xref: /illumos-gate/usr/src/uts/common/exec/elf/elf.c (revision 8e458de0)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved.
24  */
25 
26 /*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/
27 /*	   All Rights Reserved	*/
28 /*
29  * Copyright (c) 2019, Joyent, Inc.
30  * Copyright 2021 Oxide Computer Company
31  */
32 
33 #include <sys/types.h>
34 #include <sys/param.h>
35 #include <sys/thread.h>
36 #include <sys/sysmacros.h>
37 #include <sys/signal.h>
38 #include <sys/cred.h>
39 #include <sys/user.h>
40 #include <sys/errno.h>
41 #include <sys/vnode.h>
42 #include <sys/mman.h>
43 #include <sys/kmem.h>
44 #include <sys/proc.h>
45 #include <sys/pathname.h>
46 #include <sys/policy.h>
47 #include <sys/cmn_err.h>
48 #include <sys/systm.h>
49 #include <sys/elf.h>
50 #include <sys/vmsystm.h>
51 #include <sys/debug.h>
52 #include <sys/auxv.h>
53 #include <sys/exec.h>
54 #include <sys/prsystm.h>
55 #include <vm/as.h>
56 #include <vm/rm.h>
57 #include <vm/seg.h>
58 #include <vm/seg_vn.h>
59 #include <sys/modctl.h>
60 #include <sys/systeminfo.h>
61 #include <sys/vmparam.h>
62 #include <sys/machelf.h>
63 #include <sys/shm_impl.h>
64 #include <sys/archsystm.h>
65 #include <sys/fasttrap.h>
66 #include <sys/brand.h>
67 #include "elf_impl.h"
68 #include <sys/sdt.h>
69 #include <sys/siginfo.h>
70 #include <sys/random.h>
71 
72 #include <core_shstrtab.h>
73 
74 #if defined(__x86)
75 #include <sys/comm_page_util.h>
76 #include <sys/fp.h>
77 #endif /* defined(__x86) */
78 
79 
80 extern int at_flags;
81 extern volatile size_t aslr_max_brk_skew;
82 
83 #define	ORIGIN_STR	"ORIGIN"
84 #define	ORIGIN_STR_SIZE	6
85 
86 static int getelfhead(vnode_t *, cred_t *, Ehdr *, int *, int *, int *);
87 static int getelfphdr(vnode_t *, cred_t *, const Ehdr *, int, caddr_t *,
88     ssize_t *);
89 static int getelfshdr(vnode_t *, cred_t *, const Ehdr *, int, int, caddr_t *,
90     ssize_t *, caddr_t *, ssize_t *);
91 static size_t elfsize(Ehdr *, int, caddr_t, uintptr_t *);
92 static int mapelfexec(vnode_t *, Ehdr *, int, caddr_t,
93     Phdr **, Phdr **, Phdr **, Phdr **, Phdr *,
94     caddr_t *, caddr_t *, intptr_t *, intptr_t *, size_t, long *, size_t *);
95 
96 static int
dtrace_safe_phdr(Phdr * phdrp,struct uarg * args,uintptr_t base)97 dtrace_safe_phdr(Phdr *phdrp, struct uarg *args, uintptr_t base)
98 {
99 	ASSERT(phdrp->p_type == PT_SUNWDTRACE);
100 
101 	/*
102 	 * See the comment in fasttrap.h for information on how to safely
103 	 * update this program header.
104 	 */
105 	if (phdrp->p_memsz < PT_SUNWDTRACE_SIZE ||
106 	    (phdrp->p_flags & (PF_R | PF_W | PF_X)) != (PF_R | PF_W | PF_X))
107 		return (-1);
108 
109 	args->thrptr = phdrp->p_vaddr + base;
110 
111 	return (0);
112 }
113 
114 static int
handle_secflag_dt(proc_t * p,uint_t dt,uint_t val)115 handle_secflag_dt(proc_t *p, uint_t dt, uint_t val)
116 {
117 	uint_t flag;
118 
119 	switch (dt) {
120 	case DT_SUNW_ASLR:
121 		flag = PROC_SEC_ASLR;
122 		break;
123 	default:
124 		return (EINVAL);
125 	}
126 
127 	if (val == 0) {
128 		if (secflag_isset(p->p_secflags.psf_lower, flag))
129 			return (EPERM);
130 		if ((secpolicy_psecflags(CRED(), p, p) != 0) &&
131 		    secflag_isset(p->p_secflags.psf_inherit, flag))
132 			return (EPERM);
133 
134 		secflag_clear(&p->p_secflags.psf_effective, flag);
135 	} else {
136 		if (!secflag_isset(p->p_secflags.psf_upper, flag))
137 			return (EPERM);
138 
139 		if ((secpolicy_psecflags(CRED(), p, p) != 0) &&
140 		    !secflag_isset(p->p_secflags.psf_inherit, flag))
141 			return (EPERM);
142 
143 		secflag_set(&p->p_secflags.psf_effective, flag);
144 	}
145 
146 	return (0);
147 }
148 
149 /*
150  * Map in the executable pointed to by vp. Returns 0 on success.
151  */
152 int
mapexec_brand(vnode_t * vp,uarg_t * args,Ehdr * ehdr,Addr * uphdr_vaddr,intptr_t * voffset,caddr_t exec_file,int * interp,caddr_t * bssbase,caddr_t * brkbase,size_t * brksize,uintptr_t * lddatap)153 mapexec_brand(vnode_t *vp, uarg_t *args, Ehdr *ehdr, Addr *uphdr_vaddr,
154     intptr_t *voffset, caddr_t exec_file, int *interp, caddr_t *bssbase,
155     caddr_t *brkbase, size_t *brksize, uintptr_t *lddatap)
156 {
157 	size_t		len;
158 	struct vattr	vat;
159 	caddr_t		phdrbase = NULL;
160 	ssize_t		phdrsize;
161 	int		nshdrs, shstrndx, nphdrs;
162 	int		error = 0;
163 	Phdr		*uphdr = NULL;
164 	Phdr		*junk = NULL;
165 	Phdr		*dynphdr = NULL;
166 	Phdr		*dtrphdr = NULL;
167 	uintptr_t	lddata;
168 	long		execsz;
169 	intptr_t	minaddr;
170 
171 	if (lddatap != NULL)
172 		*lddatap = 0;
173 
174 	if (error = execpermissions(vp, &vat, args)) {
175 		uprintf("%s: Cannot execute %s\n", exec_file, args->pathname);
176 		return (error);
177 	}
178 
179 	if ((error = getelfhead(vp, CRED(), ehdr, &nshdrs, &shstrndx,
180 	    &nphdrs)) != 0 ||
181 	    (error = getelfphdr(vp, CRED(), ehdr, nphdrs, &phdrbase,
182 	    &phdrsize)) != 0) {
183 		uprintf("%s: Cannot read %s\n", exec_file, args->pathname);
184 		return (error);
185 	}
186 
187 	if ((len = elfsize(ehdr, nphdrs, phdrbase, &lddata)) == 0) {
188 		uprintf("%s: Nothing to load in %s", exec_file, args->pathname);
189 		kmem_free(phdrbase, phdrsize);
190 		return (ENOEXEC);
191 	}
192 	if (lddatap != NULL)
193 		*lddatap = lddata;
194 
195 	if (error = mapelfexec(vp, ehdr, nphdrs, phdrbase, &uphdr, &dynphdr,
196 	    &junk, &dtrphdr, NULL, bssbase, brkbase, voffset, &minaddr,
197 	    len, &execsz, brksize)) {
198 		uprintf("%s: Cannot map %s\n", exec_file, args->pathname);
199 		kmem_free(phdrbase, phdrsize);
200 		return (error);
201 	}
202 
203 	/*
204 	 * Inform our caller if the executable needs an interpreter.
205 	 */
206 	*interp = (dynphdr == NULL) ? 0 : 1;
207 
208 	/*
209 	 * If this is a statically linked executable, voffset should indicate
210 	 * the address of the executable itself (it normally holds the address
211 	 * of the interpreter).
