1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22/*
23 * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
24 */
25
26/*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
27/*	   All Rights Reserved	*/
28/*
29 * Copyright (c) 2019, Joyent, Inc.
30 */
31
32#include <sys/types.h>
33#include <sys/param.h>
34#include <sys/thread.h>
35#include <sys/sysmacros.h>
36#include <sys/signal.h>
37#include <sys/cred.h>
38#include <sys/user.h>
39#include <sys/errno.h>
40#include <sys/vnode.h>
41#include <sys/mman.h>
42#include <sys/kmem.h>
43#include <sys/proc.h>
44#include <sys/pathname.h>
45#include <sys/policy.h>
46#include <sys/cmn_err.h>
47#include <sys/systm.h>
48#include <sys/elf.h>
49#include <sys/vmsystm.h>
50#include <sys/debug.h>
51#include <sys/auxv.h>
52#include <sys/exec.h>
53#include <sys/prsystm.h>
54#include <vm/as.h>
55#include <vm/rm.h>
56#include <vm/seg.h>
57#include <vm/seg_vn.h>
58#include <sys/modctl.h>
59#include <sys/systeminfo.h>
60#include <sys/vmparam.h>
61#include <sys/machelf.h>
62#include <sys/shm_impl.h>
63#include <sys/archsystm.h>
64#include <sys/fasttrap.h>
65#include <sys/brand.h>
66#include "elf_impl.h"
67#include <sys/sdt.h>
68#include <sys/siginfo.h>
69#include <sys/random.h>
70
71#if defined(__x86)
72#include <sys/comm_page_util.h>
73#include <sys/fp.h>
74#endif /* defined(__x86) */
75
76
77extern int at_flags;
78extern volatile size_t aslr_max_brk_skew;
79
80#define	ORIGIN_STR	"ORIGIN"
81#define	ORIGIN_STR_SIZE	6
82
83static int getelfhead(vnode_t *, cred_t *, Ehdr *, int *, int *, int *);
84static int getelfphdr(vnode_t *, cred_t *, const Ehdr *, int, caddr_t *,
85    ssize_t *);
86static int getelfshdr(vnode_t *, cred_t *, const Ehdr *, int, int, caddr_t *,
87    ssize_t *, caddr_t *, ssize_t *);
88static size_t elfsize(Ehdr *, int, caddr_t, uintptr_t *);
89static int mapelfexec(vnode_t *, Ehdr *, int, caddr_t,
90    Phdr **, Phdr **, Phdr **, Phdr **, Phdr *,
91    caddr_t *, caddr_t *, intptr_t *, intptr_t *, size_t, long *, size_t *);
92
93typedef enum {
94	STR_CTF,
95	STR_SYMTAB,
96	STR_DYNSYM,
97	STR_STRTAB,
98	STR_DYNSTR,
99	STR_SHSTRTAB,
100	STR_NUM
101} shstrtype_t;
102
103static const char *shstrtab_data[] = {
104	".SUNW_ctf",
105	".symtab",
106	".dynsym",
107	".strtab",
108	".dynstr",
109	".shstrtab"
110};
111
112typedef struct shstrtab {
113	int	sst_ndx[STR_NUM];
114	int	sst_cur;
115} shstrtab_t;
116
117static void
118shstrtab_init(shstrtab_t *s)
119{
120	bzero(&s->sst_ndx, sizeof (s->sst_ndx));
121	s->sst_cur = 1;
122}
123
124static int
125shstrtab_ndx(shstrtab_t *s, shstrtype_t type)
126{
127	int ret;
128
129	if ((ret = s->sst_ndx[type]) != 0)
130		return (ret);
131
132	ret = s->sst_ndx[type] = s->sst_cur;
133	s->sst_cur += strlen(shstrtab_data[type]) + 1;
134
135	return (ret);
136}
137
138static size_t
139shstrtab_size(const shstrtab_t *s)
140{
141	return (s->sst_cur);
142}
143
144static void
145shstrtab_dump(const shstrtab_t *s, char *buf)
146{
147	int i, ndx;
148
149	*buf = '\0';
150	for (i = 0; i < STR_NUM; i++) {
151		if ((ndx = s->sst_ndx[i]) != 0)
152			(void) strcpy(buf + ndx, shstrtab_data[i]);
153	}
154}
155
156static int
157dtrace_safe_phdr(Phdr *phdrp, struct uarg *args, uintptr_t base)
158{
159	ASSERT(phdrp->p_type == PT_SUNWDTRACE);
160
161	/*
162	 * See the comment in fasttrap.h for information on how to safely
163	 * update this program header.
164	 */
165	if (phdrp->p_memsz < PT_SUNWDTRACE_SIZE ||
166	    (phdrp->p_flags & (PF_R | PF_W | PF_X)) != (PF_R | PF_W | PF_X))
167		return (-1);
168
169	args->thrptr = phdrp->p_vaddr + base;
170
171	return (0);
172}
173
174static int
175handle_secflag_dt(proc_t *p, uint_t dt, uint_t val)
176{
177	uint_t flag;
178
179	switch (dt) {
180	case DT_SUNW_ASLR:
181		flag = PROC_SEC_ASLR;
182		break;
183	default:
184		return (EINVAL);
185	}
186
187	if (val == 0) {
188		if (secflag_isset(p->p_secflags.psf_lower, flag))
189			return (EPERM);
190		if ((secpolicy_psecflags(CRED(), p, p) != 0) &&
191		    secflag_isset(p->p_secflags.psf_inherit, flag))
192			return (EPERM);
193
194		secflag_clear(&p->p_secflags.psf_effective, flag);
195	} else {
196		if (!secflag_isset(p->p_secflags.psf_upper, flag))
197			return (EPERM);
198
199		if ((secpolicy_psecflags(CRED(), p, p) != 0) &&
200		    !secflag_isset(p->p_secflags.psf_inherit, flag))
201			return (EPERM);
202
203		secflag_set(&p->p_secflags.psf_effective, flag);
204	}
205
206	return (0);
207}
208
209/*
210 * Map in the executable pointed to by vp. Returns 0 on success.
211 */
212int
213mapexec_brand(vnode_t *vp, uarg_t *args, Ehdr *ehdr, Addr *uphdr_vaddr,
214    intptr_t *voffset, caddr_t exec_file, int *interp, caddr_t *bssbase,
215    caddr_t *brkbase, size_t *brksize, uintptr_t *lddatap)
216{
217	size_t		len;
218	struct vattr	vat;
219	caddr_t		phdrbase = NULL;
220	ssize_t		phdrsize;
221	int		nshdrs, shstrndx, nphdrs;
222	int		error = 0;
223	Phdr		*uphdr = NULL;
224	Phdr		*junk = NULL;
225	Phdr		*dynphdr = NULL;
226	Phdr		*dtrphdr = NULL;
227	uintptr_t	lddata;
228	long		execsz;
229	intptr_t	minaddr;
230
231	if (lddatap != NULL)
232		*lddatap = 0;
233
234	if (error = execpermissions(vp, &vat, args)) {
235		uprintf("%s: Cannot execute %s\n", exec_file, args->pathname);
236		return (error);
237	}
238
239	if ((error = getelfhead(vp, CRED(), ehdr, &nshdrs, &shstrndx,
240	    &nphdrs)) != 0 ||
241	    (error = getelfphdr(vp, CRED(), ehdr, nphdrs, &phdrbase,
242	    &phdrsize)) != 0) {
243		uprintf("%s: Cannot read %s\n", exec_file, args->pathname);
244		return (error);
245	}
246
247	if ((len = elfsize(ehdr, nphdrs, phdrbase, &lddata)) == 0) {
248		uprintf("%s: Nothing to load in %s", exec_file, args->pathname);
249		kmem_free(phdrbase, phdrsize);
250		return (ENOEXEC);
251	}
252	if (lddatap != NULL)
253		*lddatap = lddata;
254
255	if (error = mapelfexec(vp, ehdr, nphdrs, phdrbase, &uphdr, &dynphdr,
256	    &junk, &dtrphdr, NULL, bssbase, brkbase, voffset, &minaddr,
257	    len, &execsz, brksize)) {
258		uprintf("%s: Cannot map %s\n", exec_file, args->pathname);
259		kmem_free(phdrbase, phdrsize);
260		return (error);
261	}
262
263	/*
264	 * Inform our caller if the executable needs an interpreter.
265	 */
266	*interp = (dynphdr == NULL) ? 0 : 1;
267
268	/*
269	 * If this is a statically linked executable, voffset should indicate
270	 * the address of the executable itself (it normally holds the address
271	 * of the interpreter).
272	 */
273	if (ehdr->e_type == ET_EXEC && *interp == 0)
274		*voffset = minaddr;
275
276	if (uphdr != NULL) {
277		*uphdr_vaddr = uphdr->p_vaddr;
278	} else {
279		*uphdr_vaddr = (Addr)-1;
280	}
281
282	kmem_free(phdrbase, phdrsize);
283	return (error);
284}
285
286/*ARGSUSED*/
287int
288elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
289    int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred,
290    int brand_action)
291{
292	caddr_t		phdrbase = NULL;
293	caddr_t		bssbase = 0;
294	caddr_t		brkbase = 0;
295	size_t		brksize = 0;
296	ssize_t		dlnsize;
297	aux_entry_t	*aux;
298	int		error;
299	ssize_t		resid;
300	int		fd = -1;
301	intptr_t	voffset;
302	Phdr		*intphdr = NULL;
303	Phdr		*dynamicphdr = NULL;
304	Phdr		*stphdr = NULL;
305	Phdr		*uphdr = NULL;
306	Phdr		*junk = NULL;
307	size_t		len;
308	size_t		i;
309	ssize_t		phdrsize;
310	int		postfixsize = 0;
311	int		hsize;
312	Phdr		*phdrp;
313	Phdr		*dataphdrp = NULL;
314	Phdr		*dtrphdr;
315	Phdr		*capphdr = NULL;
316	Cap		*cap = NULL;
317	ssize_t		capsize;
318	int		hasu = 0;
319	int		hasauxv = 0;
320	int		hasintp = 0;
321	int		branded = 0;
322
323	struct proc *p = ttoproc(curthread);
324	struct user *up = PTOU(p);
325	struct bigwad {
326		Ehdr	ehdr;
327		aux_entry_t	elfargs[__KERN_NAUXV_IMPL];
328		char		dl_name[MAXPATHLEN];
329		char		pathbuf[MAXPATHLEN];
330		struct vattr	vattr;
331		struct execenv	exenv;
332	} *bigwad;	/* kmem_alloc this behemoth so we don't blow stack */
333	Ehdr		*ehdrp;
334	int		nshdrs, shstrndx, nphdrs;
335	char		*dlnp;
336	char		*pathbufp;
337	rlim64_t	limit;
338	rlim64_t	roundlimit;
339
340	ASSERT(p->p_model == DATAMODEL_ILP32 || p->p_model == DATAMODEL_LP64);
341
342	bigwad = kmem_alloc(sizeof (struct bigwad), KM_SLEEP);
343	ehdrp = &bigwad->ehdr;
344	dlnp = bigwad->dl_name;
345	pathbufp = bigwad->pathbuf;
346
347	/*
348	 * Obtain ELF and program header information.
