xref: /titanic_51/usr/src/uts/common/exec/elf/elf.c (revision 25c28e83beb90e7c80452a7c818c5e6f73a07dc8)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
24  */
25 
26 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
27 /*	  All Rights Reserved  	*/
28 /*
29  * Copyright (c) 2013, Joyent, Inc.  All rights reserved.
30  */
31 
32 #include <sys/types.h>
33 #include <sys/param.h>
34 #include <sys/thread.h>
35 #include <sys/sysmacros.h>
36 #include <sys/signal.h>
37 #include <sys/cred.h>
38 #include <sys/user.h>
39 #include <sys/errno.h>
40 #include <sys/vnode.h>
41 #include <sys/mman.h>
42 #include <sys/kmem.h>
43 #include <sys/proc.h>
44 #include <sys/pathname.h>
45 #include <sys/cmn_err.h>
46 #include <sys/systm.h>
47 #include <sys/elf.h>
48 #include <sys/vmsystm.h>
49 #include <sys/debug.h>
50 #include <sys/auxv.h>
51 #include <sys/exec.h>
52 #include <sys/prsystm.h>
53 #include <vm/as.h>
54 #include <vm/rm.h>
55 #include <vm/seg.h>
56 #include <vm/seg_vn.h>
57 #include <sys/modctl.h>
58 #include <sys/systeminfo.h>
59 #include <sys/vmparam.h>
60 #include <sys/machelf.h>
61 #include <sys/shm_impl.h>
62 #include <sys/archsystm.h>
63 #include <sys/fasttrap.h>
64 #include <sys/brand.h>
65 #include "elf_impl.h"
66 #include <sys/sdt.h>
67 #include <sys/siginfo.h>
68 
69 extern int at_flags;
70 
71 #define	ORIGIN_STR	"ORIGIN"
72 #define	ORIGIN_STR_SIZE	6
73 
74 static int getelfhead(vnode_t *, cred_t *, Ehdr *, int *, int *, int *);
75 static int getelfphdr(vnode_t *, cred_t *, const Ehdr *, int, caddr_t *,
76     ssize_t *);
77 static int getelfshdr(vnode_t *, cred_t *, const Ehdr *, int, int, caddr_t *,
78     ssize_t *, caddr_t *, ssize_t *);
79 static size_t elfsize(Ehdr *, int, caddr_t, uintptr_t *);
80 static int mapelfexec(vnode_t *, Ehdr *, int, caddr_t,
81     Phdr **, Phdr **, Phdr **, Phdr **, Phdr *,
82     caddr_t *, caddr_t *, intptr_t *, intptr_t *, size_t, long *, size_t *);
83 
84 typedef enum {
85 	STR_CTF,
86 	STR_SYMTAB,
87 	STR_DYNSYM,
88 	STR_STRTAB,
89 	STR_DYNSTR,
90 	STR_SHSTRTAB,
91 	STR_NUM
92 } shstrtype_t;
93 
94 static const char *shstrtab_data[] = {
95 	".SUNW_ctf",
96 	".symtab",
97 	".dynsym",
98 	".strtab",
99 	".dynstr",
100 	".shstrtab"
101 };
102 
103 typedef struct shstrtab {
104 	int	sst_ndx[STR_NUM];
105 	int	sst_cur;
106 } shstrtab_t;
107 
108 static void
109 shstrtab_init(shstrtab_t *s)
110 {
111 	bzero(&s->sst_ndx, sizeof (s->sst_ndx));
112 	s->sst_cur = 1;
113 }
114 
115 static int
116 shstrtab_ndx(shstrtab_t *s, shstrtype_t type)
117 {
118 	int ret;
119 
120 	if ((ret = s->sst_ndx[type]) != 0)
121 		return (ret);
122 
123 	ret = s->sst_ndx[type] = s->sst_cur;
124 	s->sst_cur += strlen(shstrtab_data[type]) + 1;
125 
126 	return (ret);
127 }
128 
129 static size_t
130 shstrtab_size(const shstrtab_t *s)
131 {
132 	return (s->sst_cur);
133 }
134 
135 static void
136 shstrtab_dump(const shstrtab_t *s, char *buf)
137 {
138 	int i, ndx;
139 
140 	*buf = '\0';
141 	for (i = 0; i < STR_NUM; i++) {
142 		if ((ndx = s->sst_ndx[i]) != 0)
143 			(void) strcpy(buf + ndx, shstrtab_data[i]);
144 	}
145 }
146 
147 static int
148 dtrace_safe_phdr(Phdr *phdrp, struct uarg *args, uintptr_t base)
149 {
150 	ASSERT(phdrp->p_type == PT_SUNWDTRACE);
151 
152 	/*
153 	 * See the comment in fasttrap.h for information on how to safely
154 	 * update this program header.
155 	 */
156 	if (phdrp->p_memsz < PT_SUNWDTRACE_SIZE ||
157 	    (phdrp->p_flags & (PF_R | PF_W | PF_X)) != (PF_R | PF_W | PF_X))
158 		return (-1);
159 
160 	args->thrptr = phdrp->p_vaddr + base;
161 
162 	return (0);
163 }
164 
165 /*
166  * Map in the executable pointed to by vp. Returns 0 on success.
167  */
168 int
169 mapexec_brand(vnode_t *vp, uarg_t *args, Ehdr *ehdr, Addr *uphdr_vaddr,
170     intptr_t *voffset, caddr_t exec_file, int *interp, caddr_t *bssbase,
171     caddr_t *brkbase, size_t *brksize, uintptr_t *lddatap)
172 {
173 	size_t		len;
174 	struct vattr	vat;
175 	caddr_t		phdrbase = NULL;
176 	ssize_t		phdrsize;
177 	int		nshdrs, shstrndx, nphdrs;
178 	int		error = 0;
179 	Phdr		*uphdr = NULL;
180 	Phdr		*junk = NULL;
181 	Phdr		*dynphdr = NULL;
182 	Phdr		*dtrphdr = NULL;
183 	uintptr_t	lddata;
184 	long		execsz;
185 	intptr_t	minaddr;
186 
187 	if (lddatap != NULL)
188 		*lddatap = NULL;
189 
190 	if (error = execpermissions(vp, &vat, args)) {
191 		uprintf("%s: Cannot execute %s\n", exec_file, args->pathname);
192 		return (error);
193 	}
194 
195 	if ((error = getelfhead(vp, CRED(), ehdr, &nshdrs, &shstrndx,
196 	    &nphdrs)) != 0 ||
197 	    (error = getelfphdr(vp, CRED(), ehdr, nphdrs, &phdrbase,
198 	    &phdrsize)) != 0) {
199 		uprintf("%s: Cannot read %s\n", exec_file, args->pathname);
200 		return (error);
201 	}
202 
203 	if ((len = elfsize(ehdr, nphdrs, phdrbase, &lddata)) == 0) {
204 		uprintf("%s: Nothing to load in %s", exec_file, args->pathname);
205 		kmem_free(phdrbase, phdrsize);
206 		return (ENOEXEC);
207 	}
208 	if (lddatap != NULL)
209 		*lddatap = lddata;
210 
211 	if (error = mapelfexec(vp, ehdr, nphdrs, phdrbase, &uphdr, &dynphdr,
212 	    &junk, &dtrphdr, NULL, bssbase, brkbase, voffset, &minaddr,
213 	    len, &execsz, brksize)) {
214 		uprintf("%s: Cannot map %s\n", exec_file, args->pathname);
215 		kmem_free(phdrbase, phdrsize);
216 		return (error);
217 	}
218 
219 	/*
220 	 * Inform our caller if the executable needs an interpreter.
221 	 */
222 	*interp = (dynphdr == NULL) ? 0 : 1;
223 
224 	/*
225 	 * If this is a statically linked executable, voffset should indicate
226 	 * the address of the executable itself (it normally holds the address
227 	 * of the interpreter).
228 	 */
229 	if (ehdr->e_type == ET_EXEC && *interp == 0)
230 		*voffset = minaddr;
231 
232 	if (uphdr != NULL) {
233 		*uphdr_vaddr = uphdr->p_vaddr;
234 	} else {
235 		*uphdr_vaddr = (Addr)-1;
236 	}
237 
238 	kmem_free(phdrbase, phdrsize);
239 	return (error);
240 }
241 
242 /*ARGSUSED*/
243 int
244 elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
245     int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred,
246     int brand_action)
247 {
248 	caddr_t		phdrbase = NULL;
249 	caddr_t 	bssbase = 0;
250 	caddr_t 	brkbase = 0;
251 	size_t		brksize = 0;
252 	ssize_t		dlnsize;
253 	aux_entry_t	*aux;
254 	int		error;
255 	ssize_t		resid;
256 	int		fd = -1;
257 	intptr_t	voffset;
258 	Phdr		*dyphdr = NULL;
259 	Phdr		*stphdr = NULL;
260 	Phdr		*uphdr = NULL;
261 	Phdr		*junk = NULL;
262 	size_t		len;
263 	ssize_t		phdrsize;
264 	int		postfixsize = 0;
265 	int		i, hsize;
266 	Phdr		*phdrp;
267 	Phdr		*dataphdrp = NULL;
268 	Phdr		*dtrphdr;
269 	Phdr		*capphdr = NULL;
270 	Cap		*cap = NULL;
271 	ssize_t		capsize;
272 	int		hasu = 0;
273 	int		hasauxv = 0;
274 	int		hasdy = 0;
275 	int		branded = 0;
276 
277 	struct proc *p = ttoproc(curthread);
278 	struct user *up = PTOU(p);
279 	struct bigwad {
280 		Ehdr	ehdr;
281 		aux_entry_t	elfargs[__KERN_NAUXV_IMPL];
282 		char		dl_name[MAXPATHLEN];
283 		char		pathbuf[MAXPATHLEN];
284 		struct vattr	vattr;
285 		struct execenv	exenv;
286 	} *bigwad;	/* kmem_alloc this behemoth so we don't blow stack */
287 	Ehdr		*ehdrp;
288 	int		nshdrs, shstrndx, nphdrs;
289 	char		*dlnp;
290 	char		*pathbufp;
291 	rlim64_t	limit;
292 	rlim64_t	roundlimit;
293 
294 	ASSERT(p->p_model == DATAMODEL_ILP32 || p->p_model == DATAMODEL_LP64);
295 
296 	bigwad = kmem_alloc(sizeof (struct bigwad), KM_SLEEP);
297 	ehdrp = &bigwad->ehdr;
298 	dlnp = bigwad->dl_name;
299 	pathbufp = bigwad->pathbuf;
300 
301 	/*
302 	 * Obtain ELF and program header information.