212 	 */
213 	if (ehdr->e_type == ET_EXEC && *interp == 0)
214 		*voffset = minaddr;
215 
216 	if (uphdr != NULL) {
217 		*uphdr_vaddr = uphdr->p_vaddr;
218 	} else {
219 		*uphdr_vaddr = (Addr)-1;
220 	}
221 
222 	kmem_free(phdrbase, phdrsize);
223 	return (error);
224 }
225 
226 /*ARGSUSED*/
227 int
elfexec(vnode_t * vp,execa_t * uap,uarg_t * args,intpdata_t * idatap,int level,long * execsz,int setid,caddr_t exec_file,cred_t * cred,int brand_action)228 elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap,
229     int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred,
230     int brand_action)
231 {
232 	caddr_t		phdrbase = NULL;
233 	caddr_t		bssbase = 0;
234 	caddr_t		brkbase = 0;
235 	size_t		brksize = 0;
236 	ssize_t		dlnsize;
237 	aux_entry_t	*aux;
238 	int		error;
239 	ssize_t		resid;
240 	int		fd = -1;
241 	intptr_t	voffset;
242 	Phdr		*intphdr = NULL;
243 	Phdr		*dynamicphdr = NULL;
244 	Phdr		*stphdr = NULL;
245 	Phdr		*uphdr = NULL;
246 	Phdr		*junk = NULL;
247 	size_t		len;
248 	size_t		i;
249 	ssize_t		phdrsize;
250 	int		postfixsize = 0;
251 	int		hsize;
252 	Phdr		*phdrp;
253 	Phdr		*dataphdrp = NULL;
254 	Phdr		*dtrphdr;
255 	Phdr		*capphdr = NULL;
256 	Cap		*cap = NULL;
257 	ssize_t		capsize;
258 	int		hasu = 0;
259 	int		hasauxv = 0;
260 	int		hasintp = 0;
261 	int		branded = 0;
262 
263 	struct proc *p = ttoproc(curthread);
264 	struct user *up = PTOU(p);
265 	struct bigwad {
266 		Ehdr	ehdr;
267 		aux_entry_t	elfargs[__KERN_NAUXV_IMPL];
268 		char		dl_name[MAXPATHLEN];
269 		char		pathbuf[MAXPATHLEN];
270 		struct vattr	vattr;
271 		struct execenv	exenv;
272 	} *bigwad;	/* kmem_alloc this behemoth so we don't blow stack */
273 	Ehdr		*ehdrp;
274 	int		nshdrs, shstrndx, nphdrs;
275 	char		*dlnp;
276 	char		*pathbufp;
277 	rlim64_t	limit;
278 	rlim64_t	roundlimit;
279 
280 	ASSERT(p->p_model == DATAMODEL_ILP32 || p->p_model == DATAMODEL_LP64);
281 
282 	bigwad = kmem_alloc(sizeof (struct bigwad), KM_SLEEP);
283 	ehdrp = &bigwad->ehdr;
284 	dlnp = bigwad->dl_name;
285 	pathbufp = bigwad->pathbuf;
286 
287 	/*
288 	 * Obtain ELF and program header information.
289 	 */
290 	if ((error = getelfhead(vp, CRED(), ehdrp, &nshdrs, &shstrndx,
291 	    &nphdrs)) != 0 ||
292 	    (error = getelfphdr(vp, CRED(), ehdrp, nphdrs, &phdrbase,
293 	    &phdrsize)) != 0)
294 		goto out;
295 
296 	/*
297 	 * Prevent executing an ELF file that has no entry point.
298 	 */
299 	if (ehdrp->e_entry == 0) {
300 		uprintf("%s: Bad entry point\n", exec_file);
301 		goto bad;
302 	}
303 
304 	/*
305 	 * Put data model that we're exec-ing to into the args passed to
306 	 * exec_args(), so it will know what it is copying to on new stack.
307 	 * Now that we know whether we are exec-ing a 32-bit or 64-bit
308 	 * executable, we can set execsz with the appropriate NCARGS.
309 	 */
310 #ifdef	_LP64
311 	if (ehdrp->e_ident[EI_CLASS] == ELFCLASS32) {
312 		args->to_model = DATAMODEL_ILP32;
313 		*execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS32-1);
314 	} else {
315 		args->to_model = DATAMODEL_LP64;
316 		args->stk_prot &= ~PROT_EXEC;
317 #if defined(__x86)
318 		args->dat_prot &= ~PROT_EXEC;
319 #endif
320 		*execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS64-1);
321 	}
322 #else	/* _LP64 */
323 	args->to_model = DATAMODEL_ILP32;
324 	*execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS-1);
325 #endif	/* _LP64 */
326 
327 	/*
328 	 * We delay invoking the brand callback until we've figured out
329 	 * what kind of elf binary we're trying to run, 32-bit or 64-bit.
330 	 * We do this because now the brand library can just check
331 	 * args->to_model to see if the target is 32-bit or 64-bit without
332 	 * having do duplicate all the code above.
333 	 *
334 	 * The level checks associated with brand handling below are used to
335 	 * prevent a loop since the brand elfexec function typically comes back
336 	 * through this function. We must check <= here since the nested
337 	 * handling in the #! interpreter code will increment the level before
338 	 * calling gexec to run the final elfexec interpreter.
339 	 */
340 	if ((level <= INTP_MAXDEPTH) &&
341 	    (brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
342 		error = BROP(p)->b_elfexec(vp, uap, args,
343 		    idatap, level + 1, execsz, setid, exec_file, cred,
344 		    brand_action);
345 		goto out;
346 	}
347 
348 	/*
349 	 * Determine aux size now so that stack can be built
350 	 * in one shot (except actual copyout of aux image),
351 	 * determine any non-default stack protections,
352 	 * and still have this code be machine independent.
353 	 */
354 	hsize = ehdrp->e_phentsize;
355 	phdrp = (Phdr *)phdrbase;
356 	for (i = nphdrs; i > 0; i--) {
357 		switch (phdrp->p_type) {
358 		case PT_INTERP:
359 			hasauxv = hasintp = 1;
360 			break;
361 		case PT_PHDR:
362 			hasu = 1;
363 			break;
364 		case PT_SUNWSTACK:
365 			args->stk_prot = PROT_USER;
366 			if (phdrp->p_flags & PF_R)
367 				args->stk_prot |= PROT_READ;
368 			if (phdrp->p_flags & PF_W)
369 				args->stk_prot |= PROT_WRITE;
370 			if (phdrp->p_flags & PF_X)
371 				args->stk_prot |= PROT_EXEC;
372 			break;
373 		case PT_LOAD:
374 			dataphdrp = phdrp;
375 			break;
376 		case PT_SUNWCAP:
377 			capphdr = phdrp;
378 			break;
379 		case PT_DYNAMIC:
380 			dynamicphdr = phdrp;
381 			break;
382 		}
383 		phdrp = (Phdr *)((caddr_t)phdrp + hsize);
384 	}
385 
386 	if (ehdrp->e_type != ET_EXEC) {
387 		dataphdrp = NULL;
388 		hasauxv = 1;
389 	}
390 
391 	/* Copy BSS permissions to args->dat_prot */
392 	if (dataphdrp != NULL) {
393 		args->dat_prot = PROT_USER;
394 		if (dataphdrp->p_flags & PF_R)
395 			args->dat_prot |= PROT_READ;
396 		if (dataphdrp->p_flags & PF_W)
397 			args->dat_prot |= PROT_WRITE;
398 		if (dataphdrp->p_flags & PF_X)
399 			args->dat_prot |= PROT_EXEC;
400 	}
401 
402 	/*
403 	 * If a auxvector will be required - reserve the space for
404 	 * it now.  This may be increased by exec_args if there are
405 	 * ISA-specific types (included in __KERN_NAUXV_IMPL).
406 	 */
407 	if (hasauxv) {
408 		/*
409 		 * If a AUX vector is being built - the base AUX
410 		 * entries are:
411 		 *
412 		 *	AT_BASE
413 		 *	AT_FLAGS
414 		 *	AT_PAGESZ
415 		 *	AT_SUN_AUXFLAGS
416 		 *	AT_SUN_HWCAP
417 		 *	AT_SUN_HWCAP2
418 		 *	AT_SUN_PLATFORM (added in stk_copyout)
419 		 *	AT_SUN_EXECNAME (added in stk_copyout)
420 		 *	AT_NULL
421 		 *
422 		 * total == 9
423 		 */
424 		if (hasintp && hasu) {
425 			/*
426 			 * Has PT_INTERP & PT_PHDR - the auxvectors that
427 			 * will be built are:
428 			 *
429 			 *	AT_PHDR
430 			 *	AT_PHENT
431 			 *	AT_PHNUM
432 			 *	AT_ENTRY
433 			 *	AT_LDDATA
434 			 *
435 			 * total = 5
436 			 */
437 			args->auxsize = (9 + 5) * sizeof (aux_entry_t);
438 		} else if (hasintp) {
439 			/*
440 			 * Has PT_INTERP but no PT_PHDR
441 			 *
442 			 *	AT_EXECFD
443 			 *	AT_LDDATA
444 			 *
445 			 * total = 2
446 			 */
447 			args->auxsize = (9 + 2) * sizeof (aux_entry_t);
448 		} else {
449 			args->auxsize = 9 * sizeof (aux_entry_t);
450 		}
451 	} else {
452 		args->auxsize = 0;
453 	}
454 
455 	/*
456 	 * If this binary is using an emulator, we need to add an
457 	 * AT_SUN_EMULATOR aux entry.
458 	 */
459 	if (args->emulator != NULL)
460 		args->auxsize += sizeof (aux_entry_t);
461 
462 	/*
463 	 * On supported kernels (x86_64) make room in the auxv for the
464 	 * AT_SUN_COMMPAGE entry.  This will go unpopulated on i86xpv systems
465 	 * which do not provide such functionality.
466 	 *
467 	 * Additionally cover the floating point information AT_SUN_FPSIZE and
468 	 * AT_SUN_FPTYPE.
469 	 */
470 #if defined(__amd64)
471 	args->auxsize += 3 * sizeof (aux_entry_t);
472 #endif /* defined(__amd64) */
473 
474 	if ((brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) {
475 		branded = 1;
476 		/*
477 		 * We will be adding 4 entries to the aux vectors.  One for
478 		 * the the brandname and 3 for the brand specific aux vectors.
