELF header, we'll need that program header at index zero. 1530 */ 1531 if (nshdrs == 0 && nphdrs >= PN_XNUM) 1532 nshdrs = 1; 1533 1534 phdrsz = nphdrs * sizeof (Phdr); 1535 shdrsz = nshdrs * sizeof (Shdr); 1536 1537 bigsize = MAX(sizeof (*bigwad), MAX(phdrsz, shdrsz)); 1538 bigwad = kmem_alloc(bigsize, KM_SLEEP); 1539 1540 ehdr = &bigwad->ehdr; 1541 bzero(ehdr, sizeof (*ehdr)); 1542 1543 ehdr->e_ident[EI_MAG0] = ELFMAG0; 1544 ehdr->e_ident[EI_MAG1] = ELFMAG1; 1545 ehdr->e_ident[EI_MAG2] = ELFMAG2; 1546 ehdr->e_ident[EI_MAG3] = ELFMAG3; 1547 ehdr->e_ident[EI_CLASS] = ELFCLASS; 1548 ehdr->e_type = ET_CORE; 1549 1550 #if !defined(_LP64) || defined(_ELF32_COMPAT) 1551 1552 #if defined(__sparc) 1553 ehdr->e_ident[EI_DATA] = ELFDATA2MSB; 1554 ehdr->e_machine = EM_SPARC; 1555 #elif defined(__i386) || defined(__i386_COMPAT) 1556 ehdr->e_ident[EI_DATA] = ELFDATA2LSB; 1557 ehdr->e_machine = EM_386; 1558 #else 1559 #error "no recognized machine type is defined" 1560 #endif 1561 1562 #else /* !defined(_LP64) || defined(_ELF32_COMPAT) */ 1563 1564 #if defined(__sparc) 1565 ehdr->e_ident[EI_DATA] = ELFDATA2MSB; 1566 ehdr->e_machine = EM_SPARCV9; 1567 #elif defined(__amd64) 1568 ehdr->e_ident[EI_DATA] = ELFDATA2LSB; 1569 ehdr->e_machine = EM_AMD64; 1570 #else 1571 #error "no recognized 64-bit machine type is defined" 1572 #endif 1573 1574 #endif /* !defined(_LP64) || defined(_ELF32_COMPAT) */ 1575 1576 /* 1577 * If the count of program headers or section headers or the index 1578 * of the section string table can't fit in the mere 16 bits 1579 * shortsightedly allotted to them in the ELF header, we use the 1580 * extended formats and put the real values in the section header 1581 * as index 0. 1582 */ 1583 ehdr->e_version = EV_CURRENT; 1584 ehdr->e_ehsize = sizeof (Ehdr); 1585 1586 if (nphdrs >= PN_XNUM) 1587 ehdr->e_phnum = PN_XNUM; 1588 else 1589 ehdr->e_phnum = (unsigned short)nphdrs; 1590 1591 ehdr->e_phoff = sizeof (Ehdr); 1592 ehdr->e_phentsize = sizeof (Phdr); 1593 1594 if (nshdrs > 0) { 1595 if (nshdrs >= SHN_LORESERVE) 1596 ehdr->e_shnum = 0; 1597 else 1598 ehdr->e_shnum = (unsigned short)nshdrs; 1599 1600 if (nshdrs - 1 >= SHN_LORESERVE) 1601 ehdr->e_shstrndx = SHN_XINDEX; 1602 else 1603 ehdr->e_shstrndx = (unsigned short)(nshdrs - 1); 1604 1605 ehdr->e_shoff = ehdr->e_phoff + ehdr->e_phentsize * nphdrs; 1606 ehdr->e_shentsize = sizeof (Shdr); 1607 } 1608 1609 if (error = core_write(vp, UIO_SYSSPACE, (offset_t)0, ehdr, 1610 sizeof (Ehdr), rlimit, credp)) 1611 goto done; 1612 1613 poffset = sizeof (Ehdr); 1614 soffset = sizeof (Ehdr) + phdrsz; 1615 doffset = sizeof (Ehdr) + phdrsz + shdrsz; 1616 1617 v = &bigwad->phdr[0]; 1618 bzero(v, phdrsz); 1619 1620 setup_old_note_header(&v[0], p); 1621 v[0].p_offset = doffset = roundup(doffset, sizeof (Word)); 1622 doffset += v[0].p_filesz; 1623 1624 setup_note_header(&v[1], p); 1625 v[1].p_offset = doffset = roundup(doffset, sizeof (Word)); 1626 doffset += v[1].p_filesz; 1627 1628 mutex_enter(&p->p_lock); 1629 1630 brkbase = p->p_brkbase; 1631 brksize = p->p_brksize; 1632 1633 stkbase = p->p_usrstack - p->p_stksize; 1634 stksize = p->p_stksize; 1635 1636 mutex_exit(&p->p_lock); 1637 1638 AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER); 1639 i = 2; 1640 