303 	 */
304 	if ((error = getelfhead(vp, CRED(), ehdrp, &nshdrs, &shstrndx,
305 	    &nphdrs)) != 0 ||
306 	    (error = getelfphdr(vp, CRED(), ehdrp, nphdrs, &phdrbase,
307 	    &phdrsize)) != 0)
308 		goto out;
309 
310 	/*
311 	 * Prevent executing an ELF file that has no entry point.
312 	 */
313 	if (ehdrp->e_entry == 0) {
314 		uprintf("%s: Bad entry point\n", exec_file);
315 		goto bad;
316 	}
317 
318 	/*
319 	 * Put data model that we're exec-ing to into the args passed to
320 	 * exec_args(), so it will know what it is copying to on new stack.
321 	 * Now that we know whether we are exec-ing a 32-bit or 64-bit
322 	 * executable, we can set execsz with the appropriate NCARGS.
323 	 */
324 #ifdef	_LP64
325 	if (ehdrp->e_ident[EI_CLASS] == ELFCLASS32) {
326 		args->to_model = DATAMODEL_ILP32;
327 		*execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS32-1);
328 	} else {
329 		args->to_model = DATAMODEL_LP64;
330 		args->stk_prot &= ~PROT_EXEC;
331 #if defined(__i386) || defined(__amd64)
332 		args->dat_prot &= ~PROT_EXEC;
333 #endif
334 		*execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS64-1);
335 	}
336 #else	/* _LP64 */
337 	args->to_model = DATAMODEL_ILP32;
338 	*execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS-1);
339 #endif	/* _LP64 */
340 
341 	/*
342 	 * We delay invoking the brand callback until we've figured out
343 	 * what kind of elf binary we're trying to run, 32-bit or 64-bit.
344 	 * We do this because now the brand library can just check
345 	 * args->to_model to see if the target is 32-bit or 64-bit without
346 	 * having do duplicate all the code above.
347 	 */
348 	if ((level < 2) &&
349 	    (brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
350 		error = BROP(p)->b_elfexec(vp, uap, args,
351 		    idatap, level + 1, execsz, setid, exec_file, cred,
352 		    brand_action);
353 		goto out;
354 	}
355 
356 	/*
357 	 * Determine aux size now so that stack can be built
358 	 * in one shot (except actual copyout of aux image),
359 	 * determine any non-default stack protections,
360 	 * and still have this code be machine independent.
361 	 */
362 	hsize = ehdrp->e_phentsize;
363 	phdrp = (Phdr *)phdrbase;
364 	for (i = nphdrs; i > 0; i--) {
365 		switch (phdrp->p_type) {
366 		case PT_INTERP:
367 			hasauxv = hasdy = 1;
368 			break;
369 		case PT_PHDR:
370 			hasu = 1;
371 			break;
372 		case PT_SUNWSTACK:
373 			args->stk_prot = PROT_USER;
374 			if (phdrp->p_flags & PF_R)
375 				args->stk_prot |= PROT_READ;
376 			if (phdrp->p_flags & PF_W)
377 				args->stk_prot |= PROT_WRITE;
378 			if (phdrp->p_flags & PF_X)
379 				args->stk_prot |= PROT_EXEC;
380 			break;
381 		case PT_LOAD:
382 			dataphdrp = phdrp;
383 			break;
384 		case PT_SUNWCAP:
385 			capphdr = phdrp;
386 			break;
387 		}
388 		phdrp = (Phdr *)((caddr_t)phdrp + hsize);
389 	}
390 
391 	if (ehdrp->e_type != ET_EXEC) {
392 		dataphdrp = NULL;
393 		hasauxv = 1;
394 	}
395 
396 	/* Copy BSS permissions to args->dat_prot */
397 	if (dataphdrp != NULL) {
398 		args->dat_prot = PROT_USER;
399 		if (dataphdrp->p_flags & PF_R)
400 			args->dat_prot |= PROT_READ;
401 		if (dataphdrp->p_flags & PF_W)
402 			args->dat_prot |= PROT_WRITE;
403 		if (dataphdrp->p_flags & PF_X)
404 			args->dat_prot |= PROT_EXEC;
405 	}
406 
407 	/*
408 	 * If a auxvector will be required - reserve the space for
409 	 * it now.  This may be increased by exec_args if there are
410 	 * ISA-specific types (included in __KERN_NAUXV_IMPL).
411 	 */
412 	if (hasauxv) {
413 		/*
414 		 * If a AUX vector is being built - the base AUX
415 		 * entries are:
416 		 *
417 		 *	AT_BASE
418 		 *	AT_FLAGS
419 		 *	AT_PAGESZ
420 		 *	AT_SUN_LDSECURE
421 		 *	AT_SUN_HWCAP
422 		 *	AT_SUN_HWCAP2
423 		 *	AT_SUN_PLATFORM
424 		 *	AT_SUN_EXECNAME
425 		 *	AT_NULL
426 		 *
427 		 * total == 9
428 		 */
429 		if (hasdy && hasu) {
430 			/*
431 			 * Has PT_INTERP & PT_PHDR - the auxvectors that
432 			 * will be built are:
433 			 *
434 			 *	AT_PHDR
435 			 *	AT_PHENT
436 			 *	AT_PHNUM
437 			 *	AT_ENTRY
438 			 *	AT_LDDATA
439 			 *
440 			 * total = 5
441 			 */
442 			args->auxsize = (9 + 5) * sizeof (aux_entry_t);
443 		} else if (hasdy) {
444 			/*
445 			 * Has PT_INTERP but no PT_PHDR
446 			 *
447 			 *	AT_EXECFD
448 			 *	AT_LDDATA
449 			 *
450 			 * total = 2
451 			 */
452 			args->auxsize = (9 + 2) * sizeof (aux_entry_t);
453 		} else {
454 			args->auxsize = 9 * sizeof (aux_entry_t);
455 		}
456 	} else {
457 		args->auxsize = 0;
458 	}
459 
460 	/*
461 	 * If this binary is using an emulator, we need to add an
462 	 * AT_SUN_EMULATOR aux entry.
463 	 */
464 	if (args->emulator != NULL)
465 		args->auxsize += sizeof (aux_entry_t);
466 
467 	if ((brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
468 		branded = 1;
469 		/*
470 		 * We will be adding 4 entries to the aux vectors.  One for
471 		 * the the brandname and 3 for the brand specific aux vectors.
472 		 */
473 		args->auxsize += 4 * sizeof (aux_entry_t);
474 	}
475 
476 	/* Hardware/Software capabilities */
477 	if (capphdr != NULL &&
478 	    (capsize = capphdr->p_filesz) > 0 &&
479 	    capsize <= 16 * sizeof (*cap)) {
480 		int ncaps = capsize / sizeof (*cap);
481 		Cap *cp;
482 
483 		cap = kmem_alloc(capsize, KM_SLEEP);
484 		if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)cap,
485 		    capsize, (offset_t)capphdr->p_offset,
486 		    UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid)) != 0) {
487 			uprintf("%s: Cannot read capabilities section\n",
488 			    exec_file);
489 			goto out;
490 		}
491 		for (cp = cap; cp < cap + ncaps; cp++) {
492 			if (cp->c_tag == CA_SUNW_SF_1 &&
493 			    (cp->c_un.c_val & SF1_SUNW_ADDR32)) {
494 				if (args->to_model == DATAMODEL_LP64)
495 					args->addr32 = 1;
496 				break;
497 			}
498 		}
499 	}
500 
501 	aux = bigwad->elfargs;
502 	/*
503 	 * Move args to the user's stack.
504 	 */
505 	if ((error = exec_args(uap, args, idatap, (void **)&aux)) != 0) {
506 		if (error == -1) {
507 			error = ENOEXEC;
508 			goto bad;
509 		}
510 		goto out;
511 	}
512 	/* we're single threaded after this point */
513 
514 	/*
515 	 * If this is an ET_DYN executable (shared object),
516 	 * determine its memory size so that mapelfexec() can load it.
517 	 */
518 	if (ehdrp->e_type == ET_DYN)
519 		len = elfsize(ehdrp, nphdrs, phdrbase, NULL);
520 	else
521 		len = 0;
522 
523 	dtrphdr = NULL;
524 
525 	if ((error = mapelfexec(vp, ehdrp, nphdrs, phdrbase, &uphdr, &dyphdr,
526 	    &stphdr, &dtrphdr, dataphdrp, &bssbase, &brkbase, &voffset, NULL,
527 	    len, execsz, &brksize)) != 0)
528 		goto bad;
529 
530 	if (uphdr != NULL && dyphdr == NULL)
531 		goto bad;
532 
533 	if (dtrphdr != NULL && dtrace_safe_phdr(dtrphdr, args, voffset) != 0) {
534 		uprintf("%s: Bad DTrace phdr in %s\n", exec_file, exec_file);
535 		goto bad;
536 	}
537 
538 	if (dyphdr != NULL) {
539 		size_t		len;
540 		uintptr_t	lddata;
541 		char		*p;
542 		struct vnode	*nvp;
543 
544 		dlnsize = dyphdr->p_filesz;
545 
546 		if (dlnsize > MAXPATHLEN || dlnsize <= 0)
547 			goto bad;
548 
549 		/*
550 		 * Read in "interpreter" pathname.
551 		 */
552 		if ((error = vn_rdwr(UIO_READ, vp, dlnp, dyphdr->p_filesz,
553 		    (offset_t)dyphdr->p_offset, UIO_SYSSPACE, 0, (rlim64_t)0,
554 		    CRED(), &resid)) != 0) {
555 			uprintf("%s: Cannot obtain interpreter pathname\n",
556 			    exec_file);
557 			goto bad;
558 		}
559 
560 		if (resid != 0 || dlnp[dlnsize - 1] != '\0')
561 			goto bad;
562 
563 		/*
564 		 * Search for '$ORIGIN' token in interpreter path.
565 		 * If found, expand it.
566 		 */
567 		for (p = dlnp; p = strchr(p, '$'); ) {
568 			uint_t	len, curlen;
569 			char	*_ptr;
570 
571 			if (strncmp(++p, ORIGIN_STR, ORIGIN_STR_SIZE))
572 				continue;
573 
574 			curlen = 0;
575 			len = p - dlnp - 1;
576 			if (len) {
577 				bcopy(dlnp, pathbufp, len);
578 				curlen += len;
579 			}
580 			if (_ptr = strrchr(args->pathname, '/')) {
581 				len = _ptr - args->pathname;
582 				if ((curlen + len) > MAXPATHLEN)
583 					break;
584 
585 				bcopy(args->pathname, &pathbufp[curlen], len);
586 				curlen += len;
587 			} else {
588 				/*
589 				 * executable is a basename found in the
590 				 * current directory.  So - just substitue
591 				 * '.' for ORIGIN.