349	 */
350	if ((error = getelfhead(vp, CRED(), ehdrp, &nshdrs, &shstrndx,
351	    &nphdrs)) != 0 ||
352	    (error = getelfphdr(vp, CRED(), ehdrp, nphdrs, &phdrbase,
353	    &phdrsize)) != 0)
354		goto out;
355
356	/*
357	 * Prevent executing an ELF file that has no entry point.
358	 */
359	if (ehdrp->e_entry == 0) {
360		uprintf("%s: Bad entry point\n", exec_file);
361		goto bad;
362	}
363
364	/*
365	 * Put data model that we're exec-ing to into the args passed to
366	 * exec_args(), so it will know what it is copying to on new stack.
367	 * Now that we know whether we are exec-ing a 32-bit or 64-bit
368	 * executable, we can set execsz with the appropriate NCARGS.
369	 */
370#ifdef	_LP64
371	if (ehdrp->e_ident[EI_CLASS] == ELFCLASS32) {
372		args->to_model = DATAMODEL_ILP32;
373		*execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS32-1);
374	} else {
375		args->to_model = DATAMODEL_LP64;
376		args->stk_prot &= ~PROT_EXEC;
377#if defined(__i386) || defined(__amd64)
378		args->dat_prot &= ~PROT_EXEC;
379#endif
380		*execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS64-1);
381	}
382#else	/* _LP64 */
383	args->to_model = DATAMODEL_ILP32;
384	*execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS-1);
385#endif	/* _LP64 */
386
387	/*
388	 * We delay invoking the brand callback until we've figured out
389	 * what kind of elf binary we're trying to run, 32-bit or 64-bit.
390	 * We do this because now the brand library can just check
391	 * args->to_model to see if the target is 32-bit or 64-bit without
392	 * having do duplicate all the code above.
393	 *
394	 * The level checks associated with brand handling below are used to
395	 * prevent a loop since the brand elfexec function typically comes back
396	 * through this function. We must check <= here since the nested
397	 * handling in the #! interpreter code will increment the level before
398	 * calling gexec to run the final elfexec interpreter.
399	 */
400	if ((level <= INTP_MAXDEPTH) &&
401	    (brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
402		error = BROP(p)->b_elfexec(vp, uap, args,
403		    idatap, level + 1, execsz, setid, exec_file, cred,
404		    brand_action);
405		goto out;
406	}
407
408	/*
409	 * Determine aux size now so that stack can be built
410	 * in one shot (except actual copyout of aux image),
411	 * determine any non-default stack protections,
412	 * and still have this code be machine independent.
413	 */
414	hsize = ehdrp->e_phentsize;
415	phdrp = (Phdr *)phdrbase;
416	for (i = nphdrs; i > 0; i--) {
417		switch (phdrp->p_type) {
418		case PT_INTERP:
419			hasauxv = hasintp = 1;
420			break;
421		case PT_PHDR:
422			hasu = 1;
423			break;
424		case PT_SUNWSTACK:
425			args->stk_prot = PROT_USER;
426			if (phdrp->p_flags & PF_R)
427				args->stk_prot |= PROT_READ;
428			if (phdrp->p_flags & PF_W)
429				args->stk_prot |= PROT_WRITE;
430			if (phdrp->p_flags & PF_X)
431				args->stk_prot |= PROT_EXEC;
432			break;
433		case PT_LOAD:
434			dataphdrp = phdrp;
435			break;
436		case PT_SUNWCAP:
437			capphdr = phdrp;
438			break;
439		case PT_DYNAMIC:
440			dynamicphdr = phdrp;
441			break;
442		}
443		phdrp = (Phdr *)((caddr_t)phdrp + hsize);
444	}
445
446	if (ehdrp->e_type != ET_EXEC) {
447		dataphdrp = NULL;
448		hasauxv = 1;
449	}
450
451	/* Copy BSS permissions to args->dat_prot */
452	if (dataphdrp != NULL) {
453		args->dat_prot = PROT_USER;
454		if (dataphdrp->p_flags & PF_R)
455			args->dat_prot |= PROT_READ;
456		if (dataphdrp->p_flags & PF_W)
457			args->dat_prot |= PROT_WRITE;
458		if (dataphdrp->p_flags & PF_X)
459			args->dat_prot |= PROT_EXEC;
460	}
461
462	/*
463	 * If a auxvector will be required - reserve the space for
464	 * it now.  This may be increased by exec_args if there are
465	 * ISA-specific types (included in __KERN_NAUXV_IMPL).
466	 */
467	if (hasauxv) {
468		/*
469		 * If a AUX vector is being built - the base AUX
470		 * entries are:
471		 *
472		 *	AT_BASE
473		 *	AT_FLAGS
474		 *	AT_PAGESZ
475		 *	AT_SUN_AUXFLAGS
476		 *	AT_SUN_HWCAP
477		 *	AT_SUN_HWCAP2
478		 *	AT_SUN_PLATFORM (added in stk_copyout)
479		 *	AT_SUN_EXECNAME (added in stk_copyout)
480		 *	AT_NULL
481		 *
482		 * total == 9
483		 */
484		if (hasintp && hasu) {
485			/*
486			 * Has PT_INTERP & PT_PHDR - the auxvectors that
487			 * will be built are:
488			 *
489			 *	AT_PHDR
490			 *	AT_PHENT
491			 *	AT_PHNUM
492			 *	AT_ENTRY
493			 *	AT_LDDATA
494			 *
495			 * total = 5
496			 */
497			args->auxsize = (9 + 5) * sizeof (aux_entry_t);
498		} else if (hasintp) {
499			/*
500			 * Has PT_INTERP but no PT_PHDR
501			 *
502			 *	AT_EXECFD
503			 *	AT_LDDATA
504			 *
505			 * total = 2
506			 */
507			args->auxsize = (9 + 2) * sizeof (aux_entry_t);
508		} else {
509			args->auxsize = 9 * sizeof (aux_entry_t);
510		}
511	} else {
512		args->auxsize = 0;
513	}
514
515	/*
516	 * If this binary is using an emulator, we need to add an
517	 * AT_SUN_EMULATOR aux entry.
518	 */
519	if (args->emulator != NULL)
520		args->auxsize += sizeof (aux_entry_t);
521
522	/*
523	 * On supported kernels (x86_64) make room in the auxv for the
524	 * AT_SUN_COMMPAGE entry.  This will go unpopulated on i86xpv systems
525	 * which do not provide such functionality.
526	 *
527	 * Additionally cover the floating point information AT_SUN_FPSIZE and
528	 * AT_SUN_FPTYPE.
529	 */
530#if defined(__amd64)
531	args->auxsize += 3 * sizeof (aux_entry_t);
532#endif /* defined(__amd64) */
533
534	if ((brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
535		branded = 1;
536		/*
537		 * We will be adding 4 entries to the aux vectors.  One for
538		 * the the brandname and 3 for the brand specific aux vectors.
539		 */
540		args->auxsize += 4 * sizeof (aux_entry_t);
541	}
542
543	/* If the binary has an explicit ASLR flag, it must be honoured */
544	if ((dynamicphdr != NULL) && (dynamicphdr->p_filesz > 0)) {
545		const size_t dynfilesz = dynamicphdr->p_filesz;
546		const size_t dynoffset = dynamicphdr->p_offset;
547		Dyn *dyn, *dp;
548
549		if (dynoffset > MAXOFFSET_T ||
550		    dynfilesz > MAXOFFSET_T ||
551		    dynoffset + dynfilesz > MAXOFFSET_T) {
552			uprintf("%s: cannot read full .dynamic section\n",
553			    exec_file);
554			error = EINVAL;
555			goto out;
556		}
557
558#define	DYN_STRIDE	100
559		for (i = 0; i < dynfilesz; i += sizeof (*dyn) * DYN_STRIDE) {
560			const size_t remdyns = (dynfilesz - i) / sizeof (*dyn);
561			const size_t ndyns = MIN(DYN_STRIDE, remdyns);
562			const size_t dynsize = ndyns * sizeof (*dyn);
563
564			dyn = kmem_alloc(dynsize, KM_SLEEP);
565
566			if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)dyn,
567			    (ssize_t)dynsize, (offset_t)(dynoffset + i),
568			    UIO_SYSSPACE, 0, (rlim64_t)0,
569			    CRED(), &resid)) != 0) {
570				uprintf("%s: cannot read .dynamic section\n",
571				    exec_file);
572				goto out;
573			}
574
575			for (dp = dyn; dp < (dyn + ndyns); dp++) {
576				if (dp->d_tag == DT_SUNW_ASLR) {
577					if ((error = handle_secflag_dt(p,
578					    DT_SUNW_ASLR,
579					    dp->d_un.d_val)) != 0) {
580						uprintf("%s: error setting "
581						    "security-flag from "
582						    "DT_SUNW_ASLR: %d\n",
583						    exec_file, error);
584						goto out;
585					}
586				}
587			}
588
589			kmem_free(dyn, dynsize);
590		}
591	}
592
593	/* Hardware/Software capabilities */
594	if (capphdr != NULL &&
595	    (capsize = capphdr->p_filesz) > 0 &&
596	    capsize <= 16 * sizeof (*cap)) {
597		int ncaps = capsize / sizeof (*cap);
598		Cap *cp;
599
600		cap = kmem_alloc(capsize, KM_SLEEP);
601		if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)cap,
602		    capsize, (offset_t)capphdr->p_offset,
603		    UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid)) != 0) {
604			uprintf("%s: Cannot read capabilities section\n",
605			    exec_file);
606			goto out;
607		}
608		for (cp = cap; cp < cap + ncaps; cp++) {
609			if (cp->c_tag == CA_SUNW_SF_1 &&
610			    (cp->c_un.c_val & SF1_SUNW_ADDR32)) {
611				if (args->to_model == DATAMODEL_LP64)
612					args->addr32 = 1;
613				break;
614			}
615		}
616	}
617
618	aux = bigwad->elfargs;
619	/*
620	 * Move args to the user's stack.
621	 * This can fill in the AT_SUN_PLATFORM and AT_SUN_EXECNAME aux entries.
622	 */
623	if ((error = exec_args(uap, args, idatap, (void **)&aux)) != 0) {
624		if (error == -1) {
625			error = ENOEXEC;
626			goto bad;
627		}
628		goto out;
629	}
630	/* we're single threaded after this point */
631
632	/*
633	 * If this is an ET_DYN executable (shared object),
634	 * determine its memory size so that mapelfexec() can load it.
635	 */
636	if (ehdrp->e_type == ET_DYN)
637		len = elfsize(ehdrp, nphdrs, phdrbase, NULL);
638	else
639		len = 0;
640
641	dtrphdr = NULL;
642
643	if ((error = mapelfexec(vp, ehdrp, nphdrs, phdrbase, &uphdr, &intphdr,
644	    &stphdr, &dtrphdr, dataphdrp, &bssbase, &brkbase, &voffset, NULL,
645	    len, execsz, &brksize)) != 0)
646		goto bad;
647
648	if (uphdr != NULL && intphdr == NULL)
649		goto bad;
650
651	if (dtrphdr != NULL && dtrace_safe_phdr(dtrphdr, args, voffset) != 0) {
652		uprintf("%s: Bad DTrace phdr in %s\n", exec_file, exec_file);
653		goto bad;
654	}
655
656	if (intphdr != NULL) {
657		size_t		len;
658		uintptr_t	lddata;
659		char		*p;
660		struct vnode	*nvp;
661
662		dlnsize = intphdr->p_filesz;
663
664		if (dlnsize > MAXPATHLEN || dlnsize <= 0)
665			goto bad;
666
667		/*
668		 * Read in "interpreter" pathname.