479 		 */
480 		args->auxsize += 4 * sizeof (aux_entry_t);
481 	}
482 
483 	/* If the binary has an explicit ASLR flag, it must be honoured */
484 	if ((dynamicphdr != NULL) && (dynamicphdr->p_filesz > 0)) {
485 		const size_t dynfilesz = dynamicphdr->p_filesz;
486 		const size_t dynoffset = dynamicphdr->p_offset;
487 		Dyn *dyn, *dp;
488 
489 		if (dynoffset > MAXOFFSET_T ||
490 		    dynfilesz > MAXOFFSET_T ||
491 		    dynoffset + dynfilesz > MAXOFFSET_T) {
492 			uprintf("%s: cannot read full .dynamic section\n",
493 			    exec_file);
494 			error = EINVAL;
495 			goto out;
496 		}
497 
498 #define	DYN_STRIDE	100
499 		for (i = 0; i < dynfilesz; i += sizeof (*dyn) * DYN_STRIDE) {
500 			const size_t remdyns = (dynfilesz - i) / sizeof (*dyn);
501 			const size_t ndyns = MIN(DYN_STRIDE, remdyns);
502 			const size_t dynsize = ndyns * sizeof (*dyn);
503 
504 			dyn = kmem_alloc(dynsize, KM_SLEEP);
505 
506 			if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)dyn,
507 			    (ssize_t)dynsize, (offset_t)(dynoffset + i),
508 			    UIO_SYSSPACE, 0, (rlim64_t)0,
509 			    CRED(), &resid)) != 0) {
510 				uprintf("%s: cannot read .dynamic section\n",
511 				    exec_file);
512 				goto out;
513 			}
514 
515 			for (dp = dyn; dp < (dyn + ndyns); dp++) {
516 				if (dp->d_tag == DT_SUNW_ASLR) {
517 					if ((error = handle_secflag_dt(p,
518 					    DT_SUNW_ASLR,
519 					    dp->d_un.d_val)) != 0) {
520 						uprintf("%s: error setting "
521 						    "security-flag from "
522 						    "DT_SUNW_ASLR: %d\n",
523 						    exec_file, error);
524 						goto out;
525 					}
526 				}
527 			}
528 
529 			kmem_free(dyn, dynsize);
530 		}
531 	}
532 
533 	/* Hardware/Software capabilities */
534 	if (capphdr != NULL &&
535 	    (capsize = capphdr->p_filesz) > 0 &&
536 	    capsize <= 16 * sizeof (*cap)) {
537 		int ncaps = capsize / sizeof (*cap);
538 		Cap *cp;
539 
540 		cap = kmem_alloc(capsize, KM_SLEEP);
541 		if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)cap,
542 		    capsize, (offset_t)capphdr->p_offset,
543 		    UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid)) != 0) {
544 			uprintf("%s: Cannot read capabilities section\n",
545 			    exec_file);
546 			goto out;
547 		}
548 		for (cp = cap; cp < cap + ncaps; cp++) {
549 			if (cp->c_tag == CA_SUNW_SF_1 &&
550 			    (cp->c_un.c_val & SF1_SUNW_ADDR32)) {
551 				if (args->to_model == DATAMODEL_LP64)
552 					args->addr32 = 1;
553 				break;
554 			}
555 		}
556 	}
557 
558 	aux = bigwad->elfargs;
559 	/*
560 	 * Move args to the user's stack.
561 	 * This can fill in the AT_SUN_PLATFORM and AT_SUN_EXECNAME aux entries.
562 	 */
563 	if ((error = exec_args(uap, args, idatap, (void **)&aux)) != 0) {
564 		if (error == -1) {
565 			error = ENOEXEC;
566 			goto bad;
567 		}
568 		goto out;
569 	}
570 	/* we're single threaded after this point */
571 
572 	/*
573 	 * If this is an ET_DYN executable (shared object),
574 	 * determine its memory size so that mapelfexec() can load it.
575 	 */
576 	if (ehdrp->e_type == ET_DYN)
577 		len = elfsize(ehdrp, nphdrs, phdrbase, NULL);
578 	else
579 		len = 0;
580 
581 	dtrphdr = NULL;
582 
583 	if ((error = mapelfexec(vp, ehdrp, nphdrs, phdrbase, &uphdr, &intphdr,
584 	    &stphdr, &dtrphdr, dataphdrp, &bssbase, &brkbase, &voffset, NULL,
585 	    len, execsz, &brksize)) != 0)
586 		goto bad;
587 
588 	if (uphdr != NULL && intphdr == NULL)
589 		goto bad;
590 
591 	if (dtrphdr != NULL && dtrace_safe_phdr(dtrphdr, args, voffset) != 0) {
592 		uprintf("%s: Bad DTrace phdr in %s\n", exec_file, exec_file);
593 		goto bad;
594 	}
595 
596 	if (intphdr != NULL) {
597 		size_t		len;
598 		uintptr_t	lddata;
599 		char		*p;
600 		struct vnode	*nvp;
601 
602 		dlnsize = intphdr->p_filesz;
603 
604 		if (dlnsize > MAXPATHLEN || dlnsize <= 0)
605 			goto bad;
606 
607 		/*
608 		 * Read in "interpreter" pathname.
609 		 */
610 		if ((error = vn_rdwr(UIO_READ, vp, dlnp, intphdr->p_filesz,
611 		    (offset_t)intphdr->p_offset, UIO_SYSSPACE, 0, (rlim64_t)0,
612 		    CRED(), &resid)) != 0) {
613 			uprintf("%s: Cannot obtain interpreter pathname\n",
614 			    exec_file);
615 			goto bad;
616 		}
617 
618 		if (resid != 0 || dlnp[dlnsize - 1] != '\0')
619 			goto bad;
620 
621 		/*
622 		 * Search for '$ORIGIN' token in interpreter path.
623 		 * If found, expand it.
624 		 */
625 		for (p = dlnp; p = strchr(p, '$'); ) {
626 			uint_t	len, curlen;
627 			char	*_ptr;
628 
629 			if (strncmp(++p, ORIGIN_STR, ORIGIN_STR_SIZE))
630 				continue;
631 
632 			/*
633 			 * We don't support $ORIGIN on setid programs to close
634 			 * a potential attack vector.
635 			 */
636 			if ((setid & EXECSETID_SETID) != 0) {
637 				error = ENOEXEC;
638 				goto bad;
639 			}
640 
641 			curlen = 0;
642 			len = p - dlnp - 1;
643 			if (len) {
644 				bcopy(dlnp, pathbufp, len);
645 				curlen += len;
646 			}
647 			if (_ptr = strrchr(args->pathname, '/')) {
648 				len = _ptr - args->pathname;
649 				if ((curlen + len) > MAXPATHLEN)
650 					break;
651 
652 				bcopy(args->pathname, &pathbufp[curlen], len);
653 				curlen += len;
654 			} else {
655 				/*
656 				 * executable is a basename found in the
657 				 * current directory.  So - just substitue
658 				 * '.' for ORIGIN.
659 				 */
660 				pathbufp[curlen] = '.';
661 				curlen++;
662 			}
663 			p += ORIGIN_STR_SIZE;
664 			len = strlen(p);
665 
666 			if ((curlen + len) > MAXPATHLEN)
667 				break;
668 			bcopy(p, &pathbufp[curlen], len);
669 			curlen += len;
670 			pathbufp[curlen++] = '\0';
671 			bcopy(pathbufp, dlnp, curlen);
672 		}
673 
674 		/*
675 		 * /usr/lib/ld.so.1 is known to be a symlink to /lib/ld.so.1
676 		 * (and /usr/lib/64/ld.so.1 is a symlink to /lib/64/ld.so.1).
677 		 * Just in case /usr is not mounted, change it now.
678 		 */
679 		if (strcmp(dlnp, USR_LIB_RTLD) == 0)
680 			dlnp += 4;
681 		error = lookupname(dlnp, UIO_SYSSPACE, FOLLOW, NULLVPP, &nvp);
682 		if (error && dlnp != bigwad->dl_name) {
683 			/* new kernel, old user-level */
684 			error = lookupname(dlnp -= 4, UIO_SYSSPACE, FOLLOW,
685 			    NULLVPP, &nvp);
686 		}
687 		if (error) {
688 			uprintf("%s: Cannot find %s\n", exec_file, dlnp);
689 			goto bad;
690 		}
691 
692 		/*
693 		 * Setup the "aux" vector.
694 		 */
695 		if (uphdr) {
696 			if (ehdrp->e_type == ET_DYN) {
697 				/* don't use the first page */
698 				bigwad->exenv.ex_brkbase = (caddr_t)PAGESIZE;
699 				bigwad->exenv.ex_bssbase = (caddr_t)PAGESIZE;
700 			} else {
701 				bigwad->exenv.ex_bssbase = bssbase;
702 				bigwad->exenv.ex_brkbase = brkbase;
703 			}
704 			bigwad->exenv.ex_brksize = brksize;
705 			bigwad->exenv.ex_magic = elfmagic;
706 			bigwad->exenv.ex_vp = vp;
707 			setexecenv(&bigwad->exenv);
708 
709 			ADDAUX(aux, AT_PHDR, uphdr->p_vaddr + voffset)
710 			ADDAUX(aux, AT_PHENT, ehdrp->e_phentsize)
711 			ADDAUX(aux, AT_PHNUM, nphdrs)
712 			ADDAUX(aux, AT_ENTRY, ehdrp->e_entry + voffset)
713 		} else {
714 			if ((error = execopen(&vp, &fd)) != 0) {
715 				VN_RELE(nvp);
716 				goto bad;
717 			}
718 
719 			ADDAUX(aux, AT_EXECFD, fd)
720 		}
721 
722 		if ((error = execpermissions(nvp, &bigwad->vattr, args)) != 0) {
723 			VN_RELE(nvp);
724 			uprintf("%s: Cannot execute %s\n", exec_file, dlnp);
725 			goto bad;
726 		}
727 
728 		/*
729 		 * Now obtain the ELF header along with the entire program
730 		 * header contained in "nvp".