592 				 */
593 				pathbufp[curlen] = '.';
594 				curlen++;
595 			}
596 			p += ORIGIN_STR_SIZE;
597 			len = strlen(p);
598 
599 			if ((curlen + len) > MAXPATHLEN)
600 				break;
601 			bcopy(p, &pathbufp[curlen], len);
602 			curlen += len;
603 			pathbufp[curlen++] = '\0';
604 			bcopy(pathbufp, dlnp, curlen);
605 		}
606 
607 		/*
608 		 * /usr/lib/ld.so.1 is known to be a symlink to /lib/ld.so.1
609 		 * (and /usr/lib/64/ld.so.1 is a symlink to /lib/64/ld.so.1).
610 		 * Just in case /usr is not mounted, change it now.
611 		 */
612 		if (strcmp(dlnp, USR_LIB_RTLD) == 0)
613 			dlnp += 4;
614 		error = lookupname(dlnp, UIO_SYSSPACE, FOLLOW, NULLVPP, &nvp);
615 		if (error && dlnp != bigwad->dl_name) {
616 			/* new kernel, old user-level */
617 			error = lookupname(dlnp -= 4, UIO_SYSSPACE, FOLLOW,
618 			    NULLVPP, &nvp);
619 		}
620 		if (error) {
621 			uprintf("%s: Cannot find %s\n", exec_file, dlnp);
622 			goto bad;
623 		}
624 
625 		/*
626 		 * Setup the "aux" vector.
627 		 */
628 		if (uphdr) {
629 			if (ehdrp->e_type == ET_DYN) {
630 				/* don't use the first page */
631 				bigwad->exenv.ex_brkbase = (caddr_t)PAGESIZE;
632 				bigwad->exenv.ex_bssbase = (caddr_t)PAGESIZE;
633 			} else {
634 				bigwad->exenv.ex_bssbase = bssbase;
635 				bigwad->exenv.ex_brkbase = brkbase;
636 			}
637 			bigwad->exenv.ex_brksize = brksize;
638 			bigwad->exenv.ex_magic = elfmagic;
639 			bigwad->exenv.ex_vp = vp;
640 			setexecenv(&bigwad->exenv);
641 
642 			ADDAUX(aux, AT_PHDR, uphdr->p_vaddr + voffset)
643 			ADDAUX(aux, AT_PHENT, ehdrp->e_phentsize)
644 			ADDAUX(aux, AT_PHNUM, nphdrs)
645 			ADDAUX(aux, AT_ENTRY, ehdrp->e_entry + voffset)
646 		} else {
647 			if ((error = execopen(&vp, &fd)) != 0) {
648 				VN_RELE(nvp);
649 				goto bad;
650 			}
651 
652 			ADDAUX(aux, AT_EXECFD, fd)
653 		}
654 
655 		if ((error = execpermissions(nvp, &bigwad->vattr, args)) != 0) {
656 			VN_RELE(nvp);
657 			uprintf("%s: Cannot execute %s\n", exec_file, dlnp);
658 			goto bad;
659 		}
660 
661 		/*
662 		 * Now obtain the ELF header along with the entire program
663 		 * header contained in "nvp".
664 		 */
665 		kmem_free(phdrbase, phdrsize);
666 		phdrbase = NULL;
667 		if ((error = getelfhead(nvp, CRED(), ehdrp, &nshdrs,
668 		    &shstrndx, &nphdrs)) != 0 ||
669 		    (error = getelfphdr(nvp, CRED(), ehdrp, nphdrs, &phdrbase,
670 		    &phdrsize)) != 0) {
671 			VN_RELE(nvp);
672 			uprintf("%s: Cannot read %s\n", exec_file, dlnp);
673 			goto bad;
674 		}
675 
676 		/*
677 		 * Determine memory size of the "interpreter's" loadable
678 		 * sections.  This size is then used to obtain the virtual
679 		 * address of a hole, in the user's address space, large
680 		 * enough to map the "interpreter".
681 		 */
682 		if ((len = elfsize(ehdrp, nphdrs, phdrbase, &lddata)) == 0) {
683 			VN_RELE(nvp);
684 			uprintf("%s: Nothing to load in %s\n", exec_file, dlnp);
685 			goto bad;
686 		}
687 
688 		dtrphdr = NULL;
689 
690 		error = mapelfexec(nvp, ehdrp, nphdrs, phdrbase, &junk, &junk,
691 		    &junk, &dtrphdr, NULL, NULL, NULL, &voffset, NULL, len,
692 		    execsz, NULL);
693 		if (error || junk != NULL) {
694 			VN_RELE(nvp);
695 			uprintf("%s: Cannot map %s\n", exec_file, dlnp);
696 			goto bad;
697 		}
698 
699 		/*
700 		 * We use the DTrace program header to initialize the
701 		 * architecture-specific user per-LWP location. The dtrace
702 		 * fasttrap provider requires ready access to per-LWP scratch
703 		 * space. We assume that there is only one such program header
704 		 * in the interpreter.
705 		 */
706 		if (dtrphdr != NULL &&
707 		    dtrace_safe_phdr(dtrphdr, args, voffset) != 0) {
708 			VN_RELE(nvp);
709 			uprintf("%s: Bad DTrace phdr in %s\n", exec_file, dlnp);
710 			goto bad;
711 		}
712 
713 		VN_RELE(nvp);
714 		ADDAUX(aux, AT_SUN_LDDATA, voffset + lddata)
715 	}
716 
717 	if (hasauxv) {
718 		int auxf = AF_SUN_HWCAPVERIFY;
719 		/*
720 		 * Note: AT_SUN_PLATFORM was filled in via exec_args()
721 		 */
722 		ADDAUX(aux, AT_BASE, voffset)
723 		ADDAUX(aux, AT_FLAGS, at_flags)
724 		ADDAUX(aux, AT_PAGESZ, PAGESIZE)
725 		/*
726 		 * Linker flags. (security)
727 		 * p_flag not yet set at this time.
728 		 * We rely on gexec() to provide us with the information.
729 		 * If the application is set-uid but this is not reflected
730 		 * in a mismatch between real/effective uids/gids, then
731 		 * don't treat this as a set-uid exec.  So we care about
732 		 * the EXECSETID_UGIDS flag but not the ...SETID flag.
733 		 */
734 		if ((setid &= ~EXECSETID_SETID) != 0)
735 			auxf |= AF_SUN_SETUGID;
736 
737 		/*
738 		 * If we're running a native process from within a branded
739 		 * zone under pfexec then we clear the AF_SUN_SETUGID flag so
740 		 * that the native ld.so.1 is able to link with the native
741 		 * libraries instead of using the brand libraries that are
742 		 * installed in the zone.  We only do this for processes
743 		 * which we trust because we see they are already running
744 		 * under pfexec (where uid != euid).  This prevents a
745 		 * malicious user within the zone from crafting a wrapper to
746 		 * run native suid commands with unsecure libraries interposed.
747 		 */
748 		if ((brand_action == EBA_NATIVE) && (PROC_IS_BRANDED(p) &&
749 		    (setid &= ~EXECSETID_SETID) != 0))
750 			auxf &= ~AF_SUN_SETUGID;
751 
752 		/*
753 		 * Record the user addr of the auxflags aux vector entry
754 		 * since brands may optionally want to manipulate this field.
755 		 */
756 		args->auxp_auxflags =
757 		    (char *)((char *)args->stackend +
758 		    ((char *)&aux->a_type -
759 		    (char *)bigwad->elfargs));
760 		ADDAUX(aux, AT_SUN_AUXFLAGS, auxf);
761 		/*
762 		 * Hardware capability flag word (performance hints)
763 		 * Used for choosing faster library routines.
764 		 * (Potentially different between 32-bit and 64-bit ABIs)
765 		 */
766 #if defined(_LP64)
767 		if (args->to_model == DATAMODEL_NATIVE) {
768 			ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap)
769 			ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2)
770 		} else {
771 			ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap32)
772 			ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap32_2)
773 		}
774 #else
775 		ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap)
776 		ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2)
777 #endif
778 		if (branded) {
779 			/*
780 			 * Reserve space for the brand-private aux vectors,
781 			 * and record the user addr of that space.
782 			 */
783 			args->auxp_brand =
784 			    (char *)((char *)args->stackend +
785 			    ((char *)&aux->a_type -
786 			    (char *)bigwad->elfargs));
787 			ADDAUX(aux, AT_SUN_BRAND_AUX1, 0)
788 			ADDAUX(aux, AT_SUN_BRAND_AUX2, 0)
789 			ADDAUX(aux, AT_SUN_BRAND_AUX3, 0)
790 		}
791 
792 		ADDAUX(aux, AT_NULL, 0)
793 		postfixsize = (char *)aux - (char *)bigwad->elfargs;
794 		ASSERT(postfixsize == args->auxsize);
795 		ASSERT(postfixsize <= __KERN_NAUXV_IMPL * sizeof (aux_entry_t));
796 	}
797 
798 	/*
799 	 * For the 64-bit kernel, the limit is big enough that rounding it up
800 	 * to a page can overflow the 64-bit limit, so we check for btopr()
801 	 * overflowing here by comparing it with the unrounded limit in pages.
802 	 * If it hasn't overflowed, compare the exec size with the rounded up
803 	 * limit in pages.  Otherwise, just compare with the unrounded limit.
804 	 */
805 	limit = btop(p->p_vmem_ctl);
806 	roundlimit = btopr(p->p_vmem_ctl);
807 	if ((roundlimit > limit && *execsz > roundlimit) ||
808 	    (roundlimit < limit && *execsz > limit)) {
809 		mutex_enter(&p->p_lock);
810 		(void) rctl_action(rctlproc_legacy[RLIMIT_VMEM], p->p_rctls, p,
811 		    RCA_SAFE);
812 		mutex_exit(&p->p_lock);
813 		error = ENOMEM;
814 		goto bad;
815 	}
816 
817 	bzero(up->u_auxv, sizeof (up->u_auxv));
818 	if (postfixsize) {
819 		int num_auxv;
820 
821 		/*
822 		 * Copy the aux vector to the user stack.
823 		 */
824 		error = execpoststack(args, bigwad->elfargs, postfixsize);
825 		if (error)
826 			goto bad;
827 
828 		/*
829 		 * Copy auxv to the process's user structure for use by /proc.
830 		 * If this is a branded process, the brand's exec routine will
831 		 * copy it's private entries to the user structure later. It
832 		 * relies on the fact that the blank entries are at the end.
833 		 */
834 		num_auxv = postfixsize / sizeof (aux_entry_t);
835 		ASSERT(num_auxv <= sizeof (up->u_auxv) / sizeof (auxv_t));
836 		aux = bigwad->elfargs;
837 		for (i = 0; i < num_auxv; i++) {
838 			up->u_auxv[i].a_type = aux[i].a_type;
839 			up->u_auxv[i].a_un.a_val = (aux_val_t)aux[i].a_un.a_val;
840 		}
841 	}
842 
843 	/*
844 	 * Pass back the starting address so we can set the program counter.