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) { 1641 caddr_t eaddr = seg->s_base + pr_getsegsize(seg, 0); 1642 caddr_t saddr, naddr; 1643 void *tmp = NULL; 1644 extern struct seg_ops segspt_shmops; 1645 1646 for (saddr = seg->s_base; saddr < eaddr; saddr = naddr) { 1647 uint_t prot; 1648 size_t size; 1649 int type; 1650 vnode_t *mvp; 1651 1652 prot = pr_getprot(seg, 0, &tmp, &saddr, &naddr, eaddr); 1653 prot &= PROT_READ | PROT_WRITE | PROT_EXEC; 1654 if ((size = (size_t)(naddr - saddr)) == 0) 1655 continue; 1656 if (i == nphdrs) { 1657 overflow++; 1658 continue; 1659 } 1660 v[i].p_type = PT_LOAD; 1661 v[i].p_vaddr = (Addr)(uintptr_t)saddr; 1662 v[i].p_memsz = size; 1663 if (prot & PROT_READ) 1664 v[i].p_flags |= PF_R; 1665 if (prot & PROT_WRITE) 1666 v[i].p_flags |= PF_W; 1667 if (prot & PROT_EXEC) 1668 v[i].p_flags |= PF_X; 1669 1670 /* 1671 * Figure out which mappings to include in the core. 1672 */ 1673 type = SEGOP_GETTYPE(seg, saddr); 1674 1675 if (saddr == stkbase && size == stksize) { 1676 if (!(content & CC_CONTENT_STACK)) 1677 goto exclude; 1678 1679 } else if (saddr == brkbase && size == brksize) { 1680 if (!(content & CC_CONTENT_HEAP)) 1681 goto exclude; 1682 1683 } else if (seg->s_ops == &segspt_shmops) { 1684 if (type & MAP_NORESERVE) { 1685 if (!(content & CC_CONTENT_DISM)) 1686 goto exclude; 1687 } else { 1688 if (!(content & CC_CONTENT_ISM)) 1689 goto exclude; 1690 } 1691 1692 } else if (seg->s_ops != &segvn_ops) { 1693 goto exclude; 1694 1695 } else if (type & MAP_SHARED) { 1696 if (shmgetid(p, saddr) != SHMID_NONE) { 1697 if (!(content & CC_CONTENT_SHM)) 1698 goto exclude; 1699 1700 } else if (SEGOP_GETVP(seg, seg->s_base, 1701 &mvp) != 0 || mvp == NULL || 1702 mvp->v_type != VREG) { 1703 if (!(content & CC_CONTENT_SHANON)) 1704 goto exclude; 1705 1706 } else { 1707 if (!(content & CC_CONTENT_SHFILE)) 1708 goto exclude; 1709 } 1710 1711 } else if (SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 || 1712 mvp == NULL || mvp->v_type != VREG) { 1713 if (!(content & CC_CONTENT_ANON)) 1714 goto exclude; 1715 1716 } else if (prot == (PROT_READ | PROT_EXEC)) { 1717 if (!(content & CC_CONTENT_TEXT)) 1718 goto exclude; 1719 1720 } else if (prot == PROT_READ) { 1721 if (!(content & CC_CONTENT_RODATA)) 1722 goto exclude; 1723 1724 } else { 1725 if (!(content & CC_CONTENT_DATA)) 1726 goto exclude; 1727 } 1728 1729 doffset = roundup(doffset, sizeof (Word)); 1730 v[i].p_offset = doffset; 1731 v[i].p_filesz = size; 1732 doffset += size; 1733 exclude: 1734 i++; 1735 } 1736 ASSERT(tmp == NULL); 1737 } 1738 AS_LOCK_EXIT(as, &as->a_lock); 1739 1740 if (overflow || i != nphdrs) { 1741 if (ntries++ == 0) { 1742 kmem_free(bigwad, bigsize); 1743 goto top; 1744 } 1745 cmn_err(CE_WARN, "elfcore: core dump failed for " 1746 "process %d; address space is changing", p->p_pid); 1747 error = EIO; 1748 goto done; 1749 } 1750 1751 if ((error = core_write(vp, UIO_SYSSPACE, poffset, 1752 v, phdrsz, rlimit, credp)) != 0) 1753 goto done; 1754 1755 if ((error = write_old_elfnotes(p, sig, vp, v[0].p_offset, rlimit, 1756 credp)) != 0) 1757 goto done; 1758 1759 if ((error = write_elfnotes(p, sig, vp, v[1].p_offset, rlimit, 1760 credp, content)) != 0) 1761 goto done; 1762 1763 for (i = 2; i < nphdrs; i++) { 1764 if (v[i].p_filesz == 0) 1765 continue; 1766 1767 /* 1768 * If dumping out this segment fails, rather than failing 1769 * the core dump entirely, we reset the size of the mapping 1770 * to zero to indicate that the data is absent from the core 1771 * file and or in the PF_SUNW_FAILURE flag to differentiate 1772 * this from mappings that were excluded due to the core file 1773 * content settings. 