731 		 */
732 		kmem_free(phdrbase, phdrsize);
733 		phdrbase = NULL;
734 		if ((error = getelfhead(nvp, CRED(), ehdrp, &nshdrs,
735 		    &shstrndx, &nphdrs)) != 0 ||
736 		    (error = getelfphdr(nvp, CRED(), ehdrp, nphdrs, &phdrbase,
737 		    &phdrsize)) != 0) {
738 			VN_RELE(nvp);
739 			uprintf("%s: Cannot read %s\n", exec_file, dlnp);
740 			goto bad;
741 		}
742 
743 		/*
744 		 * Determine memory size of the "interpreter's" loadable
745 		 * sections.  This size is then used to obtain the virtual
746 		 * address of a hole, in the user's address space, large
747 		 * enough to map the "interpreter".
748 		 */
749 		if ((len = elfsize(ehdrp, nphdrs, phdrbase, &lddata)) == 0) {
750 			VN_RELE(nvp);
751 			uprintf("%s: Nothing to load in %s\n", exec_file, dlnp);
752 			goto bad;
753 		}
754 
755 		dtrphdr = NULL;
756 
757 		error = mapelfexec(nvp, ehdrp, nphdrs, phdrbase, &junk, &junk,
758 		    &junk, &dtrphdr, NULL, NULL, NULL, &voffset, NULL, len,
759 		    execsz, NULL);
760 		if (error || junk != NULL) {
761 			VN_RELE(nvp);
762 			uprintf("%s: Cannot map %s\n", exec_file, dlnp);
763 			goto bad;
764 		}
765 
766 		/*
767 		 * We use the DTrace program header to initialize the
768 		 * architecture-specific user per-LWP location. The dtrace
769 		 * fasttrap provider requires ready access to per-LWP scratch
770 		 * space. We assume that there is only one such program header
771 		 * in the interpreter.
772 		 */
773 		if (dtrphdr != NULL &&
774 		    dtrace_safe_phdr(dtrphdr, args, voffset) != 0) {
775 			VN_RELE(nvp);
776 			uprintf("%s: Bad DTrace phdr in %s\n", exec_file, dlnp);
777 			goto bad;
778 		}
779 
780 		VN_RELE(nvp);
781 		ADDAUX(aux, AT_SUN_LDDATA, voffset + lddata)
782 	}
783 
784 	if (hasauxv) {
785 		int auxf = AF_SUN_HWCAPVERIFY;
786 #if defined(__amd64)
787 		size_t fpsize;
788 		int fptype;
789 #endif /* defined(__amd64) */
790 
791 		/*
792 		 * Note: AT_SUN_PLATFORM and AT_SUN_EXECNAME were filled in via
793 		 * exec_args()
794 		 */
795 		ADDAUX(aux, AT_BASE, voffset)
796 		ADDAUX(aux, AT_FLAGS, at_flags)
797 		ADDAUX(aux, AT_PAGESZ, PAGESIZE)
798 		/*
799 		 * Linker flags. (security)
800 		 * p_flag not yet set at this time.
801 		 * We rely on gexec() to provide us with the information.
802 		 * If the application is set-uid but this is not reflected
803 		 * in a mismatch between real/effective uids/gids, then
804 		 * don't treat this as a set-uid exec.  So we care about
805 		 * the EXECSETID_UGIDS flag but not the ...SETID flag.
806 		 */
807 		if ((setid &= ~EXECSETID_SETID) != 0)
808 			auxf |= AF_SUN_SETUGID;
809 
810 		/*
811 		 * If we're running a native process from within a branded
812 		 * zone under pfexec then we clear the AF_SUN_SETUGID flag so
813 		 * that the native ld.so.1 is able to link with the native
814 		 * libraries instead of using the brand libraries that are
815 		 * installed in the zone.  We only do this for processes
816 		 * which we trust because we see they are already running
817 		 * under pfexec (where uid != euid).  This prevents a
818 		 * malicious user within the zone from crafting a wrapper to
819 		 * run native suid commands with unsecure libraries interposed.
820 		 */
821 		if ((brand_action == EBA_NATIVE) && (PROC_IS_BRANDED(p) &&
822 		    (setid &= ~EXECSETID_SETID) != 0))
823 			auxf &= ~AF_SUN_SETUGID;
824 
825 		/*
826 		 * Record the user addr of the auxflags aux vector entry
827 		 * since brands may optionally want to manipulate this field.
828 		 */
829 		args->auxp_auxflags =
830 		    (char *)((char *)args->stackend +
831 		    ((char *)&aux->a_type -
832 		    (char *)bigwad->elfargs));
833 		ADDAUX(aux, AT_SUN_AUXFLAGS, auxf);
834 
835 		/*
836 		 * Hardware capability flag word (performance hints)
837 		 * Used for choosing faster library routines.
838 		 * (Potentially different between 32-bit and 64-bit ABIs)
839 		 */
840 #if defined(_LP64)
841 		if (args->to_model == DATAMODEL_NATIVE) {
842 			ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap)
843 			ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2)
844 		} else {
845 			ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap32)
846 			ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap32_2)
847 		}
848 #else
849 		ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap)
850 		ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2)
851 #endif
852 		if (branded) {
853 			/*
854 			 * Reserve space for the brand-private aux vectors,
855 			 * and record the user addr of that space.
856 			 */
857 			args->auxp_brand =
858 			    (char *)((char *)args->stackend +
859 			    ((char *)&aux->a_type -
860 			    (char *)bigwad->elfargs));
861 			ADDAUX(aux, AT_SUN_BRAND_AUX1, 0)
862 			ADDAUX(aux, AT_SUN_BRAND_AUX2, 0)
863 			ADDAUX(aux, AT_SUN_BRAND_AUX3, 0)
864 		}
865 
866 		/*
867 		 * Add the comm page auxv entry, mapping it in if needed. Also
868 		 * take care of the FPU entries.
869 		 */
870 #if defined(__amd64)
871 		if (args->commpage != (uintptr_t)NULL ||
872 		    (args->commpage = (uintptr_t)comm_page_mapin()) !=
873 		    (uintptr_t)NULL) {
874 			ADDAUX(aux, AT_SUN_COMMPAGE, args->commpage)
875 		} else {
876 			/*
877 			 * If the comm page cannot be mapped, pad out the auxv
878 			 * to satisfy later size checks.
879 			 */
880 			ADDAUX(aux, AT_NULL, 0)
881 		}
882 
883 		fptype = AT_386_FPINFO_NONE;
884 		fpu_auxv_info(&fptype, &fpsize);
885 		if (fptype != AT_386_FPINFO_NONE) {
886 			ADDAUX(aux, AT_SUN_FPTYPE, fptype)
887 			ADDAUX(aux, AT_SUN_FPSIZE, fpsize)
888 		} else {
889 			ADDAUX(aux, AT_NULL, 0)
890 			ADDAUX(aux, AT_NULL, 0)
891 		}
892 #endif /* defined(__amd64) */
893 
894 		ADDAUX(aux, AT_NULL, 0)
895 		postfixsize = (char *)aux - (char *)bigwad->elfargs;
896 
897 		/*
898 		 * We make assumptions above when we determine how many aux
899 		 * vector entries we will be adding. However, if we have an
900 		 * invalid elf file, it is possible that mapelfexec might
901 		 * behave differently (but not return an error), in which case
902 		 * the number of aux entries we actually add will be different.
903 		 * We detect that now and error out.
904 		 */
905 		if (postfixsize != args->auxsize) {
906 			DTRACE_PROBE2(elfexec_badaux, int, postfixsize,
907 			    int, args->auxsize);
908 			goto bad;
909 		}
910 		ASSERT(postfixsize <= __KERN_NAUXV_IMPL * sizeof (aux_entry_t));
911 	}
912 
913 	/*
914 	 * For the 64-bit kernel, the limit is big enough that rounding it up
915 	 * to a page can overflow the 64-bit limit, so we check for btopr()
916 	 * overflowing here by comparing it with the unrounded limit in pages.
917 	 * If it hasn't overflowed, compare the exec size with the rounded up
918 	 * limit in pages.  Otherwise, just compare with the unrounded limit.
919 	 */
920 	limit = btop(p->p_vmem_ctl);
921 	roundlimit = btopr(p->p_vmem_ctl);
922 	if ((roundlimit > limit && *execsz > roundlimit) ||
923 	    (roundlimit < limit && *execsz > limit)) {
924 		mutex_enter(&p->p_lock);
925 		(void) rctl_action(rctlproc_legacy[RLIMIT_VMEM], p->p_rctls, p,
926 		    RCA_SAFE);
927 		mutex_exit(&p->p_lock);
928 		error = ENOMEM;
929 		goto bad;
930 	}
931 
932 	bzero(up->u_auxv, sizeof (up->u_auxv));
933 	up->u_commpagep = args->commpage;
934 	if (postfixsize) {
935 		int num_auxv;
936 
937 		/*
938 		 * Copy the aux vector to the user stack.