845 	 */
846 	args->entry = (uintptr_t)(ehdrp->e_entry + voffset);
847 
848 	if (!uphdr) {
849 		if (ehdrp->e_type == ET_DYN) {
850 			/*
851 			 * If we are executing a shared library which doesn't
852 			 * have a interpreter (probably ld.so.1) then
853 			 * we don't set the brkbase now.  Instead we
854 			 * delay it's setting until the first call
855 			 * via grow.c::brk().  This permits ld.so.1 to
856 			 * initialize brkbase to the tail of the executable it
857 			 * loads (which is where it needs to be).
858 			 */
859 			bigwad->exenv.ex_brkbase = (caddr_t)0;
860 			bigwad->exenv.ex_bssbase = (caddr_t)0;
861 			bigwad->exenv.ex_brksize = 0;
862 		} else {
863 			bigwad->exenv.ex_brkbase = brkbase;
864 			bigwad->exenv.ex_bssbase = bssbase;
865 			bigwad->exenv.ex_brksize = brksize;
866 		}
867 		bigwad->exenv.ex_magic = elfmagic;
868 		bigwad->exenv.ex_vp = vp;
869 		setexecenv(&bigwad->exenv);
870 	}
871 
872 	ASSERT(error == 0);
873 	goto out;
874 
875 bad:
876 	if (fd != -1)		/* did we open the a.out yet */
877 		(void) execclose(fd);
878 
879 	psignal(p, SIGKILL);
880 
881 	if (error == 0)
882 		error = ENOEXEC;
883 out:
884 	if (phdrbase != NULL)
885 		kmem_free(phdrbase, phdrsize);
886 	if (cap != NULL)
887 		kmem_free(cap, capsize);
888 	kmem_free(bigwad, sizeof (struct bigwad));
889 	return (error);
890 }
891 
892 /*
893  * Compute the memory size requirement for the ELF file.
894  */
895 static size_t
896 elfsize(Ehdr *ehdrp, int nphdrs, caddr_t phdrbase, uintptr_t *lddata)
897 {
898 	size_t	len;
899 	Phdr	*phdrp = (Phdr *)phdrbase;
900 	int	hsize = ehdrp->e_phentsize;
901 	int	first = 1;
902 	int	dfirst = 1;	/* first data segment */
903 	uintptr_t loaddr = 0;
904 	uintptr_t hiaddr = 0;
905 	uintptr_t lo, hi;
906 	int	i;
907 
908 	for (i = nphdrs; i > 0; i--) {
909 		if (phdrp->p_type == PT_LOAD) {
910 			lo = phdrp->p_vaddr;
911 			hi = lo + phdrp->p_memsz;
912 			if (first) {
913 				loaddr = lo;
914 				hiaddr = hi;
915 				first = 0;
916 			} else {
917 				if (loaddr > lo)
918 					loaddr = lo;
919 				if (hiaddr < hi)
920 					hiaddr = hi;
921 			}
922 
923 			/*
924 			 * save the address of the first data segment
925 			 * of a object - used for the AT_SUNW_LDDATA
926 			 * aux entry.
927 			 */
928 			if ((lddata != NULL) && dfirst &&
929 			    (phdrp->p_flags & PF_W)) {
930 				*lddata = lo;
931 				dfirst = 0;
932 			}
933 		}
934 		phdrp = (Phdr *)((caddr_t)phdrp + hsize);
935 	}
936 
937 	len = hiaddr - (loaddr & PAGEMASK);
938 	len = roundup(len, PAGESIZE);
939 
940 	return (len);
941 }
942 
943 /*
944  * Read in the ELF header and program header table.
945  * SUSV3 requires:
946  *	ENOEXEC	File format is not recognized
947  *	EINVAL	Format recognized but execution not supported
948  */
949 static int
950 getelfhead(vnode_t *vp, cred_t *credp, Ehdr *ehdr, int *nshdrs, int *shstrndx,
951     int *nphdrs)
952 {
953 	int error;
954 	ssize_t resid;
955 
956 	/*
957 	 * We got here by the first two bytes in ident,
958 	 * now read the entire ELF header.
959 	 */
960 	if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)ehdr,
961 	    sizeof (Ehdr), (offset_t)0, UIO_SYSSPACE, 0,
962 	    (rlim64_t)0, credp, &resid)) != 0)
963 		return (error);
964 
965 	/*
966 	 * Since a separate version is compiled for handling 32-bit and
967 	 * 64-bit ELF executables on a 64-bit kernel, the 64-bit version
968 	 * doesn't need to be able to deal with 32-bit ELF files.
969 	 */
970 	if (resid != 0 ||
971 	    ehdr->e_ident[EI_MAG2] != ELFMAG2 ||
972 	    ehdr->e_ident[EI_MAG3] != ELFMAG3)
973 		return (ENOEXEC);
974 
975 	if ((ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) ||
976 #if defined(_ILP32) || defined(_ELF32_COMPAT)
977 	    ehdr->e_ident[EI_CLASS] != ELFCLASS32 ||
978 #else
979 	    ehdr->e_ident[EI_CLASS] != ELFCLASS64 ||
980 #endif
981 	    !elfheadcheck(ehdr->e_ident[EI_DATA], ehdr->e_machine,
982 	    ehdr->e_flags))
983 		return (EINVAL);
984 
985 	*nshdrs = ehdr->e_shnum;
986 	*shstrndx = ehdr->e_shstrndx;
987 	*nphdrs = ehdr->e_phnum;
988 
989 	/*
990 	 * If e_shnum, e_shstrndx, or e_phnum is its sentinel value, we need
991 	 * to read in the section header at index zero to acces the true
992 	 * values for those fields.
993 	 */
994 	if ((*nshdrs == 0 && ehdr->e_shoff != 0) ||
995 	    *shstrndx == SHN_XINDEX || *nphdrs == PN_XNUM) {
996 		Shdr shdr;
997 
998 		if (ehdr->e_shoff == 0)
999 			return (EINVAL);
1000 
1001 		if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)&shdr,
1002 		    sizeof (shdr), (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0,
1003 		    (rlim64_t)0, credp, &resid)) != 0)
1004 			return (error);
1005 
1006 		if (*nshdrs == 0)
1007 			*nshdrs = shdr.sh_size;
1008 		if (*shstrndx == SHN_XINDEX)
1009 			*shstrndx = shdr.sh_link;
1010 		if (*nphdrs == PN_XNUM && shdr.sh_info != 0)
1011 			*nphdrs = shdr.sh_info;
1012 	}
1013 
1014 	return (0);
1015 }
1016 
1017 #ifdef _ELF32_COMPAT
1018 extern size_t elf_nphdr_max;
1019 #else
1020 size_t elf_nphdr_max = 1000;
1021 #endif
1022 
1023 static int
1024 getelfphdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, int nphdrs,
1025     caddr_t *phbasep, ssize_t *phsizep)
1026 {
1027 	ssize_t resid, minsize;
1028 	int err;
1029 
1030 	/*
1031 	 * Since we're going to be using e_phentsize to iterate down the
1032 	 * array of program headers, it must be 8-byte aligned or else
1033 	 * a we might cause a misaligned access. We use all members through
1034 	 * p_flags on 32-bit ELF files and p_memsz on 64-bit ELF files so
1035 	 * e_phentsize must be at least large enough to include those
1036 	 * members.
1037 	 */
1038 #if !defined(_LP64) || defined(_ELF32_COMPAT)
1039 	minsize = offsetof(Phdr, p_flags) + sizeof (((Phdr *)NULL)->p_flags);
1040 #else
1041 	minsize = offsetof(Phdr, p_memsz) + sizeof (((Phdr *)NULL)->p_memsz);
1042 #endif
1043 	if (ehdr->e_phentsize < minsize || (ehdr->e_phentsize & 3))
1044 		return (EINVAL);
1045 
1046 	*phsizep = nphdrs * ehdr->e_phentsize;
1047 
1048 	if (*phsizep > sizeof (Phdr) * elf_nphdr_max) {
1049 		if ((*phbasep = kmem_alloc(*phsizep, KM_NOSLEEP)) == NULL)
1050 			return (ENOMEM);
1051 	} else {
1052 		*phbasep = kmem_alloc(*phsizep, KM_SLEEP);
1053 	}
1054 
1055 	if ((err = vn_rdwr(UIO_READ, vp, *phbasep, *phsizep,
1056 	    (offset_t)ehdr->e_phoff, UIO_SYSSPACE, 0, (rlim64_t)0,
1057 	    credp, &resid)) != 0) {
1058 		kmem_free(*phbasep, *phsizep);
1059 		*phbasep = NULL;
1060 		return (err);
1061 	}
1062 
1063 	return (0);
1064 }
1065 
1066 #ifdef _ELF32_COMPAT
1067 extern size_t elf_nshdr_max;
1068 extern size_t elf_shstrtab_max;
1069 #else
1070 size_t elf_nshdr_max = 10000;
1071 size_t elf_shstrtab_max = 100 * 1024;
1072 #endif
1073 
1074 
1075 static int
1076 getelfshdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr,
1077     int nshdrs, int shstrndx, caddr_t *shbasep, ssize_t *shsizep,
1078     char **shstrbasep, ssize_t *shstrsizep)
1079 {
1080 	ssize_t resid, minsize;
1081 	int err;
1082 	Shdr *shdr;
1083 
1084 	/*
1085 	 * Since we're going to be using e_shentsize to iterate down the
1086 	 * array of section headers, it must be 8-byte aligned or else
1087 	 * a we might cause a misaligned access. We use all members through
1088 	 * sh_entsize (on both 32- and 64-bit ELF files) so e_shentsize
1089 	 * must be at least large enough to include that member. The index
1090 	 * of the string table section must also be valid.
1091 	 */
1092 	minsize = offsetof(Shdr, sh_entsize) + sizeof (shdr->sh_entsize);
1093 	if (ehdr->e_shentsize < minsize || (ehdr->e_shentsize & 3) ||
1094 	    shstrndx >= nshdrs)
1095 		return (EINVAL);
1096 
1097 	*shsizep = nshdrs * ehdr->e_shentsize;
1098 
1099 	if (*shsizep > sizeof (Shdr) * elf_nshdr_max) {
1100 		if ((*shbasep = kmem_alloc(*shsizep, KM_NOSLEEP)) == NULL)
1101 			return (ENOMEM);
1102 	} else {
1103 		*shbasep = kmem_alloc(*shsizep, KM_SLEEP);
1104 	}
1105 
1106 	if ((err = vn_rdwr(UIO_READ, vp, *shbasep, *shsizep,
1107 	    (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, (rlim64_t)0,
1108 	    credp, &resid)) != 0) {
1109 		kmem_free(*shbasep, *shsizep);
1110 		return (err);
1111 	}
1112 
1113 	/*
1114 	 * Pull the section string table out of the vnode; fail if the size
1115 	 * is zero.