669		 */
670		if ((error = vn_rdwr(UIO_READ, vp, dlnp, intphdr->p_filesz,
671		    (offset_t)intphdr->p_offset, UIO_SYSSPACE, 0, (rlim64_t)0,
672		    CRED(), &resid)) != 0) {
673			uprintf("%s: Cannot obtain interpreter pathname\n",
674			    exec_file);
675			goto bad;
676		}
677
678		if (resid != 0 || dlnp[dlnsize - 1] != '\0')
679			goto bad;
680
681		/*
682		 * Search for '$ORIGIN' token in interpreter path.
683		 * If found, expand it.
684		 */
685		for (p = dlnp; p = strchr(p, '$'); ) {
686			uint_t	len, curlen;
687			char	*_ptr;
688
689			if (strncmp(++p, ORIGIN_STR, ORIGIN_STR_SIZE))
690				continue;
691
692			/*
693			 * We don't support $ORIGIN on setid programs to close
694			 * a potential attack vector.
695			 */
696			if ((setid & EXECSETID_SETID) != 0) {
697				error = ENOEXEC;
698				goto bad;
699			}
700
701			curlen = 0;
702			len = p - dlnp - 1;
703			if (len) {
704				bcopy(dlnp, pathbufp, len);
705				curlen += len;
706			}
707			if (_ptr = strrchr(args->pathname, '/')) {
708				len = _ptr - args->pathname;
709				if ((curlen + len) > MAXPATHLEN)
710					break;
711
712				bcopy(args->pathname, &pathbufp[curlen], len);
713				curlen += len;
714			} else {
715				/*
716				 * executable is a basename found in the
717				 * current directory.  So - just substitue
718				 * '.' for ORIGIN.
719				 */
720				pathbufp[curlen] = '.';
721				curlen++;
722			}
723			p += ORIGIN_STR_SIZE;
724			len = strlen(p);
725
726			if ((curlen + len) > MAXPATHLEN)
727				break;
728			bcopy(p, &pathbufp[curlen], len);
729			curlen += len;
730			pathbufp[curlen++] = '\0';
731			bcopy(pathbufp, dlnp, curlen);
732		}
733
734		/*
735		 * /usr/lib/ld.so.1 is known to be a symlink to /lib/ld.so.1
736		 * (and /usr/lib/64/ld.so.1 is a symlink to /lib/64/ld.so.1).
737		 * Just in case /usr is not mounted, change it now.
738		 */
739		if (strcmp(dlnp, USR_LIB_RTLD) == 0)
740			dlnp += 4;
741		error = lookupname(dlnp, UIO_SYSSPACE, FOLLOW, NULLVPP, &nvp);
742		if (error && dlnp != bigwad->dl_name) {
743			/* new kernel, old user-level */
744			error = lookupname(dlnp -= 4, UIO_SYSSPACE, FOLLOW,
745			    NULLVPP, &nvp);
746		}
747		if (error) {
748			uprintf("%s: Cannot find %s\n", exec_file, dlnp);
749			goto bad;
750		}
751
752		/*
753		 * Setup the "aux" vector.
754		 */
755		if (uphdr) {
756			if (ehdrp->e_type == ET_DYN) {
757				/* don't use the first page */
758				bigwad->exenv.ex_brkbase = (caddr_t)PAGESIZE;
759				bigwad->exenv.ex_bssbase = (caddr_t)PAGESIZE;
760			} else {
761				bigwad->exenv.ex_bssbase = bssbase;
762				bigwad->exenv.ex_brkbase = brkbase;
763			}
764			bigwad->exenv.ex_brksize = brksize;
765			bigwad->exenv.ex_magic = elfmagic;
766			bigwad->exenv.ex_vp = vp;
767			setexecenv(&bigwad->exenv);
768
769			ADDAUX(aux, AT_PHDR, uphdr->p_vaddr + voffset)
770			ADDAUX(aux, AT_PHENT, ehdrp->e_phentsize)
771			ADDAUX(aux, AT_PHNUM, nphdrs)
772			ADDAUX(aux, AT_ENTRY, ehdrp->e_entry + voffset)
773		} else {
774			if ((error = execopen(&vp, &fd)) != 0) {
775				VN_RELE(nvp);
776				goto bad;
777			}
778
779			ADDAUX(aux, AT_EXECFD, fd)
780		}
781
782		if ((error = execpermissions(nvp, &bigwad->vattr, args)) != 0) {
783			VN_RELE(nvp);
784			uprintf("%s: Cannot execute %s\n", exec_file, dlnp);
785			goto bad;
786		}
787
788		/*
789		 * Now obtain the ELF header along with the entire program
790		 * header contained in "nvp".
791		 */
792		kmem_free(phdrbase, phdrsize);
793		phdrbase = NULL;
794		if ((error = getelfhead(nvp, CRED(), ehdrp, &nshdrs,
795		    &shstrndx, &nphdrs)) != 0 ||
796		    (error = getelfphdr(nvp, CRED(), ehdrp, nphdrs, &phdrbase,
797		    &phdrsize)) != 0) {
798			VN_RELE(nvp);
799			uprintf("%s: Cannot read %s\n", exec_file, dlnp);
800			goto bad;
801		}
802
803		/*
804		 * Determine memory size of the "interpreter's" loadable
805		 * sections.  This size is then used to obtain the virtual
806		 * address of a hole, in the user's address space, large
807		 * enough to map the "interpreter".
808		 */
809		if ((len = elfsize(ehdrp, nphdrs, phdrbase, &lddata)) == 0) {
810			VN_RELE(nvp);
811			uprintf("%s: Nothing to load in %s\n", exec_file, dlnp);
812			goto bad;
813		}
814
815		dtrphdr = NULL;
816
817		error = mapelfexec(nvp, ehdrp, nphdrs, phdrbase, &junk, &junk,
818		    &junk, &dtrphdr, NULL, NULL, NULL, &voffset, NULL, len,
819		    execsz, NULL);
820		if (error || junk != NULL) {
821			VN_RELE(nvp);
822			uprintf("%s: Cannot map %s\n", exec_file, dlnp);
823			goto bad;
824		}
825
826		/*
827		 * We use the DTrace program header to initialize the
828		 * architecture-specific user per-LWP location. The dtrace
829		 * fasttrap provider requires ready access to per-LWP scratch
830		 * space. We assume that there is only one such program header
831		 * in the interpreter.
832		 */
833		if (dtrphdr != NULL &&
834		    dtrace_safe_phdr(dtrphdr, args, voffset) != 0) {
835			VN_RELE(nvp);
836			uprintf("%s: Bad DTrace phdr in %s\n", exec_file, dlnp);
837			goto bad;
838		}
839
840		VN_RELE(nvp);
841		ADDAUX(aux, AT_SUN_LDDATA, voffset + lddata)
842	}
843
844	if (hasauxv) {
845		int auxf = AF_SUN_HWCAPVERIFY;
846#if defined(__amd64)
847		size_t fpsize;
848		int fptype;
849#endif /* defined(__amd64) */
850
851		/*
852		 * Note: AT_SUN_PLATFORM and AT_SUN_EXECNAME were filled in via
853		 * exec_args()
854		 */
855		ADDAUX(aux, AT_BASE, voffset)
856		ADDAUX(aux, AT_FLAGS, at_flags)
857		ADDAUX(aux, AT_PAGESZ, PAGESIZE)
858		/*
859		 * Linker flags. (security)
860		 * p_flag not yet set at this time.
861		 * We rely on gexec() to provide us with the information.
862		 * If the application is set-uid but this is not reflected
863		 * in a mismatch between real/effective uids/gids, then
864		 * don't treat this as a set-uid exec.  So we care about
865		 * the EXECSETID_UGIDS flag but not the ...SETID flag.
866		 */
867		if ((setid &= ~EXECSETID_SETID) != 0)
868			auxf |= AF_SUN_SETUGID;
869
870		/*
871		 * If we're running a native process from within a branded
872		 * zone under pfexec then we clear the AF_SUN_SETUGID flag so
873		 * that the native ld.so.1 is able to link with the native
874		 * libraries instead of using the brand libraries that are
875		 * installed in the zone.  We only do this for processes
876		 * which we trust because we see they are already running
877		 * under pfexec (where uid != euid).  This prevents a
878		 * malicious user within the zone from crafting a wrapper to
879		 * run native suid commands with unsecure libraries interposed.
880		 */
881		if ((brand_action == EBA_NATIVE) && (PROC_IS_BRANDED(p) &&
882		    (setid &= ~EXECSETID_SETID) != 0))
883			auxf &= ~AF_SUN_SETUGID;
884
885		/*
886		 * Record the user addr of the auxflags aux vector entry
887		 * since brands may optionally want to manipulate this field.
888		 */
889		args->auxp_auxflags =
890		    (char *)((char *)args->stackend +
891		    ((char *)&aux->a_type -
892		    (char *)bigwad->elfargs));
893		ADDAUX(aux, AT_SUN_AUXFLAGS, auxf);
894
895		/*
896		 * Hardware capability flag word (performance hints)
897		 * Used for choosing faster library routines.
898		 * (Potentially different between 32-bit and 64-bit ABIs)
899		 */
900#if defined(_LP64)
901		if (args->to_model == DATAMODEL_NATIVE) {
902			ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap)
903			ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2)
904		} else {
905			ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap32)
906			ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap32_2)
907		}
908#else
909		ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap)
910		ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2)
911#endif
912		if (branded) {
913			/*
914			 * Reserve space for the brand-private aux vectors,
915			 * and record the user addr of that space.
916			 */
917			args->auxp_brand =
918			    (char *)((char *)args->stackend +
919			    ((char *)&aux->a_type -
920			    (char *)bigwad->elfargs));
921			ADDAUX(aux, AT_SUN_BRAND_AUX1, 0)
922			ADDAUX(aux, AT_SUN_BRAND_AUX2, 0)
923			ADDAUX(aux, AT_SUN_BRAND_AUX3, 0)
924		}
925
926		/*
927		 * Add the comm page auxv entry, mapping it in if needed. Also
928		 * take care of the FPU entries.
929		 */
930#if defined(__amd64)
931		if (args->commpage != (uintptr_t)NULL ||
932		    (args->commpage = (uintptr_t)comm_page_mapin()) !=
933		    (uintptr_t)NULL) {
934			ADDAUX(aux, AT_SUN_COMMPAGE, args->commpage)
935		} else {
936			/*
937			 * If the comm page cannot be mapped, pad out the auxv
938			 * to satisfy later size checks.