939 		 */
940 		error = execpoststack(args, bigwad->elfargs, postfixsize);
941 		if (error)
942 			goto bad;
943 
944 		/*
945 		 * Copy auxv to the process's user structure for use by /proc.
946 		 * If this is a branded process, the brand's exec routine will
947 		 * copy it's private entries to the user structure later. It
948 		 * relies on the fact that the blank entries are at the end.
949 		 */
950 		num_auxv = postfixsize / sizeof (aux_entry_t);
951 		ASSERT(num_auxv <= sizeof (up->u_auxv) / sizeof (auxv_t));
952 		aux = bigwad->elfargs;
953 		for (i = 0; i < num_auxv; i++) {
954 			up->u_auxv[i].a_type = aux[i].a_type;
955 			up->u_auxv[i].a_un.a_val = (aux_val_t)aux[i].a_un.a_val;
956 		}
957 	}
958 
959 	/*
960 	 * Pass back the starting address so we can set the program counter.
961 	 */
962 	args->entry = (uintptr_t)(ehdrp->e_entry + voffset);
963 
964 	if (!uphdr) {
965 		if (ehdrp->e_type == ET_DYN) {
966 			/*
967 			 * If we are executing a shared library which doesn't
968 			 * have a interpreter (probably ld.so.1) then
969 			 * we don't set the brkbase now.  Instead we
970 			 * delay it's setting until the first call
971 			 * via grow.c::brk().  This permits ld.so.1 to
972 			 * initialize brkbase to the tail of the executable it
973 			 * loads (which is where it needs to be).
974 			 */
975 			bigwad->exenv.ex_brkbase = (caddr_t)0;
976 			bigwad->exenv.ex_bssbase = (caddr_t)0;
977 			bigwad->exenv.ex_brksize = 0;
978 		} else {
979 			bigwad->exenv.ex_brkbase = brkbase;
980 			bigwad->exenv.ex_bssbase = bssbase;
981 			bigwad->exenv.ex_brksize = brksize;
982 		}
983 		bigwad->exenv.ex_magic = elfmagic;
984 		bigwad->exenv.ex_vp = vp;
985 		setexecenv(&bigwad->exenv);
986 	}
987 
988 	ASSERT(error == 0);
989 	goto out;
990 
991 bad:
992 	if (fd != -1)		/* did we open the a.out yet */
993 		(void) execclose(fd);
994 
995 	psignal(p, SIGKILL);
996 
997 	if (error == 0)
998 		error = ENOEXEC;
999 out:
1000 	if (phdrbase != NULL)
1001 		kmem_free(phdrbase, phdrsize);
1002 	if (cap != NULL)
1003 		kmem_free(cap, capsize);
1004 	kmem_free(bigwad, sizeof (struct bigwad));
1005 	return (error);
1006 }
1007 
1008 /*
1009  * Compute the memory size requirement for the ELF file.
1010  */
1011 static size_t
elfsize(Ehdr * ehdrp,int nphdrs,caddr_t phdrbase,uintptr_t * lddata)1012 elfsize(Ehdr *ehdrp, int nphdrs, caddr_t phdrbase, uintptr_t *lddata)
1013 {
1014 	size_t	len;
1015 	Phdr	*phdrp = (Phdr *)phdrbase;
1016 	int	hsize = ehdrp->e_phentsize;
1017 	int	first = 1;
1018 	int	dfirst = 1;	/* first data segment */
1019 	uintptr_t loaddr = 0;
1020 	uintptr_t hiaddr = 0;
1021 	uintptr_t lo, hi;
1022 	int	i;
1023 
1024 	for (i = nphdrs; i > 0; i--) {
1025 		if (phdrp->p_type == PT_LOAD) {
1026 			lo = phdrp->p_vaddr;
1027 			hi = lo + phdrp->p_memsz;
1028 			if (first) {
1029 				loaddr = lo;
1030 				hiaddr = hi;
1031 				first = 0;
1032 			} else {
1033 				if (loaddr > lo)
1034 					loaddr = lo;
1035 				if (hiaddr < hi)
1036 					hiaddr = hi;
1037 			}
1038 
1039 			/*
1040 			 * save the address of the first data segment
1041 			 * of a object - used for the AT_SUNW_LDDATA
1042 			 * aux entry.
1043 			 */
1044 			if ((lddata != NULL) && dfirst &&
1045 			    (phdrp->p_flags & PF_W)) {
1046 				*lddata = lo;
1047 				dfirst = 0;
1048 			}
1049 		}
1050 		phdrp = (Phdr *)((caddr_t)phdrp + hsize);
1051 	}
1052 
1053 	len = hiaddr - (loaddr & PAGEMASK);
1054 	len = roundup(len, PAGESIZE);
1055 
1056 	return (len);
1057 }
1058 
1059 /*
1060  * Read in the ELF header and program header table.
1061  * SUSV3 requires:
1062  *	ENOEXEC	File format is not recognized
1063  *	EINVAL	Format recognized but execution not supported
1064  */
1065 static int
getelfhead(vnode_t * vp,cred_t * credp,Ehdr * ehdr,int * nshdrs,int * shstrndx,int * nphdrs)1066 getelfhead(vnode_t *vp, cred_t *credp, Ehdr *ehdr, int *nshdrs, int *shstrndx,
1067     int *nphdrs)
1068 {
1069 	int error;
1070 	ssize_t resid;
1071 
1072 	/*
1073 	 * We got here by the first two bytes in ident,
1074 	 * now read the entire ELF header.
1075 	 */
1076 	if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)ehdr,
1077 	    sizeof (Ehdr), (offset_t)0, UIO_SYSSPACE, 0,
1078 	    (rlim64_t)0, credp, &resid)) != 0)
1079 		return (error);
1080 
1081 	/*
1082 	 * Since a separate version is compiled for handling 32-bit and
1083 	 * 64-bit ELF executables on a 64-bit kernel, the 64-bit version
1084 	 * doesn't need to be able to deal with 32-bit ELF files.
1085 	 */
1086 	if (resid != 0 ||
1087 	    ehdr->e_ident[EI_MAG2] != ELFMAG2 ||
1088 	    ehdr->e_ident[EI_MAG3] != ELFMAG3)
1089 		return (ENOEXEC);
1090 
1091 	if ((ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) ||
1092 #if defined(_ILP32) || defined(_ELF32_COMPAT)
1093 	    ehdr->e_ident[EI_CLASS] != ELFCLASS32 ||
1094 #else
1095 	    ehdr->e_ident[EI_CLASS] != ELFCLASS64 ||
1096 #endif
1097 	    !elfheadcheck(ehdr->e_ident[EI_DATA], ehdr->e_machine,
1098 	    ehdr->e_flags))
1099 		return (EINVAL);
1100 
1101 	*nshdrs = ehdr->e_shnum;
1102 	*shstrndx = ehdr->e_shstrndx;
1103 	*nphdrs = ehdr->e_phnum;
1104 
1105 	/*
1106 	 * If e_shnum, e_shstrndx, or e_phnum is its sentinel value, we need
1107 	 * to read in the section header at index zero to acces the true
1108 	 * values for those fields.
1109 	 */
1110 	if ((*nshdrs == 0 && ehdr->e_shoff != 0) ||
1111 	    *shstrndx == SHN_XINDEX || *nphdrs == PN_XNUM) {
1112 		Shdr shdr;
1113 
1114 		if (ehdr->e_shoff == 0)
1115 			return (EINVAL);
1116 
1117 		if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)&shdr,
1118 		    sizeof (shdr), (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0,
1119 		    (rlim64_t)0, credp, &resid)) != 0)
1120 			return (error);
1121 
1122 		if (*nshdrs == 0)
1123 			*nshdrs = shdr.sh_size;
1124 		if (*shstrndx == SHN_XINDEX)
1125 			*shstrndx = shdr.sh_link;
1126 		if (*nphdrs == PN_XNUM && shdr.sh_info != 0)
1127 			*nphdrs = shdr.sh_info;
1128 	}
1129 
1130 	return (0);
1131 }
1132 
1133 #ifdef _ELF32_COMPAT
1134 extern size_t elf_nphdr_max;
1135 #else
1136 size_t elf_nphdr_max = 1000;
1137 #endif
1138 
1139 static int
getelfphdr(vnode_t * vp,cred_t * credp,const Ehdr * ehdr,int nphdrs,caddr_t * phbasep,ssize_t * phsizep)1140 getelfphdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, int nphdrs,
1141     caddr_t *phbasep, ssize_t *phsizep)
1142 {
1143 	ssize_t resid, minsize;
1144 	int err;
1145 
1146 	/*
1147 	 * Since we're going to be using e_phentsize to iterate down the
1148 	 * array of program headers, it must be 8-byte aligned or else
1149 	 * a we might cause a misaligned access. We use all members through
1150 	 * p_flags on 32-bit ELF files and p_memsz on 64-bit ELF files so
1151 	 * e_phentsize must be at least large enough to include those
1152 	 * members.