1116 	 */
1117 	shdr = (Shdr *)(*shbasep + shstrndx * ehdr->e_shentsize);
1118 	if ((*shstrsizep = shdr->sh_size) == 0) {
1119 		kmem_free(*shbasep, *shsizep);
1120 		return (EINVAL);
1121 	}
1122 
1123 	if (*shstrsizep > elf_shstrtab_max) {
1124 		if ((*shstrbasep = kmem_alloc(*shstrsizep,
1125 		    KM_NOSLEEP)) == NULL) {
1126 			kmem_free(*shbasep, *shsizep);
1127 			return (ENOMEM);
1128 		}
1129 	} else {
1130 		*shstrbasep = kmem_alloc(*shstrsizep, KM_SLEEP);
1131 	}
1132 
1133 	if ((err = vn_rdwr(UIO_READ, vp, *shstrbasep, *shstrsizep,
1134 	    (offset_t)shdr->sh_offset, UIO_SYSSPACE, 0, (rlim64_t)0,
1135 	    credp, &resid)) != 0) {
1136 		kmem_free(*shbasep, *shsizep);
1137 		kmem_free(*shstrbasep, *shstrsizep);
1138 		return (err);
1139 	}
1140 
1141 	/*
1142 	 * Make sure the strtab is null-terminated to make sure we
1143 	 * don't run off the end of the table.
1144 	 */
1145 	(*shstrbasep)[*shstrsizep - 1] = '\0';
1146 
1147 	return (0);
1148 }
1149 
1150 static int
1151 mapelfexec(
1152 	vnode_t *vp,
1153 	Ehdr *ehdr,
1154 	int nphdrs,
1155 	caddr_t phdrbase,
1156 	Phdr **uphdr,
1157 	Phdr **dyphdr,
1158 	Phdr **stphdr,
1159 	Phdr **dtphdr,
1160 	Phdr *dataphdrp,
1161 	caddr_t *bssbase,
1162 	caddr_t *brkbase,
1163 	intptr_t *voffset,
1164 	intptr_t *minaddr,
1165 	size_t len,
1166 	long *execsz,
1167 	size_t *brksize)
1168 {
1169 	Phdr *phdr;
1170 	int i, prot, error;
1171 	caddr_t addr = NULL;
1172 	size_t zfodsz;
1173 	int ptload = 0;
1174 	int page;
1175 	off_t offset;
1176 	int hsize = ehdr->e_phentsize;
1177 	caddr_t mintmp = (caddr_t)-1;
1178 	extern int use_brk_lpg;
1179 
1180 	if (ehdr->e_type == ET_DYN) {
1181 		/*
1182 		 * Obtain the virtual address of a hole in the
1183 		 * address space to map the "interpreter".
1184 		 */
1185 		map_addr(&addr, len, (offset_t)0, 1, 0);
1186 		if (addr == NULL)
1187 			return (ENOMEM);
1188 		*voffset = (intptr_t)addr;
1189 
1190 		/*
1191 		 * Calculate the minimum vaddr so it can be subtracted out.
1192 		 * According to the ELF specification, since PT_LOAD sections
1193 		 * must be sorted by increasing p_vaddr values, this is
1194 		 * guaranteed to be the first PT_LOAD section.
1195 		 */
1196 		phdr = (Phdr *)phdrbase;
1197 		for (i = nphdrs; i > 0; i--) {
1198 			if (phdr->p_type == PT_LOAD) {
1199 				*voffset -= (uintptr_t)phdr->p_vaddr;
1200 				break;
1201 			}
1202 			phdr = (Phdr *)((caddr_t)phdr + hsize);
1203 		}
1204 
1205 	} else {
1206 		*voffset = 0;
1207 	}
1208 	phdr = (Phdr *)phdrbase;
1209 	for (i = nphdrs; i > 0; i--) {
1210 		switch (phdr->p_type) {
1211 		case PT_LOAD:
1212 			if ((*dyphdr != NULL) && (*uphdr == NULL))
1213 				return (0);
1214 
1215 			ptload = 1;
1216 			prot = PROT_USER;
1217 			if (phdr->p_flags & PF_R)
1218 				prot |= PROT_READ;
1219 			if (phdr->p_flags & PF_W)
1220 				prot |= PROT_WRITE;
1221 			if (phdr->p_flags & PF_X)
1222 				prot |= PROT_EXEC;
1223 
1224 			addr = (caddr_t)((uintptr_t)phdr->p_vaddr + *voffset);
1225 
1226 			/*
1227 			 * Keep track of the segment with the lowest starting
1228 			 * address.
1229 			 */
1230 			if (addr < mintmp)
1231 				mintmp = addr;
1232 
1233 			zfodsz = (size_t)phdr->p_memsz - phdr->p_filesz;
1234 
1235 			offset = phdr->p_offset;
1236 			if (((uintptr_t)offset & PAGEOFFSET) ==
1237 			    ((uintptr_t)addr & PAGEOFFSET) &&
1238 			    (!(vp->v_flag & VNOMAP))) {
1239 				page = 1;
1240 			} else {
1241 				page = 0;
1242 			}
1243 
1244 			/*
1245 			 * Set the heap pagesize for OOB when the bss size
1246 			 * is known and use_brk_lpg is not 0.
1247 			 */
1248 			if (brksize != NULL && use_brk_lpg &&
1249 			    zfodsz != 0 && phdr == dataphdrp &&
1250 			    (prot & PROT_WRITE)) {
1251 				size_t tlen = P2NPHASE((uintptr_t)addr +
1252 				    phdr->p_filesz, PAGESIZE);
1253 
1254 				if (zfodsz > tlen) {
1255 					curproc->p_brkpageszc =
1256 					    page_szc(map_pgsz(MAPPGSZ_HEAP,
1257 					    curproc, addr + phdr->p_filesz +
1258 					    tlen, zfodsz - tlen, 0));
1259 				}
1260 			}
1261 
1262 			if (curproc->p_brkpageszc != 0 && phdr == dataphdrp &&
1263 			    (prot & PROT_WRITE)) {
1264 				uint_t	szc = curproc->p_brkpageszc;
1265 				size_t pgsz = page_get_pagesize(szc);
1266 				caddr_t ebss = addr + phdr->p_memsz;
1267 				size_t extra_zfodsz;
1268 
1269 				ASSERT(pgsz > PAGESIZE);
1270 
1271 				extra_zfodsz = P2NPHASE((uintptr_t)ebss, pgsz);
1272 
1273 				if (error = execmap(vp, addr, phdr->p_filesz,
1274 				    zfodsz + extra_zfodsz, phdr->p_offset,
1275 				    prot, page, szc))
1276 					goto bad;
1277 				if (brksize != NULL)
1278 					*brksize = extra_zfodsz;
1279 			} else {
1280 				if (error = execmap(vp, addr, phdr->p_filesz,
1281 				    zfodsz, phdr->p_offset, prot, page, 0))
1282 					goto bad;
1283 			}
1284 
1285 			if (bssbase != NULL && addr >= *bssbase &&
1286 			    phdr == dataphdrp) {
1287 				*bssbase = addr + phdr->p_filesz;
1288 			}
1289 			if (brkbase != NULL && addr >= *brkbase) {
1290 				*brkbase = addr + phdr->p_memsz;
1291 			}
1292 
1293 			*execsz += btopr(phdr->p_memsz);
1294 			break;
1295 
1296 		case PT_INTERP:
1297 			if (ptload)
1298 				goto bad;
1299 			*dyphdr = phdr;
1300 			break;
1301 
1302 		case PT_SHLIB:
1303 			*stphdr = phdr;
1304 			break;
1305 
1306 		case PT_PHDR:
1307 			if (ptload)
1308 				goto bad;
1309 			*uphdr = phdr;
1310 			break;
1311 
1312 		case PT_NULL:
1313 		case PT_DYNAMIC:
1314 		case PT_NOTE:
1315 			break;
1316 
1317 		case PT_SUNWDTRACE:
1318 			if (dtphdr != NULL)
1319 				*dtphdr = phdr;
1320 			break;
1321 
1322 		default:
1323 			break;
1324 		}
1325 		phdr = (Phdr *)((caddr_t)phdr + hsize);
1326 	}
1327 
1328 	if (minaddr != NULL) {
1329 		ASSERT(mintmp != (caddr_t)-1);
1330 		*minaddr = (intptr_t)mintmp;
1331 	}
1332 
1333 	return (0);
1334 bad:
1335 	if (error == 0)
1336 		error = EINVAL;
1337 	return (error);
1338 }
1339 
1340 int
1341 elfnote(vnode_t *vp, offset_t *offsetp, int type, int descsz, void *desc,
1342     rlim64_t rlimit, cred_t *credp)
1343 {
1344 	Note note;
1345 	int error;
1346 
1347 	bzero(&note, sizeof (note));
1348 	bcopy("CORE", note.name, 4);
1349 	note.nhdr.n_type = type;
1350 	/*
1351 	 * The System V ABI states that n_namesz must be the length of the
1352 	 * string that follows the Nhdr structure including the terminating
1353 	 * null. The ABI also specifies that sufficient padding should be
1354 	 * included so that the description that follows the name string
1355 	 * begins on a 4- or 8-byte boundary for 32- and 64-bit binaries
1356 	 * respectively. However, since this change was not made correctly
1357 	 * at the time of the 64-bit port, both 32- and 64-bit binaries
1358 	 * descriptions are only guaranteed to begin on a 4-byte boundary.
1359 	 */
1360 	note.nhdr.n_namesz = 5;
1361 	note.nhdr.n_descsz = roundup(descsz, sizeof (Word));
1362 
1363 	if (error = core_write(vp, UIO_SYSSPACE, *offsetp, &note,
1364 	    sizeof (note), rlimit, credp))
1365 		return (error);
1366 
1367 	*offsetp += sizeof (note);
1368 
1369 	if (error = core_write(vp, UIO_SYSSPACE, *offsetp, desc,
1370 	    note.nhdr.n_descsz, rlimit, credp))
1371 		return (error);
1372 
1373 	*offsetp += note.nhdr.n_descsz;
1374 	return (0);
1375 }
1376 
1377 /*
1378  * Copy the section data from one vnode to the section of another vnode.