939			 */
940			ADDAUX(aux, AT_NULL, 0)
941		}
942
943		fptype = AT_386_FPINFO_NONE;
944		fpu_auxv_info(&fptype, &fpsize);
945		if (fptype != AT_386_FPINFO_NONE) {
946			ADDAUX(aux, AT_SUN_FPTYPE, fptype)
947			ADDAUX(aux, AT_SUN_FPSIZE, fpsize)
948		} else {
949			ADDAUX(aux, AT_NULL, 0)
950			ADDAUX(aux, AT_NULL, 0)
951		}
952#endif /* defined(__amd64) */
953
954		ADDAUX(aux, AT_NULL, 0)
955		postfixsize = (char *)aux - (char *)bigwad->elfargs;
956
957		/*
958		 * We make assumptions above when we determine how many aux
959		 * vector entries we will be adding. However, if we have an
960		 * invalid elf file, it is possible that mapelfexec might
961		 * behave differently (but not return an error), in which case
962		 * the number of aux entries we actually add will be different.
963		 * We detect that now and error out.
964		 */
965		if (postfixsize != args->auxsize) {
966			DTRACE_PROBE2(elfexec_badaux, int, postfixsize,
967			    int, args->auxsize);
968			goto bad;
969		}
970		ASSERT(postfixsize <= __KERN_NAUXV_IMPL * sizeof (aux_entry_t));
971	}
972
973	/*
974	 * For the 64-bit kernel, the limit is big enough that rounding it up
975	 * to a page can overflow the 64-bit limit, so we check for btopr()
976	 * overflowing here by comparing it with the unrounded limit in pages.
977	 * If it hasn't overflowed, compare the exec size with the rounded up
978	 * limit in pages.  Otherwise, just compare with the unrounded limit.
979	 */
980	limit = btop(p->p_vmem_ctl);
981	roundlimit = btopr(p->p_vmem_ctl);
982	if ((roundlimit > limit && *execsz > roundlimit) ||
983	    (roundlimit < limit && *execsz > limit)) {
984		mutex_enter(&p->p_lock);
985		(void) rctl_action(rctlproc_legacy[RLIMIT_VMEM], p->p_rctls, p,
986		    RCA_SAFE);
987		mutex_exit(&p->p_lock);
988		error = ENOMEM;
989		goto bad;
990	}
991
992	bzero(up->u_auxv, sizeof (up->u_auxv));
993	up->u_commpagep = args->commpage;
994	if (postfixsize) {
995		int num_auxv;
996
997		/*
998		 * Copy the aux vector to the user stack.
999		 */
1000		error = execpoststack(args, bigwad->elfargs, postfixsize);
1001		if (error)
1002			goto bad;
1003
1004		/*
1005		 * Copy auxv to the process's user structure for use by /proc.
1006		 * If this is a branded process, the brand's exec routine will
1007		 * copy it's private entries to the user structure later. It
1008		 * relies on the fact that the blank entries are at the end.
1009		 */
1010		num_auxv = postfixsize / sizeof (aux_entry_t);
1011		ASSERT(num_auxv <= sizeof (up->u_auxv) / sizeof (auxv_t));
1012		aux = bigwad->elfargs;
1013		for (i = 0; i < num_auxv; i++) {
1014			up->u_auxv[i].a_type = aux[i].a_type;
1015			up->u_auxv[i].a_un.a_val = (aux_val_t)aux[i].a_un.a_val;
1016		}
1017	}
1018
1019	/*
1020	 * Pass back the starting address so we can set the program counter.
1021	 */
1022	args->entry = (uintptr_t)(ehdrp->e_entry + voffset);
1023
1024	if (!uphdr) {
1025		if (ehdrp->e_type == ET_DYN) {
1026			/*
1027			 * If we are executing a shared library which doesn't
1028			 * have a interpreter (probably ld.so.1) then
1029			 * we don't set the brkbase now.  Instead we
1030			 * delay it's setting until the first call
1031			 * via grow.c::brk().  This permits ld.so.1 to
1032			 * initialize brkbase to the tail of the executable it
1033			 * loads (which is where it needs to be).
1034			 */
1035			bigwad->exenv.ex_brkbase = (caddr_t)0;
1036			bigwad->exenv.ex_bssbase = (caddr_t)0;
1037			bigwad->exenv.ex_brksize = 0;
1038		} else {
1039			bigwad->exenv.ex_brkbase = brkbase;
1040			bigwad->exenv.ex_bssbase = bssbase;
1041			bigwad->exenv.ex_brksize = brksize;
1042		}
1043		bigwad->exenv.ex_magic = elfmagic;
1044		bigwad->exenv.ex_vp = vp;
1045		setexecenv(&bigwad->exenv);
1046	}
1047
1048	ASSERT(error == 0);
1049	goto out;
1050
1051bad:
1052	if (fd != -1)		/* did we open the a.out yet */
1053		(void) execclose(fd);
1054
1055	psignal(p, SIGKILL);
1056
1057	if (error == 0)
1058		error = ENOEXEC;
1059out:
1060	if (phdrbase != NULL)
1061		kmem_free(phdrbase, phdrsize);
1062	if (cap != NULL)
1063		kmem_free(cap, capsize);
1064	kmem_free(bigwad, sizeof (struct bigwad));
1065	return (error);
1066}
1067
1068/*
1069 * Compute the memory size requirement for the ELF file.
1070 */
1071static size_t
1072elfsize(Ehdr *ehdrp, int nphdrs, caddr_t phdrbase, uintptr_t *lddata)
1073{
1074	size_t	len;
1075	Phdr	*phdrp = (Phdr *)phdrbase;
1076	int	hsize = ehdrp->e_phentsize;
1077	int	first = 1;
1078	int	dfirst = 1;	/* first data segment */
1079	uintptr_t loaddr = 0;
1080	uintptr_t hiaddr = 0;
1081	uintptr_t lo, hi;
1082	int	i;
1083
1084	for (i = nphdrs; i > 0; i--) {
1085		if (phdrp->p_type == PT_LOAD) {
1086			lo = phdrp->p_vaddr;
1087			hi = lo + phdrp->p_memsz;
1088			if (first) {
1089				loaddr = lo;
1090				hiaddr = hi;
1091				first = 0;
1092			} else {
1093				if (loaddr > lo)
1094					loaddr = lo;
1095				if (hiaddr < hi)
1096					hiaddr = hi;
1097			}
1098
1099			/*
1100			 * save the address of the first data segment
1101			 * of a object - used for the AT_SUNW_LDDATA
1102			 * aux entry.
1103			 */
1104			if ((lddata != NULL) && dfirst &&
1105			    (phdrp->p_flags & PF_W)) {
1106				*lddata = lo;
1107				dfirst = 0;
1108			}
1109		}
1110		phdrp = (Phdr *)((caddr_t)phdrp + hsize);
1111	}
1112
1113	len = hiaddr - (loaddr & PAGEMASK);
1114	len = roundup(len, PAGESIZE);
1115
1116	return (len);
1117}
1118
1119/*
1120 * Read in the ELF header and program header table.
1121 * SUSV3 requires:
1122 *	ENOEXEC	File format is not recognized
1123 *	EINVAL	Format recognized but execution not supported
1124 */
1125static int
1126getelfhead(vnode_t *vp, cred_t *credp, Ehdr *ehdr, int *nshdrs, int *shstrndx,
1127    int *nphdrs)
1128{
1129	int error;
1130	ssize_t resid;
1131
1132	/*
1133	 * We got here by the first two bytes in ident,
1134	 * now read the entire ELF header.
1135	 */
1136	if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)ehdr,
1137	    sizeof (Ehdr), (offset_t)0, UIO_SYSSPACE, 0,
1138	    (rlim64_t)0, credp, &resid)) != 0)
1139		return (error);
1140
1141	/*
1142	 * Since a separate version is compiled for handling 32-bit and
1143	 * 64-bit ELF executables on a 64-bit kernel, the 64-bit version
1144	 * doesn't need to be able to deal with 32-bit ELF files.
1145	 */
1146	if (resid != 0 ||
1147	    ehdr->e_ident[EI_MAG2] != ELFMAG2 ||
1148	    ehdr->e_ident[EI_MAG3] != ELFMAG3)
1149		return (ENOEXEC);
1150
1151	if ((ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) ||
1152#if defined(_ILP32) || defined(_ELF32_COMPAT)
1153	    ehdr->e_ident[EI_CLASS] != ELFCLASS32 ||
1154#else
1155	    ehdr->e_ident[EI_CLASS] != ELFCLASS64 ||
1156#endif
1157	    !elfheadcheck(ehdr->e_ident[EI_DATA], ehdr->e_machine,
1158	    ehdr->e_flags))
1159		return (EINVAL);
1160
1161	*nshdrs = ehdr->e_shnum;
1162	*shstrndx = ehdr->e_shstrndx;
1163	*nphdrs = ehdr->e_phnum;
1164
1165	/*
1166	 * If e_shnum, e_shstrndx, or e_phnum is its sentinel value, we need
1167	 * to read in the section header at index zero to acces the true
1168	 * values for those fields.
1169	 */
1170	if ((*nshdrs == 0 && ehdr->e_shoff != 0) ||
1171	    *shstrndx == SHN_XINDEX || *nphdrs == PN_XNUM) {
1172		Shdr shdr;
1173
1174		if (ehdr->e_shoff == 0)
1175			return (EINVAL);
1176
1177		if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)&shdr,
1178		    sizeof (shdr), (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0,
1179		    (rlim64_t)0, credp, &resid)) != 0)
1180			return (error);
1181
1182		if (*nshdrs == 0)
1183			*nshdrs = shdr.sh_size;
1184		if (*shstrndx == SHN_XINDEX)
1185			*shstrndx = shdr.sh_link;
1186		if (*nphdrs == PN_XNUM && shdr.sh_info != 0)
1187			*nphdrs = shdr.sh_info;
1188	}
1189
1190	return (0);
1191}
1192
1193#ifdef _ELF32_COMPAT
1194extern size_t elf_nphdr_max;
1195#else
1196size_t elf_nphdr_max = 1000;
1197#endif
1198
1199static int
1200getelfphdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, int nphdrs,
1201    caddr_t *phbasep, ssize_t *phsizep)
1202{
1203	ssize_t resid, minsize;
1204	int err;
1205
1206	/*
1207	 * Since we're going to be using e_phentsize to iterate down the
1208	 * array of program headers, it must be 8-byte aligned or else
1209	 * a we might cause a misaligned access. We use all members through
1210	 * p_flags on 32-bit ELF files and p_memsz on 64-bit ELF files so
1211	 * e_phentsize must be at least large enough to include those
1212	 * members.