1153 	 */
1154 #if !defined(_LP64) || defined(_ELF32_COMPAT)
1155 	minsize = offsetof(Phdr, p_flags) + sizeof (((Phdr *)NULL)->p_flags);
1156 #else
1157 	minsize = offsetof(Phdr, p_memsz) + sizeof (((Phdr *)NULL)->p_memsz);
1158 #endif
1159 	if (ehdr->e_phentsize < minsize || (ehdr->e_phentsize & 3))
1160 		return (EINVAL);
1161 
1162 	*phsizep = nphdrs * ehdr->e_phentsize;
1163 
1164 	if (*phsizep > sizeof (Phdr) * elf_nphdr_max) {
1165 		if ((*phbasep = kmem_alloc(*phsizep, KM_NOSLEEP)) == NULL)
1166 			return (ENOMEM);
1167 	} else {
1168 		*phbasep = kmem_alloc(*phsizep, KM_SLEEP);
1169 	}
1170 
1171 	if ((err = vn_rdwr(UIO_READ, vp, *phbasep, *phsizep,
1172 	    (offset_t)ehdr->e_phoff, UIO_SYSSPACE, 0, (rlim64_t)0,
1173 	    credp, &resid)) != 0) {
1174 		kmem_free(*phbasep, *phsizep);
1175 		*phbasep = NULL;
1176 		return (err);
1177 	}
1178 
1179 	return (0);
1180 }
1181 
1182 #ifdef _ELF32_COMPAT
1183 extern size_t elf_nshdr_max;
1184 extern size_t elf_shstrtab_max;
1185 #else
1186 size_t elf_nshdr_max = 10000;
1187 size_t elf_shstrtab_max = 100 * 1024;
1188 #endif
1189 
1190 
1191 static int
getelfshdr(vnode_t * vp,cred_t * credp,const Ehdr * ehdr,int nshdrs,int shstrndx,caddr_t * shbasep,ssize_t * shsizep,char ** shstrbasep,ssize_t * shstrsizep)1192 getelfshdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr,
1193     int nshdrs, int shstrndx, caddr_t *shbasep, ssize_t *shsizep,
1194     char **shstrbasep, ssize_t *shstrsizep)
1195 {
1196 	ssize_t resid, minsize;
1197 	int err;
1198 	Shdr *shdr;
1199 
1200 	/*
1201 	 * Since we're going to be using e_shentsize to iterate down the
1202 	 * array of section headers, it must be 8-byte aligned or else
1203 	 * a we might cause a misaligned access. We use all members through
1204 	 * sh_entsize (on both 32- and 64-bit ELF files) so e_shentsize
1205 	 * must be at least large enough to include that member. The index
1206 	 * of the string table section must also be valid.
1207 	 */
1208 	minsize = offsetof(Shdr, sh_entsize) + sizeof (shdr->sh_entsize);
1209 	if (ehdr->e_shentsize < minsize || (ehdr->e_shentsize & 3) ||
1210 	    shstrndx >= nshdrs)
1211 		return (EINVAL);
1212 
1213 	*shsizep = nshdrs * ehdr->e_shentsize;
1214 
1215 	if (*shsizep > sizeof (Shdr) * elf_nshdr_max) {
1216 		if ((*shbasep = kmem_alloc(*shsizep, KM_NOSLEEP)) == NULL)
1217 			return (ENOMEM);
1218 	} else {
1219 		*shbasep = kmem_alloc(*shsizep, KM_SLEEP);
1220 	}
1221 
1222 	if ((err = vn_rdwr(UIO_READ, vp, *shbasep, *shsizep,
1223 	    (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, (rlim64_t)0,
1224 	    credp, &resid)) != 0) {
1225 		kmem_free(*shbasep, *shsizep);
1226 		return (err);
1227 	}
1228 
1229 	/*
1230 	 * Pull the section string table out of the vnode; fail if the size
1231 	 * is zero.
1232 	 */
1233 	shdr = (Shdr *)(*shbasep + shstrndx * ehdr->e_shentsize);
1234 	if ((*shstrsizep = shdr->sh_size) == 0) {
1235 		kmem_free(*shbasep, *shsizep);
1236 		return (EINVAL);
1237 	}
1238 
1239 	if (*shstrsizep > elf_shstrtab_max) {
1240 		if ((*shstrbasep = kmem_alloc(*shstrsizep,
1241 		    KM_NOSLEEP)) == NULL) {
1242 			kmem_free(*shbasep, *shsizep);
1243 			return (ENOMEM);
1244 		}
1245 	} else {
1246 		*shstrbasep = kmem_alloc(*shstrsizep, KM_SLEEP);
1247 	}
1248 
1249 	if ((err = vn_rdwr(UIO_READ, vp, *shstrbasep, *shstrsizep,
1250 	    (offset_t)shdr->sh_offset, UIO_SYSSPACE, 0, (rlim64_t)0,
1251 	    credp, &resid)) != 0) {
1252 		kmem_free(*shbasep, *shsizep);
1253 		kmem_free(*shstrbasep, *shstrsizep);
1254 		return (err);
1255 	}
1256 
1257 	/*
1258 	 * Make sure the strtab is null-terminated to make sure we
1259 	 * don't run off the end of the table.
1260 	 */
1261 	(*shstrbasep)[*shstrsizep - 1] = '\0';
1262 
1263 	return (0);
1264 }
1265 
1266 static int
mapelfexec(vnode_t * vp,Ehdr * ehdr,int nphdrs,caddr_t phdrbase,Phdr ** uphdr,Phdr ** intphdr,Phdr ** stphdr,Phdr ** dtphdr,Phdr * dataphdrp,caddr_t * bssbase,caddr_t * brkbase,intptr_t * voffset,intptr_t * minaddr,size_t len,long * execsz,size_t * brksize)1267 mapelfexec(
1268 	vnode_t *vp,
1269 	Ehdr *ehdr,
1270 	int nphdrs,
1271 	caddr_t phdrbase,
1272 	Phdr **uphdr,
1273 	Phdr **intphdr,
1274 	Phdr **stphdr,
1275 	Phdr **dtphdr,
1276 	Phdr *dataphdrp,
1277 	caddr_t *bssbase,
1278 	caddr_t *brkbase,
1279 	intptr_t *voffset,
1280 	intptr_t *minaddr,
1281 	size_t len,
1282 	long *execsz,
1283 	size_t *brksize)
1284 {
1285 	Phdr *phdr;
1286 	int i, prot, error;
1287 	caddr_t addr = NULL;
1288 	size_t zfodsz;
1289 	int ptload = 0;
1290 	int page;
1291 	off_t offset;
1292 	int hsize = ehdr->e_phentsize;
1293 	caddr_t mintmp = (caddr_t)-1;
1294 	extern int use_brk_lpg;
1295 
1296 	if (ehdr->e_type == ET_DYN) {
1297 		secflagset_t flags = 0;
1298 		/*
1299 		 * Obtain the virtual address of a hole in the
1300 		 * address space to map the "interpreter".
1301 		 */
1302 		if (secflag_enabled(curproc, PROC_SEC_ASLR))
1303 			flags |= _MAP_RANDOMIZE;
1304 
1305 		map_addr(&addr, len, (offset_t)0, 1, flags);
1306 		if (addr == NULL)
1307 			return (ENOMEM);
1308 		*voffset = (intptr_t)addr;
1309 
1310 		/*
1311 		 * Calculate the minimum vaddr so it can be subtracted out.
1312 		 * According to the ELF specification, since PT_LOAD sections
1313 		 * must be sorted by increasing p_vaddr values, this is
1314 		 * guaranteed to be the first PT_LOAD section.
1315 		 */
1316 		phdr = (Phdr *)phdrbase;
1317 		for (i = nphdrs; i > 0; i--) {
1318 			if (phdr->p_type == PT_LOAD) {
1319 				*voffset -= (uintptr_t)phdr->p_vaddr;
1320 				break;
1321 			}
1322 			phdr = (Phdr *)((caddr_t)phdr + hsize);
1323 		}
1324 
1325 	} else {
1326 		*voffset = 0;
1327 	}
1328 	phdr = (Phdr *)phdrbase;
1329 	for (i = nphdrs; i > 0; i--) {
1330 		switch (phdr->p_type) {
1331 		case PT_LOAD:
1332 			if ((*intphdr != NULL) && (*uphdr == NULL))
1333 				return (0);
1334 
1335 			ptload = 1;
1336 			prot = PROT_USER;
1337 			if (phdr->p_flags & PF_R)
1338 				prot |= PROT_READ;
1339 			if (phdr->p_flags & PF_W)
1340 				prot |= PROT_WRITE;
1341 			if (phdr->p_flags & PF_X)
1342 				prot |= PROT_EXEC;
1343 
1344 			addr = (caddr_t)((uintptr_t)phdr->p_vaddr + *voffset);
1345 
1346 			/*
1347 			 * Keep track of the segment with the lowest starting
1348 			 * address.
1349 			 */
1350 			if (addr < mintmp)
1351 				mintmp = addr;
1352 
1353 			zfodsz = (size_t)phdr->p_memsz - phdr->p_filesz;
1354 
1355 			offset = phdr->p_offset;
1356 			if (((uintptr_t)offset & PAGEOFFSET) ==
1357 			    ((uintptr_t)addr & PAGEOFFSET) &&
1358 			    (!(vp->v_flag & VNOMAP))) {
1359 				page = 1;
1360 			} else {
1361 				page = 0;
1362 			}
1363 
1364 			/*
1365 			 * Set the heap pagesize for OOB when the bss size
1366 			 * is known and use_brk_lpg is not 0.