1379  */
1380 static void
1381 copy_scn(Shdr *src, vnode_t *src_vp, Shdr *dst, vnode_t *dst_vp, Off *doffset,
1382     void *buf, size_t size, cred_t *credp, rlim64_t rlimit)
1383 {
1384 	ssize_t resid;
1385 	size_t len, n = src->sh_size;
1386 	offset_t off = 0;
1387 
1388 	while (n != 0) {
1389 		len = MIN(size, n);
1390 		if (vn_rdwr(UIO_READ, src_vp, buf, len, src->sh_offset + off,
1391 		    UIO_SYSSPACE, 0, (rlim64_t)0, credp, &resid) != 0 ||
1392 		    resid >= len ||
1393 		    core_write(dst_vp, UIO_SYSSPACE, *doffset + off,
1394 		    buf, len - resid, rlimit, credp) != 0) {
1395 			dst->sh_size = 0;
1396 			dst->sh_offset = 0;
1397 			return;
1398 		}
1399 
1400 		ASSERT(n >= len - resid);
1401 
1402 		n -= len - resid;
1403 		off += len - resid;
1404 	}
1405 
1406 	*doffset += src->sh_size;
1407 }
1408 
1409 #ifdef _ELF32_COMPAT
1410 extern size_t elf_datasz_max;
1411 #else
1412 size_t elf_datasz_max = 1 * 1024 * 1024;
1413 #endif
1414 
1415 /*
1416  * This function processes mappings that correspond to load objects to
1417  * examine their respective sections for elfcore(). It's called once with
1418  * v set to NULL to count the number of sections that we're going to need
1419  * and then again with v set to some allocated buffer that we fill in with
1420  * all the section data.
1421  */
1422 static int
1423 process_scns(core_content_t content, proc_t *p, cred_t *credp, vnode_t *vp,
1424     Shdr *v, int nv, rlim64_t rlimit, Off *doffsetp, int *nshdrsp)
1425 {
1426 	vnode_t *lastvp = NULL;
1427 	struct seg *seg;
1428 	int i, j;
1429 	void *data = NULL;
1430 	size_t datasz = 0;
1431 	shstrtab_t shstrtab;
1432 	struct as *as = p->p_as;
1433 	int error = 0;
1434 
1435 	if (v != NULL)
1436 		shstrtab_init(&shstrtab);
1437 
1438 	i = 1;
1439 	for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
1440 		uint_t prot;
1441 		vnode_t *mvp;
1442 		void *tmp = NULL;
1443 		caddr_t saddr = seg->s_base;
1444 		caddr_t naddr;
1445 		caddr_t eaddr;
1446 		size_t segsize;
1447 
1448 		Ehdr ehdr;
1449 		int nshdrs, shstrndx, nphdrs;
1450 		caddr_t shbase;
1451 		ssize_t shsize;
1452 		char *shstrbase;
1453 		ssize_t shstrsize;
1454 
1455 		Shdr *shdr;
1456 		const char *name;
1457 		size_t sz;
1458 		uintptr_t off;
1459 
1460 		int ctf_ndx = 0;
1461 		int symtab_ndx = 0;
1462 
1463 		/*
1464 		 * Since we're just looking for text segments of load
1465 		 * objects, we only care about the protection bits; we don't
1466 		 * care about the actual size of the segment so we use the
1467 		 * reserved size. If the segment's size is zero, there's
1468 		 * something fishy going on so we ignore this segment.
1469 		 */
1470 		if (seg->s_ops != &segvn_ops ||
1471 		    SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 ||
1472 		    mvp == lastvp || mvp == NULL || mvp->v_type != VREG ||
1473 		    (segsize = pr_getsegsize(seg, 1)) == 0)
1474 			continue;
1475 
1476 		eaddr = saddr + segsize;
1477 		prot = pr_getprot(seg, 1, &tmp, &saddr, &naddr, eaddr);
1478 		pr_getprot_done(&tmp);
1479 
1480 		/*
1481 		 * Skip this segment unless the protection bits look like
1482 		 * what we'd expect for a text segment.
1483 		 */
1484 		if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC)
1485 			continue;
1486 
1487 		if (getelfhead(mvp, credp, &ehdr, &nshdrs, &shstrndx,
1488 		    &nphdrs) != 0 ||
1489 		    getelfshdr(mvp, credp, &ehdr, nshdrs, shstrndx,
1490 		    &shbase, &shsize, &shstrbase, &shstrsize) != 0)
1491 			continue;
1492 
1493 		off = ehdr.e_shentsize;
1494 		for (j = 1; j < nshdrs; j++, off += ehdr.e_shentsize) {
1495 			Shdr *symtab = NULL, *strtab;
1496 
1497 			shdr = (Shdr *)(shbase + off);
1498 
1499 			if (shdr->sh_name >= shstrsize)
1500 				continue;
1501 
1502 			name = shstrbase + shdr->sh_name;
1503 
1504 			if (strcmp(name, shstrtab_data[STR_CTF]) == 0) {
1505 				if ((content & CC_CONTENT_CTF) == 0 ||
1506 				    ctf_ndx != 0)
1507 					continue;
1508 
1509 				if (shdr->sh_link > 0 &&
1510 				    shdr->sh_link < nshdrs) {
1511 					symtab = (Shdr *)(shbase +
1512 					    shdr->sh_link * ehdr.e_shentsize);
1513 				}
1514 
1515 				if (v != NULL && i < nv - 1) {
1516 					if (shdr->sh_size > datasz &&
1517 					    shdr->sh_size <= elf_datasz_max) {
1518 						if (data != NULL)
1519 							kmem_free(data, datasz);
1520 
1521 						datasz = shdr->sh_size;
1522 						data = kmem_alloc(datasz,
1523 						    KM_SLEEP);
1524 					}
1525 
1526 					v[i].sh_name = shstrtab_ndx(&shstrtab,
1527 					    STR_CTF);
1528 					v[i].sh_addr = (Addr)(uintptr_t)saddr;
1529 					v[i].sh_type = SHT_PROGBITS;
1530 					v[i].sh_addralign = 4;
1531 					*doffsetp = roundup(*doffsetp,
1532 					    v[i].sh_addralign);
1533 					v[i].sh_offset = *doffsetp;
1534 					v[i].sh_size = shdr->sh_size;
1535 					if (symtab == NULL)  {
1536 						v[i].sh_link = 0;
1537 					} else if (symtab->sh_type ==
1538 					    SHT_SYMTAB &&
1539 					    symtab_ndx != 0) {
1540 						v[i].sh_link =
1541 						    symtab_ndx;
1542 					} else {
1543 						v[i].sh_link = i + 1;
1544 					}
1545 
1546 					copy_scn(shdr, mvp, &v[i], vp,
1547 					    doffsetp, data, datasz, credp,
1548 					    rlimit);
1549 				}
1550 
1551 				ctf_ndx = i++;
1552 
1553 				/*
1554 				 * We've already dumped the symtab.
1555 				 */
1556 				if (symtab != NULL &&
1557 				    symtab->sh_type == SHT_SYMTAB &&
1558 				    symtab_ndx != 0)
1559 					continue;
1560 
1561 			} else if (strcmp(name,
1562 			    shstrtab_data[STR_SYMTAB]) == 0) {
1563 				if ((content & CC_CONTENT_SYMTAB) == 0 ||
1564 				    symtab != 0)
1565 					continue;
1566 
1567 				symtab = shdr;
1568 			}
1569 
1570 			if (symtab != NULL) {
1571 				if ((symtab->sh_type != SHT_DYNSYM &&
1572 				    symtab->sh_type != SHT_SYMTAB) ||
1573 				    symtab->sh_link == 0 ||
1574 				    symtab->sh_link >= nshdrs)
1575 					continue;
1576 
1577 				strtab = (Shdr *)(shbase +
1578 				    symtab->sh_link * ehdr.e_shentsize);
1579 
1580 				if (strtab->sh_type != SHT_STRTAB)
1581 					continue;
1582 
1583 				if (v != NULL && i < nv - 2) {
1584 					sz = MAX(symtab->sh_size,
1585 					    strtab->sh_size);
1586 					if (sz > datasz &&
1587 					    sz <= elf_datasz_max) {
1588 						if (data != NULL)
1589 							kmem_free(data, datasz);
1590 
1591 						datasz = sz;
1592 						data = kmem_alloc(datasz,
1593 						    KM_SLEEP);
1594 					}
1595 
1596 					if (symtab->sh_type == SHT_DYNSYM) {
1597 						v[i].sh_name = shstrtab_ndx(
1598 						    &shstrtab, STR_DYNSYM);
1599 						v[i + 1].sh_name = shstrtab_ndx(
1600 						    &shstrtab, STR_DYNSTR);
1601 					} else {
1602 						v[i].sh_name = shstrtab_ndx(
1603 						    &shstrtab, STR_SYMTAB);
1604 						v[i + 1].sh_name = shstrtab_ndx(
1605 						    &shstrtab, STR_STRTAB);
1606 					}
1607 
1608 					v[i].sh_type = symtab->sh_type;
1609 					v[i].sh_addr = symtab->sh_addr;
1610 					if (ehdr.e_type == ET_DYN ||
1611 					    v[i].sh_addr == 0)
1612 						v[i].sh_addr +=
1613 						    (Addr)(uintptr_t)saddr;
1614 					v[i].sh_addralign =
1615 					    symtab->sh_addralign;
1616 					*doffsetp = roundup(*doffsetp,
1617 					    v[i].sh_addralign);
1618 					v[i].sh_offset = *doffsetp;
1619 					v[i].sh_size = symtab->sh_size;
1620 					v[i].sh_link = i + 1;
1621 					v[i].sh_entsize = symtab->sh_entsize;
1622 					v[i].sh_info = symtab->sh_info;
1623 
1624 					copy_scn(symtab, mvp, &v[i], vp,
1625 					    doffsetp, data, datasz, credp,
1626 					    rlimit);
1627 
1628 					v[i + 1].sh_type = SHT_STRTAB;
1629 					v[i + 1].sh_flags = SHF_STRINGS;
1630 					v[i + 1].sh_addr = symtab->sh_addr;
1631 					if (ehdr.e_type == ET_DYN ||
1632 					    v[i + 1].sh_addr == 0)
1633 						v[i + 1].sh_addr +=
1634 						    (Addr)(uintptr_t)saddr;
1635 					v[i + 1].sh_addralign =
1636 					    strtab->sh_addralign;
1637 					*doffsetp = roundup(*doffsetp,
1638 					    v[i + 1].sh_addralign);
1639 					v[i + 1].sh_offset = *doffsetp;
1640 					v[i + 1].sh_size = strtab->sh_size;
1641 
1642 					copy_scn(strtab, mvp, &v[i + 1], vp,
1643 					    doffsetp, data, datasz, credp,
1644 					    rlimit);
1645 				}
1646 
1647 				if (symtab->sh_type == SHT_SYMTAB)
1648 					symtab_ndx = i;
1649 				i += 2;
1650 			}
1651 		}
1652 
1653 		kmem_free(shstrbase, shstrsize);
1654 		kmem_free(shbase, shsize);
1655 
1656 		lastvp = mvp;
1657 	}
1658 
1659 	if (v == NULL) {
1660 		if (i == 1)
1661 			*nshdrsp = 0;
1662 		else
1663 			*nshdrsp = i + 1;
1664 		goto done;
1665 	}
1666 
1667 	if (i != nv - 1) {
1668 		cmn_err(CE_WARN, "elfcore: core dump failed for "
1669 		    "process %d; address space is changing", p->p_pid);
1670 		error = EIO;
1671 		goto done;
1672 	}
1673 
1674 	v[i].sh_name = shstrtab_ndx(&shstrtab, STR_SHSTRTAB);
1675 	v[i].sh_size = shstrtab_size(&shstrtab);
1676 	v[i].sh_addralign = 1;
1677 	*doffsetp = roundup(*doffsetp, v[i].sh_addralign);
1678 	v[i].sh_offset = *doffsetp;
1679 	v[i].sh_flags = SHF_STRINGS;
1680 	v[i].sh_type = SHT_STRTAB;
1681 
1682 	if (v[i].sh_size > datasz) {
1683 		if (data != NULL)
1684 			kmem_free(data, datasz);
1685 
1686 		datasz = v[i].sh_size;
1687 		data = kmem_alloc(datasz,
1688 		    KM_SLEEP);
1689 	}
1690 
1691 	shstrtab_dump(&shstrtab, data);
1692 
1693 	if ((error = core_write(vp, UIO_SYSSPACE, *doffsetp,
1694 	    data, v[i].sh_size, rlimit, credp)) != 0)
1695 		goto done;
1696 
1697 	*doffsetp += v[i].sh_size;
1698 
1699 done:
1700 	if (data != NULL)
1701 		kmem_free(data, datasz);
1702 
1703 	return (error);
1704 }
1705 
1706 int
1707 elfcore(vnode_t *vp, proc_t *p, cred_t *credp, rlim64_t rlimit, int sig,
1708     core_content_t content)
1709 {
1710 	offset_t poffset, soffset;
1711 	Off doffset;
1712 	int error, i, nphdrs, nshdrs;
1713 	int overflow = 0;
1714 	struct seg *seg;
1715 	struct as *as = p->p_as;
1716 	union {
1717 		Ehdr ehdr;
1718 		Phdr phdr[1];
1719 		Shdr shdr[1];
1720 	} *bigwad;
1721 	size_t bigsize;
1722 	size_t phdrsz, shdrsz;
1723 	Ehdr *ehdr;
1724 	Phdr *v;
1725 	caddr_t brkbase;
1726 	size_t brksize;
1727 	caddr_t stkbase;
1728 	size_t stksize;
1729 	int ntries = 0;
1730 	klwp_t *lwp = ttolwp(curthread);
1731 
1732 top:
1733 	/*
1734 	 * Make sure we have everything we need (registers, etc.).