1213	 */
1214#if !defined(_LP64) || defined(_ELF32_COMPAT)
1215	minsize = offsetof(Phdr, p_flags) + sizeof (((Phdr *)NULL)->p_flags);
1216#else
1217	minsize = offsetof(Phdr, p_memsz) + sizeof (((Phdr *)NULL)->p_memsz);
1218#endif
1219	if (ehdr->e_phentsize < minsize || (ehdr->e_phentsize & 3))
1220		return (EINVAL);
1221
1222	*phsizep = nphdrs * ehdr->e_phentsize;
1223
1224	if (*phsizep > sizeof (Phdr) * elf_nphdr_max) {
1225		if ((*phbasep = kmem_alloc(*phsizep, KM_NOSLEEP)) == NULL)
1226			return (ENOMEM);
1227	} else {
1228		*phbasep = kmem_alloc(*phsizep, KM_SLEEP);
1229	}
1230
1231	if ((err = vn_rdwr(UIO_READ, vp, *phbasep, *phsizep,
1232	    (offset_t)ehdr->e_phoff, UIO_SYSSPACE, 0, (rlim64_t)0,
1233	    credp, &resid)) != 0) {
1234		kmem_free(*phbasep, *phsizep);
1235		*phbasep = NULL;
1236		return (err);
1237	}
1238
1239	return (0);
1240}
1241
1242#ifdef _ELF32_COMPAT
1243extern size_t elf_nshdr_max;
1244extern size_t elf_shstrtab_max;
1245#else
1246size_t elf_nshdr_max = 10000;
1247size_t elf_shstrtab_max = 100 * 1024;
1248#endif
1249
1250
1251static int
1252getelfshdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr,
1253    int nshdrs, int shstrndx, caddr_t *shbasep, ssize_t *shsizep,
1254    char **shstrbasep, ssize_t *shstrsizep)
1255{
1256	ssize_t resid, minsize;
1257	int err;
1258	Shdr *shdr;
1259
1260	/*
1261	 * Since we're going to be using e_shentsize to iterate down the
1262	 * array of section headers, it must be 8-byte aligned or else
1263	 * a we might cause a misaligned access. We use all members through
1264	 * sh_entsize (on both 32- and 64-bit ELF files) so e_shentsize
1265	 * must be at least large enough to include that member. The index
1266	 * of the string table section must also be valid.
1267	 */
1268	minsize = offsetof(Shdr, sh_entsize) + sizeof (shdr->sh_entsize);
1269	if (ehdr->e_shentsize < minsize || (ehdr->e_shentsize & 3) ||
1270	    shstrndx >= nshdrs)
1271		return (EINVAL);
1272
1273	*shsizep = nshdrs * ehdr->e_shentsize;
1274
1275	if (*shsizep > sizeof (Shdr) * elf_nshdr_max) {
1276		if ((*shbasep = kmem_alloc(*shsizep, KM_NOSLEEP)) == NULL)
1277			return (ENOMEM);
1278	} else {
1279		*shbasep = kmem_alloc(*shsizep, KM_SLEEP);
1280	}
1281
1282	if ((err = vn_rdwr(UIO_READ, vp, *shbasep, *shsizep,
1283	    (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, (rlim64_t)0,
1284	    credp, &resid)) != 0) {
1285		kmem_free(*shbasep, *shsizep);
1286		return (err);
1287	}
1288
1289	/*
1290	 * Pull the section string table out of the vnode; fail if the size
1291	 * is zero.
1292	 */
1293	shdr = (Shdr *)(*shbasep + shstrndx * ehdr->e_shentsize);
1294	if ((*shstrsizep = shdr->sh_size) == 0) {
1295		kmem_free(*shbasep, *shsizep);
1296		return (EINVAL);
1297	}
1298
1299	if (*shstrsizep > elf_shstrtab_max) {
1300		if ((*shstrbasep = kmem_alloc(*shstrsizep,
1301		    KM_NOSLEEP)) == NULL) {
1302			kmem_free(*shbasep, *shsizep);
1303			return (ENOMEM);
1304		}
1305	} else {
1306		*shstrbasep = kmem_alloc(*shstrsizep, KM_SLEEP);
1307	}
1308
1309	if ((err = vn_rdwr(UIO_READ, vp, *shstrbasep, *shstrsizep,
1310	    (offset_t)shdr->sh_offset, UIO_SYSSPACE, 0, (rlim64_t)0,
1311	    credp, &resid)) != 0) {
1312		kmem_free(*shbasep, *shsizep);
1313		kmem_free(*shstrbasep, *shstrsizep);
1314		return (err);
1315	}
1316
1317	/*
1318	 * Make sure the strtab is null-terminated to make sure we
1319	 * don't run off the end of the table.
1320	 */
1321	(*shstrbasep)[*shstrsizep - 1] = '\0';
1322
1323	return (0);
1324}
1325
1326static int
1327mapelfexec(
1328	vnode_t *vp,
1329	Ehdr *ehdr,
1330	int nphdrs,
1331	caddr_t phdrbase,
1332	Phdr **uphdr,
1333	Phdr **intphdr,
1334	Phdr **stphdr,
1335	Phdr **dtphdr,
1336	Phdr *dataphdrp,
1337	caddr_t *bssbase,
1338	caddr_t *brkbase,
1339	intptr_t *voffset,
1340	intptr_t *minaddr,
1341	size_t len,
1342	long *execsz,
1343	size_t *brksize)
1344{
1345	Phdr *phdr;
1346	int i, prot, error;
1347	caddr_t addr = NULL;
1348	size_t zfodsz;
1349	int ptload = 0;
1350	int page;
1351	off_t offset;
1352	int hsize = ehdr->e_phentsize;
1353	caddr_t mintmp = (caddr_t)-1;
1354	extern int use_brk_lpg;
1355
1356	if (ehdr->e_type == ET_DYN) {
1357		secflagset_t flags = 0;
1358		/*
1359		 * Obtain the virtual address of a hole in the
1360		 * address space to map the "interpreter".
1361		 */
1362		if (secflag_enabled(curproc, PROC_SEC_ASLR))
1363			flags |= _MAP_RANDOMIZE;
1364
1365		map_addr(&addr, len, (offset_t)0, 1, flags);
1366		if (addr == NULL)
1367			return (ENOMEM);
1368		*voffset = (intptr_t)addr;
1369
1370		/*
1371		 * Calculate the minimum vaddr so it can be subtracted out.
1372		 * According to the ELF specification, since PT_LOAD sections
1373		 * must be sorted by increasing p_vaddr values, this is
1374		 * guaranteed to be the first PT_LOAD section.
1375		 */
1376		phdr = (Phdr *)phdrbase;
1377		for (i = nphdrs; i > 0; i--) {
1378			if (phdr->p_type == PT_LOAD) {
1379				*voffset -= (uintptr_t)phdr->p_vaddr;
1380				break;
1381			}
1382			phdr = (Phdr *)((caddr_t)phdr + hsize);
1383		}
1384
1385	} else {
1386		*voffset = 0;
1387	}
1388	phdr = (Phdr *)phdrbase;
1389	for (i = nphdrs; i > 0; i--) {
1390		switch (phdr->p_type) {
1391		case PT_LOAD:
1392			if ((*intphdr != NULL) && (*uphdr == NULL))
1393				return (0);
1394
1395			ptload = 1;
1396			prot = PROT_USER;
1397			if (phdr->p_flags & PF_R)
1398				prot |= PROT_READ;
1399			if (phdr->p_flags & PF_W)
1400				prot |= PROT_WRITE;
1401			if (phdr->p_flags & PF_X)
1402				prot |= PROT_EXEC;
1403
1404			addr = (caddr_t)((uintptr_t)phdr->p_vaddr + *voffset);
1405
1406			/*
1407			 * Keep track of the segment with the lowest starting
1408			 * address.
1409			 */
1410			if (addr < mintmp)
1411				mintmp = addr;
1412
1413			zfodsz = (size_t)phdr->p_memsz - phdr->p_filesz;
1414
1415			offset = phdr->p_offset;
1416			if (((uintptr_t)offset & PAGEOFFSET) ==
1417			    ((uintptr_t)addr & PAGEOFFSET) &&
1418			    (!(vp->v_flag & VNOMAP))) {
1419				page = 1;
1420			} else {
1421				page = 0;
1422			}
1423
1424			/*
1425			 * Set the heap pagesize for OOB when the bss size
1426			 * is known and use_brk_lpg is not 0.
1427			 */
1428			if (brksize != NULL && use_brk_lpg &&
1429			    zfodsz != 0 && phdr == dataphdrp &&
1430			    (prot & PROT_WRITE)) {
1431				size_t tlen = P2NPHASE((uintptr_t)addr +
1432				    phdr->p_filesz, PAGESIZE);
1433
1434				if (zfodsz > tlen) {
1435					curproc->p_brkpageszc =
1436					    page_szc(map_pgsz(MAPPGSZ_HEAP,
1437					    curproc, addr + phdr->p_filesz +
1438					    tlen, zfodsz - tlen, 0));
1439				}
1440			}
1441
1442			if (curproc->p_brkpageszc != 0 && phdr == dataphdrp &&
1443			    (prot & PROT_WRITE)) {
1444				uint_t	szc = curproc->p_brkpageszc;
1445				size_t pgsz = page_get_pagesize(szc);
1446				caddr_t ebss = addr + phdr->p_memsz;
1447				/*
1448				 * If we need extra space to keep the BSS an
1449				 * integral number of pages in size, some of
1450				 * that space may fall beyond p_brkbase, so we
1451				 * need to set p_brksize to account for it
1452				 * being (logically) part of the brk.
1453				 */
1454				size_t extra_zfodsz;
1455
1456				ASSERT(pgsz > PAGESIZE);
1457
1458				extra_zfodsz = P2NPHASE((uintptr_t)ebss, pgsz);
1459
1460				if (error = execmap(vp, addr, phdr->p_filesz,
1461				    zfodsz + extra_zfodsz, phdr->p_offset,
1462				    prot, page, szc))
1463					goto bad;
1464				if (brksize != NULL)
1465					*brksize = extra_zfodsz;
1466			} else {
1467				if (error = execmap(vp, addr, phdr->p_filesz,
1468				    zfodsz, phdr->p_offset, prot, page, 0))
1469					goto bad;
1470			}
1471
1472			if (bssbase != NULL && addr >= *bssbase &&
1473			    phdr == dataphdrp) {
1474				*bssbase = addr + phdr->p_filesz;
1475			}
1476			if (brkbase != NULL && addr >= *brkbase) {
1477				*brkbase = addr + phdr->p_memsz;
1478			}
1479
1480			*execsz += btopr(phdr->p_memsz);
1481			break;
1482
1483		case PT_INTERP:
1484			if (ptload)
1485				goto bad;
1486			*intphdr = phdr;
1487			break;
1488
1489		case PT_SHLIB:
1490			*stphdr = phdr;
1491			break;
1492
1493		case PT_PHDR:
1494			if (ptload)
1495				goto bad;
1496			*uphdr = phdr;
1497			break;
1498
1499		case PT_NULL:
1500		case PT_DYNAMIC:
1501		case PT_NOTE:
1502			break;
1503
1504		case PT_SUNWDTRACE:
1505			if (dtphdr != NULL)
1506				*dtphdr = phdr;
1507			break;
1508
1509		default:
1510			break;
1511		}
1512		phdr = (Phdr *)((caddr_t)phdr + hsize);
1513	}
1514
1515	if (minaddr != NULL) {
1516		ASSERT(mintmp != (caddr_t)-1);
1517		*minaddr = (intptr_t)mintmp;
1518	}
1519
1520	if (brkbase != NULL && secflag_enabled(curproc, PROC_SEC_ASLR)) {
1521		size_t off;
1522		uintptr_t base = (uintptr_t)*brkbase;
1523		uintptr_t oend = base + *brksize;
1524
1525		ASSERT(ISP2(aslr_max_brk_skew));
1526
1527		(void) random_get_pseudo_bytes((uint8_t *)&off, sizeof (off));
1528		base += P2PHASE(off, aslr_max_brk_skew);
1529		base = P2ROUNDUP(base, PAGESIZE);
1530		*brkbase = (caddr_t)base;
1531		/*
1532		 * Above, we set *brksize to account for the possibility we
1533		 * had to grow the 'brk' in padding out the BSS to a page
1534		 * boundary.