1774 */ 1775 if ((error = core_seg(p, vp, v[i].p_offset, 1776 (caddr_t)(uintptr_t)v[i].p_vaddr, v[i].p_filesz, 1777 rlimit, credp)) != 0) { 1778 1779 /* 1780 * Since the space reserved for the segment is now 1781 * unused, we stash the errno in the first four 1782 * bytes. This undocumented interface will let us 1783 * understand the nature of the failure. 1784 */ 1785 (void) core_write(vp, UIO_SYSSPACE, v[i].p_offset, 1786 &error, sizeof (error), rlimit, credp); 1787 1788 v[i].p_filesz = 0; 1789 v[i].p_flags |= PF_SUNW_FAILURE; 1790 if ((error = core_write(vp, UIO_SYSSPACE, 1791 poffset + sizeof (v[i]) * i, &v[i], sizeof (v[i]), 1792 rlimit, credp)) != 0) 1793 goto done; 1794 } 1795 } 1796 1797 if (nshdrs > 0) { 1798 bzero(&bigwad->shdr[0], shdrsz); 1799 1800 if (nshdrs >= SHN_LORESERVE) 1801 bigwad->shdr[0].sh_size = nshdrs; 1802 1803 if (nshdrs - 1 >= SHN_LORESERVE) 1804 bigwad->shdr[0].sh_link = nshdrs - 1; 1805 1806 if (nphdrs >= PN_XNUM) 1807 bigwad->shdr[0].sh_info = nphdrs; 1808 1809 if (nshdrs > 1) { 1810 AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER); 1811 if ((error = process_scns(content, p, credp, vp, 1812 &bigwad->shdr[0], nshdrs, rlimit, &doffset, 1813 NULL)) != 0) { 1814 AS_LOCK_EXIT(as, &as->a_lock); 1815 goto done; 1816 } 1817 AS_LOCK_EXIT(as, &as->a_lock); 1818 } 1819 1820 if ((error = core_write(vp, UIO_SYSSPACE, soffset, 1821 &bigwad->shdr[0], shdrsz, rlimit, credp)) != 0) 1822 goto done; 1823 } 1824 1825 done: 1826 kmem_free(bigwad, bigsize); 1827 return (error); 1828 } 1829 1830 #ifndef _ELF32_COMPAT 1831 1832 static struct execsw esw = { 1833 #ifdef _LP64 1834 elf64magicstr, 1835 #else /* _LP64 */ 1836 elf32magicstr, 1837 #endif /* _LP64 */ 1838 0, 1839 5, 1840 elfexec, 1841 elfcore 1842 }; 1843 1844 static struct modlexec modlexec = { 1845 &mod_execops, "exec module for elf", &esw 1846 }; 1847 1848 #ifdef _LP64 1849 extern int elf32exec(vnode_t *vp, execa_t *uap, uarg_t *args, 1850 intpdata_t *idatap, int level, long *execsz, 1851 int setid, caddr_t exec_file, cred_t *cred); 1852 extern int elf32core(vnode_t *vp, proc_t *p, cred_t *credp, 1853 rlim64_t rlimit, int sig, core_content_t content); 1854 1855 static struct execsw esw32 = { 1856 elf32magicstr, 1857 0, 1858 5, 1859 elf32exec, 1860 elf32core 1861 }; 1862 1863 static struct modlexec modlexec32 = { 1864 &mod_execops, "32-bit exec module for elf", &esw32 1865 }; 1866 #endif /* _LP64 */ 1867 1868 static struct modlinkage modlinkage = { 1869 MODREV_1, 1870 (void *)&modlexec, 1871 #ifdef _LP64 1872 (void *)&modlexec32, 1873 #endif /* _LP64 */ 1874 NULL 1875 }; 1876 1877 int 1878 _init(void) 1879 { 1880 return (mod_install(&modlinkage)); 1881 } 1882 1883 int 1884 _fini(void) 1885 { 1886 return (mod_remove(&modlinkage)); 1887 } 1888 1889 int 1890 _info(struct modinfo *modinfop) 1891 { 1892 return (mod_info(&modlinkage, modinfop)); 1893 } 1894 1895 #endif /* !_ELF32_COMPAT */ 1896