1735 	 * All other lwps have already stopped and are in an orderly state.
1736 	 */
1737 	ASSERT(p == ttoproc(curthread));
1738 	prstop(0, 0);
1739 
1740 	AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER);
1741 	nphdrs = prnsegs(as, 0) + 2;		/* two CORE note sections */
1742 
1743 	/*
1744 	 * Count the number of section headers we're going to need.
1745 	 */
1746 	nshdrs = 0;
1747 	if (content & (CC_CONTENT_CTF | CC_CONTENT_SYMTAB)) {
1748 		(void) process_scns(content, p, credp, NULL, NULL, NULL, 0,
1749 		    NULL, &nshdrs);
1750 	}
1751 	AS_LOCK_EXIT(as, &as->a_lock);
1752 
1753 	ASSERT(nshdrs == 0 || nshdrs > 1);
1754 
1755 	/*
1756 	 * The core file contents may required zero section headers, but if
1757 	 * we overflow the 16 bits allotted to the program header count in
1758 	 * the ELF header, we'll need that program header at index zero.
1759 	 */
1760 	if (nshdrs == 0 && nphdrs >= PN_XNUM)
1761 		nshdrs = 1;
1762 
1763 	phdrsz = nphdrs * sizeof (Phdr);
1764 	shdrsz = nshdrs * sizeof (Shdr);
1765 
1766 	bigsize = MAX(sizeof (*bigwad), MAX(phdrsz, shdrsz));
1767 	bigwad = kmem_alloc(bigsize, KM_SLEEP);
1768 
1769 	ehdr = &bigwad->ehdr;
1770 	bzero(ehdr, sizeof (*ehdr));
1771 
1772 	ehdr->e_ident[EI_MAG0] = ELFMAG0;
1773 	ehdr->e_ident[EI_MAG1] = ELFMAG1;
1774 	ehdr->e_ident[EI_MAG2] = ELFMAG2;
1775 	ehdr->e_ident[EI_MAG3] = ELFMAG3;
1776 	ehdr->e_ident[EI_CLASS] = ELFCLASS;
1777 	ehdr->e_type = ET_CORE;
1778 
1779 #if !defined(_LP64) || defined(_ELF32_COMPAT)
1780 
1781 #if defined(__sparc)
1782 	ehdr->e_ident[EI_DATA] = ELFDATA2MSB;
1783 	ehdr->e_machine = EM_SPARC;
1784 #elif defined(__i386) || defined(__i386_COMPAT)
1785 	ehdr->e_ident[EI_DATA] = ELFDATA2LSB;
1786 	ehdr->e_machine = EM_386;
1787 #else
1788 #error "no recognized machine type is defined"
1789 #endif
1790 
1791 #else	/* !defined(_LP64) || defined(_ELF32_COMPAT) */
1792 
1793 #if defined(__sparc)
1794 	ehdr->e_ident[EI_DATA] = ELFDATA2MSB;
1795 	ehdr->e_machine = EM_SPARCV9;
1796 #elif defined(__amd64)
1797 	ehdr->e_ident[EI_DATA] = ELFDATA2LSB;
1798 	ehdr->e_machine = EM_AMD64;
1799 #else
1800 #error "no recognized 64-bit machine type is defined"
1801 #endif
1802 
1803 #endif	/* !defined(_LP64) || defined(_ELF32_COMPAT) */
1804 
1805 	/*
1806 	 * If the count of program headers or section headers or the index
1807 	 * of the section string table can't fit in the mere 16 bits
1808 	 * shortsightedly allotted to them in the ELF header, we use the
1809 	 * extended formats and put the real values in the section header
1810 	 * as index 0.
1811 	 */
1812 	ehdr->e_version = EV_CURRENT;
1813 	ehdr->e_ehsize = sizeof (Ehdr);
1814 
1815 	if (nphdrs >= PN_XNUM)
1816 		ehdr->e_phnum = PN_XNUM;
1817 	else
1818 		ehdr->e_phnum = (unsigned short)nphdrs;
1819 
1820 	ehdr->e_phoff = sizeof (Ehdr);
1821 	ehdr->e_phentsize = sizeof (Phdr);
1822 
1823 	if (nshdrs > 0) {
1824 		if (nshdrs >= SHN_LORESERVE)
1825 			ehdr->e_shnum = 0;
1826 		else
1827 			ehdr->e_shnum = (unsigned short)nshdrs;
1828 
1829 		if (nshdrs - 1 >= SHN_LORESERVE)
1830 			ehdr->e_shstrndx = SHN_XINDEX;
1831 		else
1832 			ehdr->e_shstrndx = (unsigned short)(nshdrs - 1);
1833 
1834 		ehdr->e_shoff = ehdr->e_phoff + ehdr->e_phentsize * nphdrs;
1835 		ehdr->e_shentsize = sizeof (Shdr);
1836 	}
1837 
1838 	if (error = core_write(vp, UIO_SYSSPACE, (offset_t)0, ehdr,
1839 	    sizeof (Ehdr), rlimit, credp))
1840 		goto done;
1841 
1842 	poffset = sizeof (Ehdr);
1843 	soffset = sizeof (Ehdr) + phdrsz;
1844 	doffset = sizeof (Ehdr) + phdrsz + shdrsz;
1845 
1846 	v = &bigwad->phdr[0];
1847 	bzero(v, phdrsz);
1848 
1849 	setup_old_note_header(&v[0], p);
1850 	v[0].p_offset = doffset = roundup(doffset, sizeof (Word));
1851 	doffset += v[0].p_filesz;
1852 
1853 	setup_note_header(&v[1], p);
1854 	v[1].p_offset = doffset = roundup(doffset, sizeof (Word));
1855 	doffset += v[1].p_filesz;
1856 
1857 	mutex_enter(&p->p_lock);
1858 
1859 	brkbase = p->p_brkbase;
1860 	brksize = p->p_brksize;
1861 
1862 	stkbase = p->p_usrstack - p->p_stksize;
1863 	stksize = p->p_stksize;
1864 
1865 	mutex_exit(&p->p_lock);
1866 
1867 	AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER);
1868 	i = 2;
1869 	for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
1870 		caddr_t eaddr = seg->s_base + pr_getsegsize(seg, 0);
1871 		caddr_t saddr, naddr;
1872 		void *tmp = NULL;
1873 		extern struct seg_ops segspt_shmops;
1874 
1875 		for (saddr = seg->s_base; saddr < eaddr; saddr = naddr) {
1876 			uint_t prot;
1877 			size_t size;
1878 			int type;
1879 			vnode_t *mvp;
1880 
1881 			prot = pr_getprot(seg, 0, &tmp, &saddr, &naddr, eaddr);
1882 			prot &= PROT_READ | PROT_WRITE | PROT_EXEC;
1883 			if ((size = (size_t)(naddr - saddr)) == 0)
1884 				continue;
1885 			if (i == nphdrs) {
1886 				overflow++;
1887 				continue;
1888 			}
1889 			v[i].p_type = PT_LOAD;
1890 			v[i].p_vaddr = (Addr)(uintptr_t)saddr;
1891 			v[i].p_memsz = size;
1892 			if (prot & PROT_READ)
1893 				v[i].p_flags |= PF_R;
1894 			if (prot & PROT_WRITE)
1895 				v[i].p_flags |= PF_W;
1896 			if (prot & PROT_EXEC)
1897 				v[i].p_flags |= PF_X;
1898 
1899 			/*
1900 			 * Figure out which mappings to include in the core.