1535		 *
1536		 * We now need to adjust that based on where we now are
1537		 * actually putting the brk.
1538		 */
1539		if (oend > base)
1540			*brksize = oend - base;
1541		else
1542			*brksize = 0;
1543	}
1544
1545	return (0);
1546bad:
1547	if (error == 0)
1548		error = EINVAL;
1549	return (error);
1550}
1551
1552int
1553elfnote(vnode_t *vp, offset_t *offsetp, int type, int descsz, void *desc,
1554    rlim64_t rlimit, cred_t *credp)
1555{
1556	Note note;
1557	int error;
1558
1559	bzero(&note, sizeof (note));
1560	bcopy("CORE", note.name, 4);
1561	note.nhdr.n_type = type;
1562	/*
1563	 * The System V ABI states that n_namesz must be the length of the
1564	 * string that follows the Nhdr structure including the terminating
1565	 * null. The ABI also specifies that sufficient padding should be
1566	 * included so that the description that follows the name string
1567	 * begins on a 4- or 8-byte boundary for 32- and 64-bit binaries
1568	 * respectively. However, since this change was not made correctly
1569	 * at the time of the 64-bit port, both 32- and 64-bit binaries
1570	 * descriptions are only guaranteed to begin on a 4-byte boundary.
1571	 */
1572	note.nhdr.n_namesz = 5;
1573	note.nhdr.n_descsz = roundup(descsz, sizeof (Word));
1574
1575	if (error = core_write(vp, UIO_SYSSPACE, *offsetp, &note,
1576	    sizeof (note), rlimit, credp))
1577		return (error);
1578
1579	*offsetp += sizeof (note);
1580
1581	if (error = core_write(vp, UIO_SYSSPACE, *offsetp, desc,
1582	    note.nhdr.n_descsz, rlimit, credp))
1583		return (error);
1584
1585	*offsetp += note.nhdr.n_descsz;
1586	return (0);
1587}
1588
1589/*
1590 * Copy the section data from one vnode to the section of another vnode.
1591 */
1592static void
1593copy_scn(Shdr *src, vnode_t *src_vp, Shdr *dst, vnode_t *dst_vp, Off *doffset,
1594    void *buf, size_t size, cred_t *credp, rlim64_t rlimit)
1595{
1596	ssize_t resid;
1597	size_t len, n = src->sh_size;
1598	offset_t off = 0;
1599
1600	while (n != 0) {
1601		len = MIN(size, n);
1602		if (vn_rdwr(UIO_READ, src_vp, buf, len, src->sh_offset + off,
1603		    UIO_SYSSPACE, 0, (rlim64_t)0, credp, &resid) != 0 ||
1604		    resid >= len ||
1605		    core_write(dst_vp, UIO_SYSSPACE, *doffset + off,
1606		    buf, len - resid, rlimit, credp) != 0) {
1607			dst->sh_size = 0;
1608			dst->sh_offset = 0;
1609			return;
1610		}
1611
1612		ASSERT(n >= len - resid);
1613
1614		n -= len - resid;
1615		off += len - resid;
1616	}
1617
1618	*doffset += src->sh_size;
1619}
1620
1621#ifdef _ELF32_COMPAT
1622extern size_t elf_datasz_max;
1623#else
1624size_t elf_datasz_max = 1 * 1024 * 1024;
1625#endif
1626
1627/*
1628 * This function processes mappings that correspond to load objects to
1629 * examine their respective sections for elfcore(). It's called once with
1630 * v set to NULL to count the number of sections that we're going to need
1631 * and then again with v set to some allocated buffer that we fill in with
1632 * all the section data.
1633 */
1634static int
1635process_scns(core_content_t content, proc_t *p, cred_t *credp, vnode_t *vp,
1636    Shdr *v, int nv, rlim64_t rlimit, Off *doffsetp, int *nshdrsp)
1637{
1638	vnode_t *lastvp = NULL;
1639	struct seg *seg;
1640	int i, j;
1641	void *data = NULL;
1642	size_t datasz = 0;
1643	shstrtab_t shstrtab;
1644	struct as *as = p->p_as;
1645	int error = 0;
1646
1647	if (v != NULL)
1648		shstrtab_init(&shstrtab);
1649
1650	i = 1;
1651	for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
1652		uint_t prot;
1653		vnode_t *mvp;
1654		void *tmp = NULL;
1655		caddr_t saddr = seg->s_base;
1656		caddr_t naddr;
1657		caddr_t eaddr;
1658		size_t segsize;
1659
1660		Ehdr ehdr;
1661		int nshdrs, shstrndx, nphdrs;
1662		caddr_t shbase;
1663		ssize_t shsize;
1664		char *shstrbase;
1665		ssize_t shstrsize;
1666
1667		Shdr *shdr;
1668		const char *name;
1669		size_t sz;
1670		uintptr_t off;
1671
1672		int ctf_ndx = 0;
1673		int symtab_ndx = 0;
1674
1675		/*
1676		 * Since we're just looking for text segments of load
1677		 * objects, we only care about the protection bits; we don't
1678		 * care about the actual size of the segment so we use the
1679		 * reserved size. If the segment's size is zero, there's
1680		 * something fishy going on so we ignore this segment.
1681		 */
1682		if (seg->s_ops != &segvn_ops ||
1683		    SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 ||
1684		    mvp == lastvp || mvp == NULL || mvp->v_type != VREG ||
1685		    (segsize = pr_getsegsize(seg, 1)) == 0)
1686			continue;
1687
1688		eaddr = saddr + segsize;
1689		prot = pr_getprot(seg, 1, &tmp, &saddr, &naddr, eaddr);
1690		pr_getprot_done(&tmp);
1691
1692		/*
1693		 * Skip this segment unless the protection bits look like
1694		 * what we'd expect for a text segment.
1695		 */
1696		if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC)
1697			continue;
1698
1699		if (getelfhead(mvp, credp, &ehdr, &nshdrs, &shstrndx,
1700		    &nphdrs) != 0 ||
1701		    getelfshdr(mvp, credp, &ehdr, nshdrs, shstrndx,
1702		    &shbase, &shsize, &shstrbase, &shstrsize) != 0)
1703			continue;
1704
1705		off = ehdr.e_shentsize;
1706		for (j = 1; j < nshdrs; j++, off += ehdr.e_shentsize) {
1707			Shdr *symtab = NULL, *strtab;
1708
1709			shdr = (Shdr *)(shbase + off);
1710
1711			if (shdr->sh_name >= shstrsize)
1712				continue;
1713
1714			name = shstrbase + shdr->sh_name;
1715
1716			if (strcmp(name, shstrtab_data[STR_CTF]) == 0) {
1717				if ((content & CC_CONTENT_CTF) == 0 ||
1718				    ctf_ndx != 0)
1719					continue;
1720
1721				if (shdr->sh_link > 0 &&
1722				    shdr->sh_link < nshdrs) {
1723					symtab = (Shdr *)(shbase +
1724					    shdr->sh_link * ehdr.e_shentsize);
1725				}
1726
1727				if (v != NULL && i < nv - 1) {
1728					if (shdr->sh_size > datasz &&
1729					    shdr->sh_size <= elf_datasz_max) {
1730						if (data != NULL)
1731							kmem_free(data, datasz);
1732
1733						datasz = shdr->sh_size;
1734						data = kmem_alloc(datasz,
1735						    KM_SLEEP);
1736					}
1737
1738					v[i].sh_name = shstrtab_ndx(&shstrtab,
1739					    STR_CTF);
1740					v[i].sh_addr = (Addr)(uintptr_t)saddr;
1741					v[i].sh_type = SHT_PROGBITS;
1742					v[i].sh_addralign = 4;
1743					*doffsetp = roundup(*doffsetp,
1744					    v[i].sh_addralign);
1745					v[i].sh_offset = *doffsetp;
1746					v[i].sh_size = shdr->sh_size;
1747					if (symtab == NULL)  {
1748						v[i].sh_link = 0;
1749					} else if (symtab->sh_type ==
1750					    SHT_SYMTAB &&
1751					    symtab_ndx != 0) {
1752						v[i].sh_link =
1753						    symtab_ndx;
1754					} else {
1755						v[i].sh_link = i + 1;
1756					}
1757
1758					copy_scn(shdr, mvp, &v[i], vp,
1759					    doffsetp, data, datasz, credp,
1760					    rlimit);
1761				}
1762
1763				ctf_ndx = i++;
1764
1765				/*
1766				 * We've already dumped the symtab.