1367 			 */
1368 			if (brksize != NULL && use_brk_lpg &&
1369 			    zfodsz != 0 && phdr == dataphdrp &&
1370 			    (prot & PROT_WRITE)) {
1371 				size_t tlen = P2NPHASE((uintptr_t)addr +
1372 				    phdr->p_filesz, PAGESIZE);
1373 
1374 				if (zfodsz > tlen) {
1375 					curproc->p_brkpageszc =
1376 					    page_szc(map_pgsz(MAPPGSZ_HEAP,
1377 					    curproc, addr + phdr->p_filesz +
1378 					    tlen, zfodsz - tlen, 0));
1379 				}
1380 			}
1381 
1382 			if (curproc->p_brkpageszc != 0 && phdr == dataphdrp &&
1383 			    (prot & PROT_WRITE)) {
1384 				uint_t	szc = curproc->p_brkpageszc;
1385 				size_t pgsz = page_get_pagesize(szc);
1386 				caddr_t ebss = addr + phdr->p_memsz;
1387 				/*
1388 				 * If we need extra space to keep the BSS an
1389 				 * integral number of pages in size, some of
1390 				 * that space may fall beyond p_brkbase, so we
1391 				 * need to set p_brksize to account for it
1392 				 * being (logically) part of the brk.
1393 				 */
1394 				size_t extra_zfodsz;
1395 
1396 				ASSERT(pgsz > PAGESIZE);
1397 
1398 				extra_zfodsz = P2NPHASE((uintptr_t)ebss, pgsz);
1399 
1400 				if (error = execmap(vp, addr, phdr->p_filesz,
1401 				    zfodsz + extra_zfodsz, phdr->p_offset,
1402 				    prot, page, szc))
1403 					goto bad;
1404 				if (brksize != NULL)
1405 					*brksize = extra_zfodsz;
1406 			} else {
1407 				if (error = execmap(vp, addr, phdr->p_filesz,
1408 				    zfodsz, phdr->p_offset, prot, page, 0))
1409 					goto bad;
1410 			}
1411 
1412 			if (bssbase != NULL && addr >= *bssbase &&
1413 			    phdr == dataphdrp) {
1414 				*bssbase = addr + phdr->p_filesz;
1415 			}
1416 			if (brkbase != NULL && addr >= *brkbase) {
1417 				*brkbase = addr + phdr->p_memsz;
1418 			}
1419 
1420 			*execsz += btopr(phdr->p_memsz);
1421 			break;
1422 
1423 		case PT_INTERP:
1424 			if (ptload)
1425 				goto bad;
1426 			*intphdr = phdr;
1427 			break;
1428 
1429 		case PT_SHLIB:
1430 			*stphdr = phdr;
1431 			break;
1432 
1433 		case PT_PHDR:
1434 			if (ptload)
1435 				goto bad;
1436 			*uphdr = phdr;
1437 			break;
1438 
1439 		case PT_NULL:
1440 		case PT_DYNAMIC:
1441 		case PT_NOTE:
1442 			break;
1443 
1444 		case PT_SUNWDTRACE:
1445 			if (dtphdr != NULL)
1446 				*dtphdr = phdr;
1447 			break;
1448 
1449 		default:
1450 			break;
1451 		}
1452 		phdr = (Phdr *)((caddr_t)phdr + hsize);
1453 	}
1454 
1455 	if (minaddr != NULL) {
1456 		ASSERT(mintmp != (caddr_t)-1);
1457 		*minaddr = (intptr_t)mintmp;
1458 	}
1459 
1460 	if (brkbase != NULL && secflag_enabled(curproc, PROC_SEC_ASLR)) {
1461 		size_t off;
1462 		uintptr_t base = (uintptr_t)*brkbase;
1463 		uintptr_t oend = base + *brksize;
1464 
1465 		ASSERT(ISP2(aslr_max_brk_skew));
1466 
1467 		(void) random_get_pseudo_bytes((uint8_t *)&off, sizeof (off));
1468 		base += P2PHASE(off, aslr_max_brk_skew);
1469 		base = P2ROUNDUP(base, PAGESIZE);
1470 		*brkbase = (caddr_t)base;
1471 		/*
1472 		 * Above, we set *brksize to account for the possibility we
1473 		 * had to grow the 'brk' in padding out the BSS to a page
1474 		 * boundary.
1475 		 *
1476 		 * We now need to adjust that based on where we now are
1477 		 * actually putting the brk.
1478 		 */
1479 		if (oend > base)
1480 			*brksize = oend - base;
1481 		else
1482 			*brksize = 0;
1483 	}
1484 
1485 	return (0);
1486 bad:
1487 	if (error == 0)
1488 		error = EINVAL;
1489 	return (error);
1490 }
1491 
1492 int
elfnote(vnode_t * vp,offset_t * offsetp,int type,int descsz,void * desc,rlim64_t rlimit,cred_t * credp)1493 elfnote(vnode_t *vp, offset_t *offsetp, int type, int descsz, void *desc,
1494     rlim64_t rlimit, cred_t *credp)
1495 {
1496 	Note note;
1497 	int error;
1498 
1499 	bzero(&note, sizeof (note));
1500 	bcopy("CORE", note.name, 4);
1501 	note.nhdr.n_type = type;
1502 	/*
1503 	 * The System V ABI states that n_namesz must be the length of the
1504 	 * string that follows the Nhdr structure including the terminating
1505 	 * null. The ABI also specifies that sufficient padding should be
1506 	 * included so that the description that follows the name string
1507 	 * begins on a 4- or 8-byte boundary for 32- and 64-bit binaries
1508 	 * respectively. However, since this change was not made correctly
1509 	 * at the time of the 64-bit port, both 32- and 64-bit binaries
1510 	 * descriptions are only guaranteed to begin on a 4-byte boundary.
1511 	 */
1512 	note.nhdr.n_namesz = 5;
1513 	note.nhdr.n_descsz = roundup(descsz, sizeof (Word));
1514 
1515 	if (error = core_write(vp, UIO_SYSSPACE, *offsetp, &note,
1516 	    sizeof (note), rlimit, credp))
1517 		return (error);
1518 
1519 	*offsetp += sizeof (note);
1520 
1521 	if (error = core_write(vp, UIO_SYSSPACE, *offsetp, desc,
1522 	    note.nhdr.n_descsz, rlimit, credp))
1523 		return (error);
1524 
1525 	*offsetp += note.nhdr.n_descsz;
1526 	return (0);
1527 }
1528 
1529 /*
1530  * Copy the section data from one vnode to the section of another vnode.
1531  */
1532 static void
copy_scn(Shdr * src,vnode_t * src_vp,Shdr * dst,vnode_t * dst_vp,Off * doffset,void * buf,size_t size,cred_t * credp,rlim64_t rlimit)1533 copy_scn(Shdr *src, vnode_t *src_vp, Shdr *dst, vnode_t *dst_vp, Off *doffset,
1534     void *buf, size_t size, cred_t *credp, rlim64_t rlimit)
1535 {
1536 	ssize_t resid;
1537 	size_t len, n = src->sh_size;
1538 	offset_t off = 0;
1539 
1540 	while (n != 0) {
1541 		len = MIN(size, n);
1542 		if (vn_rdwr(UIO_READ, src_vp, buf, len, src->sh_offset + off,
1543 		    UIO_SYSSPACE, 0, (rlim64_t)0, credp, &resid) != 0 ||
1544 		    resid >= len ||
1545 		    core_write(dst_vp, UIO_SYSSPACE, *doffset + off,
1546 		    buf, len - resid, rlimit, credp) != 0) {
1547 			dst->sh_size = 0;
1548 			dst->sh_offset = 0;
1549 			return;
1550 		}
1551 
1552 		ASSERT(n >= len - resid);
1553 
1554 		n -= len - resid;
1555 		off += len - resid;
1556 	}
1557 
1558 	*doffset += src->sh_size;
1559 }
1560 
1561 #ifdef _ELF32_COMPAT
1562 extern size_t elf_datasz_max;
1563 extern size_t elf_zeropg_sz;
1564 #else
1565 size_t elf_datasz_max = 1 * 1024 * 1024;
1566 size_t elf_zeropg_sz = 4 * 1024;
1567 #endif
1568 
1569 /*
1570  * This function processes mappings that correspond to load objects to
1571  * examine their respective sections for elfcore(). It's called once with
1572  * v set to NULL to count the number of sections that we're going to need
1573  * and then again with v set to some allocated buffer that we fill in with
1574  * all the section data.