1901 			 */
1902 			type = SEGOP_GETTYPE(seg, saddr);
1903 
1904 			if (saddr == stkbase && size == stksize) {
1905 				if (!(content & CC_CONTENT_STACK))
1906 					goto exclude;
1907 
1908 			} else if (saddr == brkbase && size == brksize) {
1909 				if (!(content & CC_CONTENT_HEAP))
1910 					goto exclude;
1911 
1912 			} else if (seg->s_ops == &segspt_shmops) {
1913 				if (type & MAP_NORESERVE) {
1914 					if (!(content & CC_CONTENT_DISM))
1915 						goto exclude;
1916 				} else {
1917 					if (!(content & CC_CONTENT_ISM))
1918 						goto exclude;
1919 				}
1920 
1921 			} else if (seg->s_ops != &segvn_ops) {
1922 				goto exclude;
1923 
1924 			} else if (type & MAP_SHARED) {
1925 				if (shmgetid(p, saddr) != SHMID_NONE) {
1926 					if (!(content & CC_CONTENT_SHM))
1927 						goto exclude;
1928 
1929 				} else if (SEGOP_GETVP(seg, seg->s_base,
1930 				    &mvp) != 0 || mvp == NULL ||
1931 				    mvp->v_type != VREG) {
1932 					if (!(content & CC_CONTENT_SHANON))
1933 						goto exclude;
1934 
1935 				} else {
1936 					if (!(content & CC_CONTENT_SHFILE))
1937 						goto exclude;
1938 				}
1939 
1940 			} else if (SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 ||
1941 			    mvp == NULL || mvp->v_type != VREG) {
1942 				if (!(content & CC_CONTENT_ANON))
1943 					goto exclude;
1944 
1945 			} else if (prot == (PROT_READ | PROT_EXEC)) {
1946 				if (!(content & CC_CONTENT_TEXT))
1947 					goto exclude;
1948 
1949 			} else if (prot == PROT_READ) {
1950 				if (!(content & CC_CONTENT_RODATA))
1951 					goto exclude;
1952 
1953 			} else {
1954 				if (!(content & CC_CONTENT_DATA))
1955 					goto exclude;
1956 			}
1957 
1958 			doffset = roundup(doffset, sizeof (Word));
1959 			v[i].p_offset = doffset;
1960 			v[i].p_filesz = size;
1961 			doffset += size;
1962 exclude:
1963 			i++;
1964 		}
1965 		ASSERT(tmp == NULL);
1966 	}
1967 	AS_LOCK_EXIT(as, &as->a_lock);
1968 
1969 	if (overflow || i != nphdrs) {
1970 		if (ntries++ == 0) {
1971 			kmem_free(bigwad, bigsize);
1972 			overflow = 0;
1973 			goto top;
1974 		}
1975 		cmn_err(CE_WARN, "elfcore: core dump failed for "
1976 		    "process %d; address space is changing", p->p_pid);
1977 		error = EIO;
1978 		goto done;
1979 	}
1980 
1981 	if ((error = core_write(vp, UIO_SYSSPACE, poffset,
1982 	    v, phdrsz, rlimit, credp)) != 0)
1983 		goto done;
1984 
1985 	if ((error = write_old_elfnotes(p, sig, vp, v[0].p_offset, rlimit,
1986 	    credp)) != 0)
1987 		goto done;
1988 
1989 	if ((error = write_elfnotes(p, sig, vp, v[1].p_offset, rlimit,
1990 	    credp, content)) != 0)
1991 		goto done;
1992 
1993 	for (i = 2; i < nphdrs; i++) {
1994 		prkillinfo_t killinfo;
1995 		sigqueue_t *sq;
1996 		int sig, j;
1997 
1998 		if (v[i].p_filesz == 0)
1999 			continue;
2000 
2001 		/*
2002 		 * If dumping out this segment fails, rather than failing
2003 		 * the core dump entirely, we reset the size of the mapping
2004 		 * to zero to indicate that the data is absent from the core
2005 		 * file and or in the PF_SUNW_FAILURE flag to differentiate
2006 		 * this from mappings that were excluded due to the core file
2007 		 * content settings.
2008 		 */
2009 		if ((error = core_seg(p, vp, v[i].p_offset,
2010 		    (caddr_t)(uintptr_t)v[i].p_vaddr, v[i].p_filesz,
2011 		    rlimit, credp)) == 0) {
2012 			continue;
2013 		}
2014 
2015 		if ((sig = lwp->lwp_cursig) == 0) {
2016 			/*
2017 			 * We failed due to something other than a signal.
2018 			 * Since the space reserved for the segment is now
2019 			 * unused, we stash the errno in the first four
2020 			 * bytes. This undocumented interface will let us
2021 			 * understand the nature of the failure.
2022 			 */
2023 			(void) core_write(vp, UIO_SYSSPACE, v[i].p_offset,
2024 			    &error, sizeof (error), rlimit, credp);
2025 
2026 			v[i].p_filesz = 0;
2027 			v[i].p_flags |= PF_SUNW_FAILURE;
2028 			if ((error = core_write(vp, UIO_SYSSPACE,
2029 			    poffset + sizeof (v[i]) * i, &v[i], sizeof (v[i]),
2030 			    rlimit, credp)) != 0)
2031 				goto done;
2032 
2033 			continue;
2034 		}
2035 
2036 		/*
2037 		 * We took a signal.  We want to abort the dump entirely, but
2038 		 * we also want to indicate what failed and why.  We therefore
2039 		 * use the space reserved for the first failing segment to
2040 		 * write our error (which, for purposes of compatability with
2041 		 * older core dump readers, we set to EINTR) followed by any
2042 		 * siginfo associated with the signal.
2043 		 */
2044 		bzero(&killinfo, sizeof (killinfo));
2045 		killinfo.prk_error = EINTR;
2046 
2047 		sq = sig == SIGKILL ? curproc->p_killsqp : lwp->lwp_curinfo;
2048 
2049 		if (sq != NULL) {
2050 			bcopy(&sq->sq_info, &killinfo.prk_info,
2051 			    sizeof (sq->sq_info));
2052 		} else {
2053 			killinfo.prk_info.si_signo = lwp->lwp_cursig;
2054 			killinfo.prk_info.si_code = SI_NOINFO;
2055 		}
2056 
2057 #if (defined(_SYSCALL32_IMPL) || defined(_LP64))
2058 		/*
2059 		 * If this is a 32-bit process, we need to translate from the
2060 		 * native siginfo to the 32-bit variant.  (Core readers must
2061 		 * always have the same data model as their target or must
2062 		 * be aware of -- and compensate for -- data model differences.)
2063 		 */
2064 		if (curproc->p_model == DATAMODEL_ILP32) {
2065 			siginfo32_t si32;
2066 
2067 			siginfo_kto32((k_siginfo_t *)&killinfo.prk_info, &si32);
2068 			bcopy(&si32, &killinfo.prk_info, sizeof (si32));
2069 		}
2070 #endif
2071 
2072 		(void) core_write(vp, UIO_SYSSPACE, v[i].p_offset,
2073 		    &killinfo, sizeof (killinfo), rlimit, credp);
2074 
2075 		/*
2076 		 * For the segment on which we took the signal, indicate that
2077 		 * its data now refers to a siginfo.
2078 		 */
2079 		v[i].p_filesz = 0;
2080 		v[i].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED |
2081 		    PF_SUNW_SIGINFO;
2082 
2083 		/*
2084 		 * And for every other segment, indicate that its absence
2085 		 * is due to a signal.
2086 		 */
2087 		for (j = i + 1; j < nphdrs; j++) {
2088 			v[j].p_filesz = 0;
2089 			v[j].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED;
2090 		}
2091 
2092 		/*
2093 		 * Finally, write out our modified program headers.
2094 		 */
2095 		if ((error = core_write(vp, UIO_SYSSPACE,
2096 		    poffset + sizeof (v[i]) * i, &v[i],
2097 		    sizeof (v[i]) * (nphdrs - i), rlimit, credp)) != 0)
2098 			goto done;
2099 
2100 		break;
2101 	}
2102 
2103 	if (nshdrs > 0) {
2104 		bzero(&bigwad->shdr[0], shdrsz);
2105 
2106 		if (nshdrs >= SHN_LORESERVE)
2107 			bigwad->shdr[0].sh_size = nshdrs;
2108 
2109 		if (nshdrs - 1 >= SHN_LORESERVE)
2110 			bigwad->shdr[0].sh_link = nshdrs - 1;
2111 
2112 		if (nphdrs >= PN_XNUM)
2113 			bigwad->shdr[0].sh_info = nphdrs;
2114 
2115 		if (nshdrs > 1) {
2116 			AS_LOCK_ENTER(as, &as->a_lock, RW_WRITER);
2117 			if ((error = process_scns(content, p, credp, vp,
2118 			    &bigwad->shdr[0], nshdrs, rlimit, &doffset,
2119 			    NULL)) != 0) {
2120 				AS_LOCK_EXIT(as, &as->a_lock);
2121 				goto done;
2122 			}
2123 			AS_LOCK_EXIT(as, &as->a_lock);
2124 		}
2125 
2126 		if ((error = core_write(vp, UIO_SYSSPACE, soffset,
2127 		    &bigwad->shdr[0], shdrsz, rlimit, credp)) != 0)
2128 			goto done;
2129 	}
2130 
2131 done:
2132 	kmem_free(bigwad, bigsize);
2133 	return (error);
2134 }
2135 
2136 #ifndef	_ELF32_COMPAT
2137 
2138 static struct execsw esw = {
2139 #ifdef	_LP64
2140 	elf64magicstr,
2141 #else	/* _LP64 */
2142 	elf32magicstr,
2143 #endif	/* _LP64 */
2144 	0,
2145 	5,
2146 	elfexec,
2147 	elfcore
2148 };
2149 
2150 static struct modlexec modlexec = {
2151 	&mod_execops, "exec module for elf", &esw
2152 };
2153 
2154 #ifdef	_LP64
2155 extern int elf32exec(vnode_t *vp, execa_t *uap, uarg_t *args,
2156 			intpdata_t *idatap, int level, long *execsz,
2157 			int setid, caddr_t exec_file, cred_t *cred,
2158 			int brand_action);
2159 extern int elf32core(vnode_t *vp, proc_t *p, cred_t *credp,
2160 			rlim64_t rlimit, int sig, core_content_t content);
2161 
2162 static struct execsw esw32 = {
2163 	elf32magicstr,
2164 	0,
2165 	5,
2166 	elf32exec,
2167 	elf32core
2168 };
2169 
2170 static struct modlexec modlexec32 = {
2171 	&mod_execops, "32-bit exec module for elf", &esw32
2172 };
2173 #endif	/* _LP64 */
2174 
2175 static struct modlinkage modlinkage = {
2176 	MODREV_1,
2177 	(void *)&modlexec,
2178 #ifdef	_LP64
2179 	(void *)&modlexec32,
2180 #endif	/* _LP64 */
2181 	NULL
2182 };
2183 
2184 int
2185 _init(void)
2186 {
2187 	return (mod_install(&modlinkage));
2188 }
2189 
2190 int
2191 _fini(void)
2192 {
2193 	return (mod_remove(&modlinkage));
2194 }
2195 
2196 int
2197 _info(struct modinfo *modinfop)
2198 {
2199 	return (mod_info(&modlinkage, modinfop));
2200 }
2201 
2202 #endif	/* !_ELF32_COMPAT */
2203