1767				 */
1768				if (symtab != NULL &&
1769				    symtab->sh_type == SHT_SYMTAB &&
1770				    symtab_ndx != 0)
1771					continue;
1772
1773			} else if (strcmp(name,
1774			    shstrtab_data[STR_SYMTAB]) == 0) {
1775				if ((content & CC_CONTENT_SYMTAB) == 0 ||
1776				    symtab != 0)
1777					continue;
1778
1779				symtab = shdr;
1780			}
1781
1782			if (symtab != NULL) {
1783				if ((symtab->sh_type != SHT_DYNSYM &&
1784				    symtab->sh_type != SHT_SYMTAB) ||
1785				    symtab->sh_link == 0 ||
1786				    symtab->sh_link >= nshdrs)
1787					continue;
1788
1789				strtab = (Shdr *)(shbase +
1790				    symtab->sh_link * ehdr.e_shentsize);
1791
1792				if (strtab->sh_type != SHT_STRTAB)
1793					continue;
1794
1795				if (v != NULL && i < nv - 2) {
1796					sz = MAX(symtab->sh_size,
1797					    strtab->sh_size);
1798					if (sz > datasz &&
1799					    sz <= elf_datasz_max) {
1800						if (data != NULL)
1801							kmem_free(data, datasz);
1802
1803						datasz = sz;
1804						data = kmem_alloc(datasz,
1805						    KM_SLEEP);
1806					}
1807
1808					if (symtab->sh_type == SHT_DYNSYM) {
1809						v[i].sh_name = shstrtab_ndx(
1810						    &shstrtab, STR_DYNSYM);
1811						v[i + 1].sh_name = shstrtab_ndx(
1812						    &shstrtab, STR_DYNSTR);
1813					} else {
1814						v[i].sh_name = shstrtab_ndx(
1815						    &shstrtab, STR_SYMTAB);
1816						v[i + 1].sh_name = shstrtab_ndx(
1817						    &shstrtab, STR_STRTAB);
1818					}
1819
1820					v[i].sh_type = symtab->sh_type;
1821					v[i].sh_addr = symtab->sh_addr;
1822					if (ehdr.e_type == ET_DYN ||
1823					    v[i].sh_addr == 0)
1824						v[i].sh_addr +=
1825						    (Addr)(uintptr_t)saddr;
1826					v[i].sh_addralign =
1827					    symtab->sh_addralign;
1828					*doffsetp = roundup(*doffsetp,
1829					    v[i].sh_addralign);
1830					v[i].sh_offset = *doffsetp;
1831					v[i].sh_size = symtab->sh_size;
1832					v[i].sh_link = i + 1;
1833					v[i].sh_entsize = symtab->sh_entsize;
1834					v[i].sh_info = symtab->sh_info;
1835
1836					copy_scn(symtab, mvp, &v[i], vp,
1837					    doffsetp, data, datasz, credp,
1838					    rlimit);
1839
1840					v[i + 1].sh_type = SHT_STRTAB;
1841					v[i + 1].sh_flags = SHF_STRINGS;
1842					v[i + 1].sh_addr = symtab->sh_addr;
1843					if (ehdr.e_type == ET_DYN ||
1844					    v[i + 1].sh_addr == 0)
1845						v[i + 1].sh_addr +=
1846						    (Addr)(uintptr_t)saddr;
1847					v[i + 1].sh_addralign =
1848					    strtab->sh_addralign;
1849					*doffsetp = roundup(*doffsetp,
1850					    v[i + 1].sh_addralign);
1851					v[i + 1].sh_offset = *doffsetp;
1852					v[i + 1].sh_size = strtab->sh_size;
1853
1854					copy_scn(strtab, mvp, &v[i + 1], vp,
1855					    doffsetp, data, datasz, credp,
1856					    rlimit);
1857				}
1858
1859				if (symtab->sh_type == SHT_SYMTAB)
1860					symtab_ndx = i;
1861				i += 2;
1862			}
1863		}
1864
1865		kmem_free(shstrbase, shstrsize);
1866		kmem_free(shbase, shsize);
1867
1868		lastvp = mvp;
1869	}
1870
1871	if (v == NULL) {
1872		if (i == 1)
1873			*nshdrsp = 0;
1874		else
1875			*nshdrsp = i + 1;
1876		goto done;
1877	}
1878
1879	if (i != nv - 1) {
1880		cmn_err(CE_WARN, "elfcore: core dump failed for "
1881		    "process %d; address space is changing", p->p_pid);
1882		error = EIO;
1883		goto done;
1884	}
1885
1886	v[i].sh_name = shstrtab_ndx(&shstrtab, STR_SHSTRTAB);
1887	v[i].sh_size = shstrtab_size(&shstrtab);
1888	v[i].sh_addralign = 1;
1889	*doffsetp = roundup(*doffsetp, v[i].sh_addralign);
1890	v[i].sh_offset = *doffsetp;
1891	v[i].sh_flags = SHF_STRINGS;
1892	v[i].sh_type = SHT_STRTAB;
1893
1894	if (v[i].sh_size > datasz) {
1895		if (data != NULL)
1896			kmem_free(data, datasz);
1897
1898		datasz = v[i].sh_size;
1899		data = kmem_alloc(datasz,
1900		    KM_SLEEP);
1901	}
1902
1903	shstrtab_dump(&shstrtab, data);
1904
1905	if ((error = core_write(vp, UIO_SYSSPACE, *doffsetp,
1906	    data, v[i].sh_size, rlimit, credp)) != 0)
1907		goto done;
1908
1909	*doffsetp += v[i].sh_size;
1910
1911done:
1912	if (data != NULL)
1913		kmem_free(data, datasz);
1914
1915	return (error);
1916}
1917
1918int
1919elfcore(vnode_t *vp, proc_t *p, cred_t *credp, rlim64_t rlimit, int sig,
1920    core_content_t content)
1921{
1922	offset_t poffset, soffset;
1923	Off doffset;
1924	int error, i, nphdrs, nshdrs;
1925	int overflow = 0;
1926	struct seg *seg;
1927	struct as *as = p->p_as;
1928	union {
1929		Ehdr ehdr;
1930		Phdr phdr[1];
1931		Shdr shdr[1];
1932	} *bigwad;
1933	size_t bigsize;
1934	size_t phdrsz, shdrsz;
1935	Ehdr *ehdr;
1936	Phdr *v;
1937	caddr_t brkbase;
1938	size_t brksize;
1939	caddr_t stkbase;
1940	size_t stksize;
1941	int ntries = 0;
1942	klwp_t *lwp = ttolwp(curthread);
1943
1944top:
1945	/*
1946	 * Make sure we have everything we need (registers, etc.).
1947	 * All other lwps have already stopped and are in an orderly state.
1948	 */
1949	ASSERT(p == ttoproc(curthread));
1950	prstop(0, 0);
1951
1952	AS_LOCK_ENTER(as, RW_WRITER);
1953	nphdrs = prnsegs(as, 0) + 2;		/* two CORE note sections */
1954
1955	/*
1956	 * Count the number of section headers we're going to need.
1957	 */
1958	nshdrs = 0;
1959	if (content & (CC_CONTENT_CTF | CC_CONTENT_SYMTAB)) {
1960		(void) process_scns(content, p, credp, NULL, NULL, 0, 0,
1961		    NULL, &nshdrs);
1962	}
1963	AS_LOCK_EXIT(as);
1964
1965	ASSERT(nshdrs == 0 || nshdrs > 1);
1966
1967	/*
1968	 * The core file contents may required zero section headers, but if
1969	 * we overflow the 16 bits allotted to the program header count in
1970	 * the ELF header, we'll need that program header at index zero.
1971	 */
1972	if (nshdrs == 0 && nphdrs >= PN_XNUM)
1973		nshdrs = 1;
1974
1975	phdrsz = nphdrs * sizeof (Phdr);
1976	shdrsz = nshdrs * sizeof (Shdr);
1977
1978	bigsize = MAX(sizeof (*bigwad), MAX(phdrsz, shdrsz));
1979	bigwad = kmem_alloc(bigsize, KM_SLEEP);
1980
1981	ehdr = &bigwad->ehdr;
1982	bzero(ehdr, sizeof (*ehdr));
1983
1984	ehdr->e_ident[EI_MAG0] = ELFMAG0;
1985	ehdr->e_ident[EI_MAG1] = ELFMAG1;
1986	ehdr->e_ident[EI_MAG2] = ELFMAG2;
1987	ehdr->e_ident[EI_MAG3] = ELFMAG3;
1988	ehdr->e_ident[EI_CLASS] = ELFCLASS;
1989	ehdr->e_type = ET_CORE;
1990
1991#if !defined(_LP64) || defined(_ELF32_COMPAT)
1992
1993#if defined(__sparc)
1994	ehdr->e_ident[EI_DATA] = ELFDATA2MSB;
1995	ehdr->e_machine = EM_SPARC;
1996#elif defined(__i386) || defined(__i386_COMPAT)
1997	ehdr->e_ident[EI_DATA] = ELFDATA2LSB;
1998	ehdr->e_machine = EM_386;
1999#else
2000#error "no recognized machine type is defined"
2001#endif
2002
2003#else	/* !defined(_LP64) || defined(_ELF32_COMPAT) */
2004
2005#if defined(__sparc)
2006	ehdr->e_ident[EI_DATA] = ELFDATA2MSB;
2007	ehdr->e_machine = EM_SPARCV9;
2008#elif defined(__amd64)
2009	ehdr->e_ident[EI_DATA] = ELFDATA2LSB;
2010	ehdr->e_machine = EM_AMD64;
2011#else
2012#error "no recognized 64-bit machine type is defined"
2013#endif
2014
2015#endif	/* !defined(_LP64) || defined(_ELF32_COMPAT) */
2016
2017	/*
2018	 * If the count of program headers or section headers or the index
2019	 * of the section string table can't fit in the mere 16 bits
2020	 * shortsightedly allotted to them in the ELF header, we use the
2021	 * extended formats and put the real values in the section header
2022	 * as index 0.
2023	 */
2024	ehdr->e_version = EV_CURRENT;
2025	ehdr->e_ehsize = sizeof (Ehdr);
2026
2027	if (nphdrs >= PN_XNUM)
2028		ehdr->e_phnum = PN_XNUM;
2029	else
2030		ehdr->e_phnum = (unsigned short)nphdrs;
2031
2032	ehdr->e_phoff = sizeof (Ehdr);
2033	ehdr->e_phentsize = sizeof (Phdr);
2034
2035	if (nshdrs > 0) {
2036		if (nshdrs >= SHN_LORESERVE)
2037			ehdr->e_shnum = 0;
2038		else
2039			ehdr->e_shnum = (unsigned short)nshdrs;
2040
2041		if (nshdrs - 1 >= SHN_LORESERVE)
2042			ehdr->e_shstrndx = SHN_XINDEX;
2043		else
2044			ehdr->e_shstrndx = (unsigned short)(nshdrs - 1);
2045
2046		ehdr->e_shoff = ehdr->e_phoff + ehdr->e_phentsize * nphdrs;
2047		ehdr->e_shentsize = sizeof (Shdr);
2048	}
2049
2050	if (error = core_write(vp, UIO_SYSSPACE, (offset_t)0, ehdr,
2051	    sizeof (Ehdr), rlimit, credp))
2052		goto done;
2053
2054	poffset = sizeof (Ehdr);
2055	soffset = sizeof (Ehdr) + phdrsz;
2056	doffset = sizeof (Ehdr) + phdrsz + shdrsz;
2057
2058	v = &bigwad->phdr[0];
2059	bzero(v, phdrsz);
2060
2061	setup_old_note_header(&v[0], p);
2062	v[0].p_offset = doffset = roundup(doffset, sizeof (Word));
2063	doffset += v[0].p_filesz;
2064
2065	setup_note_header(&v[1], p);
2066	v[1].p_offset = doffset = roundup(doffset, sizeof (Word));
2067	doffset += v[1].p_filesz;
2068
2069	mutex_enter(&p->p_lock);
2070
2071	brkbase = p->p_brkbase;
2072	brksize = p->p_brksize;
2073
2074	stkbase = p->p_usrstack - p->p_stksize;
2075	stksize = p->p_stksize;
2076
2077	mutex_exit(&p->p_lock);
2078
2079	AS_LOCK_ENTER(as, RW_WRITER);
2080	i = 2;
2081	for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
2082		caddr_t eaddr = seg->s_base + pr_getsegsize(seg, 0);
2083		caddr_t saddr, naddr;
2084		void *tmp = NULL;
2085		extern struct seg_ops segspt_shmops;
2086
2087		if ((seg->s_flags & S_HOLE) != 0) {
2088			continue;
2089		}
2090
2091		for (saddr = seg->s_base; saddr < eaddr; saddr = naddr) {
2092			uint_t prot;
2093			size_t size;
2094			int type;
2095			vnode_t *mvp;
2096
2097			prot = pr_getprot(seg, 0, &tmp, &saddr, &naddr, eaddr);
2098			prot &= PROT_READ | PROT_WRITE | PROT_EXEC;
2099			if ((size = (size_t)(naddr - saddr)) == 0)
2100				continue;
2101			if (i == nphdrs) {
2102				overflow++;
2103				continue;
2104			}
2105			v[i].p_type = PT_LOAD;
2106			v[i].p_vaddr = (Addr)(uintptr_t)saddr;
2107			v[i].p_memsz = size;
2108			if (prot & PROT_READ)
2109				v[i].p_flags |= PF_R;
2110			if (prot & PROT_WRITE)
2111				v[i].p_flags |= PF_W;
2112			if (prot & PROT_EXEC)
2113				v[i].p_flags |= PF_X;
2114
2115			/*
2116			 * Figure out which mappings to include in the core.
2117			 */
2118			type = SEGOP_GETTYPE(seg, saddr);
2119
2120			if (saddr == stkbase && size == stksize) {
2121				if (!(content & CC_CONTENT_STACK))
2122					goto exclude;
2123
2124			} else if (saddr == brkbase && size == brksize) {
2125				if (!(content & CC_CONTENT_HEAP))
2126					goto exclude;
2127
2128			} else if (seg->s_ops == &segspt_shmops) {
2129				if (type & MAP_NORESERVE) {
2130					if (!(content & CC_CONTENT_DISM))
2131						goto exclude;
2132				} else {
2133					if (!(content & CC_CONTENT_ISM))
2134						goto exclude;
2135				}
2136
2137			} else if (seg->s_ops != &segvn_ops) {
2138				goto exclude;
2139
2140			} else if (type & MAP_SHARED) {
2141				if (shmgetid(p, saddr) != SHMID_NONE) {
2142					if (!(content & CC_CONTENT_SHM))
2143						goto exclude;
2144
2145				} else if (SEGOP_GETVP(seg, seg->s_base,
2146				    &mvp) != 0 || mvp == NULL ||
2147				    mvp->v_type != VREG) {
2148					if (!(content & CC_CONTENT_SHANON))
2149						goto exclude;
2150
2151				} else {
2152					if (!(content & CC_CONTENT_SHFILE))
2153						goto exclude;
2154				}
2155
2156			} else if (SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 ||
2157			    mvp == NULL || mvp->v_type != VREG) {
2158				if (!(content & CC_CONTENT_ANON))
2159					goto exclude;
2160
2161			} else if (prot == (PROT_READ | PROT_EXEC)) {
2162				if (!(content & CC_CONTENT_TEXT))
2163					goto exclude;
2164
2165			} else if (prot == PROT_READ) {
2166				if (!(content & CC_CONTENT_RODATA))
2167					goto exclude;
2168
2169			} else {
2170				if (!(content & CC_CONTENT_DATA))
2171					goto exclude;
2172			}
2173
2174			doffset = roundup(doffset, sizeof (Word));
2175			v[i].p_offset = doffset;
2176			v[i].p_filesz = size;
2177			doffset += size;
2178exclude:
2179			i++;
2180		}
2181		ASSERT(tmp == NULL);
2182	}
2183	AS_LOCK_EXIT(as);
2184
2185	if (overflow || i != nphdrs) {
2186		if (ntries++ == 0) {
2187			kmem_free(bigwad, bigsize);
2188			overflow = 0;
2189			goto top;
2190		}
2191		cmn_err(CE_WARN, "elfcore: core dump failed for "
2192		    "process %d; address space is changing", p->p_pid);
2193		error = EIO;
2194		goto done;
2195	}
2196
2197	if ((error = core_write(vp, UIO_SYSSPACE, poffset,
2198	    v, phdrsz, rlimit, credp)) != 0)
2199		goto done;
2200
2201	if ((error = write_old_elfnotes(p, sig, vp, v[0].p_offset, rlimit,
2202	    credp)) != 0)
2203		goto done;
2204
2205	if ((error = write_elfnotes(p, sig, vp, v[1].p_offset, rlimit,
2206	    credp, content)) != 0)
2207		goto done;
2208
2209	for (i = 2; i < nphdrs; i++) {
2210		prkillinfo_t killinfo;
2211		sigqueue_t *sq;
2212		int sig, j;
2213
2214		if (v[i].p_filesz == 0)
2215			continue;
2216
2217		/*
2218		 * If dumping out this segment fails, rather than failing
2219		 * the core dump entirely, we reset the size of the mapping
2220		 * to zero to indicate that the data is absent from the core
2221		 * file and or in the PF_SUNW_FAILURE flag to differentiate
2222		 * this from mappings that were excluded due to the core file
2223		 * content settings.
2224		 */
2225		if ((error = core_seg(p, vp, v[i].p_offset,
2226		    (caddr_t)(uintptr_t)v[i].p_vaddr, v[i].p_filesz,
2227		    rlimit, credp)) == 0) {
2228			continue;
2229		}
2230
2231		if ((sig = lwp->lwp_cursig) == 0) {
2232			/*
2233			 * We failed due to something other than a signal.
2234			 * Since the space reserved for the segment is now
2235			 * unused, we stash the errno in the first four
2236			 * bytes. This undocumented interface will let us
2237			 * understand the nature of the failure.
2238			 */
2239			(void) core_write(vp, UIO_SYSSPACE, v[i].p_offset,
2240			    &error, sizeof (error), rlimit, credp);
2241
2242			v[i].p_filesz = 0;
2243			v[i].p_flags |= PF_SUNW_FAILURE;
2244			if ((error = core_write(vp, UIO_SYSSPACE,
2245			    poffset + sizeof (v[i]) * i, &v[i], sizeof (v[i]),
2246			    rlimit, credp)) != 0)
2247				goto done;
2248
2249			continue;
2250		}
2251
2252		/*
2253		 * We took a signal.  We want to abort the dump entirely, but
2254		 * we also want to indicate what failed and why.  We therefore
2255		 * use the space reserved for the first failing segment to
2256		 * write our error (which, for purposes of compatability with
2257		 * older core dump readers, we set to EINTR) followed by any
2258		 * siginfo associated with the signal.
2259		 */
2260		bzero(&killinfo, sizeof (killinfo));
2261		killinfo.prk_error = EINTR;
2262
2263		sq = sig == SIGKILL ? curproc->p_killsqp : lwp->lwp_curinfo;
2264
2265		if (sq != NULL) {
2266			bcopy(&sq->sq_info, &killinfo.prk_info,
2267			    sizeof (sq->sq_info));
2268		} else {
2269			killinfo.prk_info.si_signo = lwp->lwp_cursig;
2270			killinfo.prk_info.si_code = SI_NOINFO;
2271		}
2272
2273#if (defined(_SYSCALL32_IMPL) || defined(_LP64))
2274		/*
2275		 * If this is a 32-bit process, we need to translate from the
2276		 * native siginfo to the 32-bit variant.  (Core readers must
2277		 * always have the same data model as their target or must
2278		 * be aware of -- and compensate for -- data model differences.)
2279		 */
2280		if (curproc->p_model == DATAMODEL_ILP32) {
2281			siginfo32_t si32;
2282
2283			siginfo_kto32((k_siginfo_t *)&killinfo.prk_info, &si32);
2284			bcopy(&si32, &killinfo.prk_info, sizeof (si32));
2285		}
2286#endif
2287
2288		(void) core_write(vp, UIO_SYSSPACE, v[i].p_offset,
2289		    &killinfo, sizeof (killinfo), rlimit, credp);
2290
2291		/*
2292		 * For the segment on which we took the signal, indicate that
2293		 * its data now refers to a siginfo.
2294		 */
2295		v[i].p_filesz = 0;
2296		v[i].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED |
2297		    PF_SUNW_SIGINFO;
2298
2299		/*
2300		 * And for every other segment, indicate that its absence
2301		 * is due to a signal.
2302		 */
2303		for (j = i + 1; j < nphdrs; j++) {
2304			v[j].p_filesz = 0;
2305			v[j].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED;
2306		}
2307
2308		/*
2309		 * Finally, write out our modified program headers.
2310		 */
2311		if ((error = core_write(vp, UIO_SYSSPACE,
2312		    poffset + sizeof (v[i]) * i, &v[i],
2313		    sizeof (v[i]) * (nphdrs - i), rlimit, credp)) != 0)
2314			goto done;
2315
2316		break;
2317	}
2318
2319	if (nshdrs > 0) {
2320		bzero(&bigwad->shdr[0], shdrsz);
2321
2322		if (nshdrs >= SHN_LORESERVE)
2323			bigwad->shdr[0].sh_size = nshdrs;
2324
2325		if (nshdrs - 1 >= SHN_LORESERVE)
2326			bigwad->shdr[0].sh_link = nshdrs - 1;
2327
2328		if (nphdrs >= PN_XNUM)
2329			bigwad->shdr[0].sh_info = nphdrs;
2330
2331		if (nshdrs > 1) {
2332			AS_LOCK_ENTER(as, RW_WRITER);
2333			if ((error = process_scns(content, p, credp, vp,
2334			    &bigwad->shdr[0], nshdrs, rlimit, &doffset,
2335			    NULL)) != 0) {
2336				AS_LOCK_EXIT(as);
2337				goto done;
2338			}
2339			AS_LOCK_EXIT(as);
2340		}
2341
2342		if ((error = core_write(vp, UIO_SYSSPACE, soffset,
2343		    &bigwad->shdr[0], shdrsz, rlimit, credp)) != 0)
2344			goto done;
2345	}
2346
2347done:
2348	kmem_free(bigwad, bigsize);
2349	return (error);
2350}
2351
2352#ifndef	_ELF32_COMPAT
2353
2354static struct execsw esw = {
2355#ifdef	_LP64
2356	elf64magicstr,
2357#else	/* _LP64 */
2358	elf32magicstr,
2359#endif	/* _LP64 */
2360	0,
2361	5,
2362	elfexec,
2363	elfcore
2364};
2365
2366static struct modlexec modlexec = {
2367	&mod_execops, "exec module for elf", &esw
2368};
2369
2370#ifdef	_LP64
2371extern int elf32exec(vnode_t *vp, execa_t *uap, uarg_t *args,
2372			intpdata_t *idatap, int level, long *execsz,
2373			int setid, caddr_t exec_file, cred_t *cred,
2374			int brand_action);
2375extern int elf32core(vnode_t *vp, proc_t *p, cred_t *credp,
2376			rlim64_t rlimit, int sig, core_content_t content);
2377
2378static struct execsw esw32 = {
2379	elf32magicstr,
2380	0,
2381	5,
2382	elf32exec,
2383	elf32core
2384};
2385
2386static struct modlexec modlexec32 = {
2387	&mod_execops, "32-bit exec module for elf", &esw32
2388};
2389#endif	/* _LP64 */
2390
2391static struct modlinkage modlinkage = {
2392	MODREV_1,
2393	(void *)&modlexec,
2394#ifdef	_LP64
2395	(void *)&modlexec32,
2396#endif	/* _LP64 */
2397	NULL
2398};
2399
2400int
2401_init(void)
2402{
2403	return (mod_install(&modlinkage));
2404}
2405
2406int
2407_fini(void)
2408{
2409	return (mod_remove(&modlinkage));
2410}
2411
2412int
2413_info(struct modinfo *modinfop)
2414{
2415	return (mod_info(&modlinkage, modinfop));
2416}
2417
2418#endif	/* !_ELF32_COMPAT */
2419