1575  */
1576 static int
process_scns(core_content_t content,proc_t * p,cred_t * credp,vnode_t * vp,Shdr * v,int nv,rlim64_t rlimit,Off * doffsetp,int * nshdrsp)1577 process_scns(core_content_t content, proc_t *p, cred_t *credp, vnode_t *vp,
1578     Shdr *v, int nv, rlim64_t rlimit, Off *doffsetp, int *nshdrsp)
1579 {
1580 	vnode_t *lastvp = NULL;
1581 	struct seg *seg;
1582 	int i, j;
1583 	void *data = NULL;
1584 	size_t datasz = 0;
1585 	shstrtab_t shstrtab;
1586 	struct as *as = p->p_as;
1587 	int error = 0;
1588 
1589 	if (!shstrtab_init(&shstrtab)) {
1590 		error = ENOMEM;
1591 		goto done;
1592 	}
1593 
1594 	i = 1;
1595 	for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
1596 		uint_t prot;
1597 		vnode_t *mvp;
1598 		void *tmp = NULL;
1599 		caddr_t saddr = seg->s_base;
1600 		caddr_t naddr;
1601 		caddr_t eaddr;
1602 		size_t segsize;
1603 
1604 		Ehdr ehdr;
1605 		int nshdrs, shstrndx, nphdrs;
1606 		caddr_t shbase;
1607 		ssize_t shsize;
1608 		char *shstrbase;
1609 		ssize_t shstrsize;
1610 
1611 		Shdr *shdr;
1612 		const char *name;
1613 		size_t sz;
1614 		uintptr_t off;
1615 
1616 		int ctf_ndx = 0;
1617 		int symtab_ndx = 0;
1618 
1619 		/*
1620 		 * Since we're just looking for text segments of load
1621 		 * objects, we only care about the protection bits; we don't
1622 		 * care about the actual size of the segment so we use the
1623 		 * reserved size. If the segment's size is zero, there's
1624 		 * something fishy going on so we ignore this segment.
1625 		 */
1626 		if (seg->s_ops != &segvn_ops ||
1627 		    SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 ||
1628 		    mvp == lastvp || mvp == NULL || mvp->v_type != VREG ||
1629 		    (segsize = pr_getsegsize(seg, 1)) == 0)
1630 			continue;
1631 
1632 		eaddr = saddr + segsize;
1633 		prot = pr_getprot(seg, 1, &tmp, &saddr, &naddr, eaddr);
1634 		pr_getprot_done(&tmp);
1635 
1636 		/*
1637 		 * Skip this segment unless the protection bits look like
1638 		 * what we'd expect for a text segment.
1639 		 */
1640 		if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC)
1641 			continue;
1642 
1643 		if (getelfhead(mvp, credp, &ehdr, &nshdrs, &shstrndx,
1644 		    &nphdrs) != 0 ||
1645 		    getelfshdr(mvp, credp, &ehdr, nshdrs, shstrndx,
1646 		    &shbase, &shsize, &shstrbase, &shstrsize) != 0)
1647 			continue;
1648 
1649 		off = ehdr.e_shentsize;
1650 		for (j = 1; j < nshdrs; j++, off += ehdr.e_shentsize) {
1651 			Shdr *symtab = NULL, *strtab;
1652 			size_t allocsz;
1653 
1654 			shdr = (Shdr *)(shbase + off);
1655 			allocsz = MIN(shdr->sh_size, elf_datasz_max);
1656 
1657 			if (shdr->sh_name >= shstrsize)
1658 				continue;
1659 
1660 			name = shstrbase + shdr->sh_name;
1661 
1662 			if (strcmp(name, shstrtab_data[STR_CTF]) == 0) {
1663 				if ((content & CC_CONTENT_CTF) == 0 ||
1664 				    ctf_ndx != 0)
1665 					continue;
1666 
1667 				if (shdr->sh_link > 0 &&
1668 				    shdr->sh_link < nshdrs) {
1669 					symtab = (Shdr *)(shbase +
1670 					    shdr->sh_link * ehdr.e_shentsize);
1671 				}
1672 
1673 				if (v != NULL && i < nv - 1) {
1674 					if (allocsz > datasz) {
1675 						if (data != NULL)
1676 							kmem_free(data, datasz);
1677 
1678 						datasz = allocsz;
1679 						data = kmem_alloc(datasz,
1680 						    KM_SLEEP);
1681 					}
1682 
1683 					if (!shstrtab_ndx(&shstrtab,
1684 					    shstrtab_data[STR_CTF],
1685 					    &v[i].sh_name)) {
1686 						error = ENOMEM;
1687 						goto done;
1688 					}
1689 					v[i].sh_addr = (Addr)(uintptr_t)saddr;
1690 					v[i].sh_type = SHT_PROGBITS;
1691 					v[i].sh_addralign = 4;
1692 					*doffsetp = roundup(*doffsetp,
1693 					    v[i].sh_addralign);
1694 					v[i].sh_offset = *doffsetp;
1695 					v[i].sh_size = shdr->sh_size;
1696 					if (symtab == NULL)  {
1697 						v[i].sh_link = 0;
1698 					} else if (symtab->sh_type ==
1699 					    SHT_SYMTAB &&
1700 					    symtab_ndx != 0) {
1701 						v[i].sh_link =
1702 						    symtab_ndx;
1703 					} else {
1704 						v[i].sh_link = i + 1;
1705 					}
1706 
1707 					copy_scn(shdr, mvp, &v[i], vp,
1708 					    doffsetp, data, datasz, credp,
1709 					    rlimit);
1710 				}
1711 
1712 				ctf_ndx = i++;
1713 
1714 				/*
1715 				 * We've already dumped the symtab.
1716 				 */
1717 				if (symtab != NULL &&
1718 				    symtab->sh_type == SHT_SYMTAB &&
1719 				    symtab_ndx != 0)
1720 					continue;
1721 
1722 			} else if (strcmp(name,
1723 			    shstrtab_data[STR_SYMTAB]) == 0) {
1724 				if ((content & CC_CONTENT_SYMTAB) == 0 ||
1725 				    symtab != 0)
1726 					continue;
1727 
1728 				symtab = shdr;
1729 			} else if (strncmp(name, ".debug_",
1730 			    strlen(".debug_")) == 0) {
1731 				/*
1732 				 * The design of the above check is intentional.
1733 				 * In particular, we want to capture any
1734 				 * sections that begin with '.debug_' for a few
1735 				 * reasons:
1736 				 *
1737 				 * 1) Various revisions to the DWARF spec end up
1738 				 * changing the set of section headers that
1739 				 * exist. This ensures that we don't need to
1740 				 * change the kernel to get a new version.
1741 				 *
1742 				 * 2) Other software uses .debug_ sections for
1743 				 * things which aren't DWARF. This allows them
1744 				 * to be captured as well.
1745 				 */
1746 				if ((content & CC_CONTENT_DEBUG) == 0)
1747 					continue;
1748 
1749 				if (v != NULL && i < nv - 1) {
1750 					if (allocsz > datasz) {
1751 						if (data != NULL)
1752 							kmem_free(data, datasz);
1753 
1754 						datasz = allocsz;
1755 						data = kmem_alloc(datasz,
1756 						    KM_SLEEP);
1757 					}
1758 
1759 					if (!shstrtab_ndx(&shstrtab,
1760 					    name, &v[i].sh_name)) {
1761 						error = ENOMEM;
1762 						goto done;
1763 					}
1764 					v[i].sh_addr = (Addr)(uintptr_t)saddr;
1765 					v[i].sh_type = shdr->sh_type;
1766 					v[i].sh_addralign = shdr->sh_addralign;
1767 					*doffsetp = roundup(*doffsetp,
1768 					    v[i].sh_addralign);
1769 					v[i].sh_offset = *doffsetp;
1770 					v[i].sh_size = shdr->sh_size;
1771 					v[i].sh_link = 0;
1772 					v[i].sh_entsize = shdr->sh_entsize;
1773 					v[i].sh_info = shdr->sh_info;
1774 
1775 					copy_scn(shdr, mvp, &v[i], vp,
1776 					    doffsetp, data, datasz, credp,
1777 					    rlimit);
1778 				}
1779 
1780 				i++;
1781 				continue;
1782 			}
1783 
1784 			if (symtab != NULL) {
1785 				if ((symtab->sh_type != SHT_DYNSYM &&
1786 				    symtab->sh_type != SHT_SYMTAB) ||
1787 				    symtab->sh_link == 0 ||
1788 				    symtab->sh_link >= nshdrs)
1789 					continue;
1790 
1791 				strtab = (Shdr *)(shbase +
1792 				    symtab->sh_link * ehdr.e_shentsize);
1793 
1794 				if (strtab->sh_type != SHT_STRTAB)
1795 					continue;
1796 
1797 				if (v != NULL && i < nv - 2) {
1798 					sz = MAX(symtab->sh_size,
1799 					    strtab->sh_size);
1800 					allocsz = MIN(sz, elf_datasz_max);
1801 					if (allocsz > datasz) {
1802 						if (data != NULL)
1803 							kmem_free(data, datasz);
1804 
1805 						datasz = allocsz;
1806 						data = kmem_alloc(datasz,
1807 						    KM_SLEEP);
1808 					}
1809 
1810 					if (symtab->sh_type == SHT_DYNSYM) {
1811 						if (!shstrtab_ndx(&shstrtab,
1812 						    shstrtab_data[STR_DYNSYM],
1813 						    &v[i].sh_name)) {
1814 							error = ENOMEM;
1815 							goto done;
1816 						}
1817 						if (!shstrtab_ndx(&shstrtab,
1818 						    shstrtab_data[STR_DYNSTR],
1819 						    &v[i + 1].sh_name)) {
1820 							error = ENOMEM;
1821 							goto done;
1822 						}
1823 					} else {
1824 						if (!shstrtab_ndx(&shstrtab,
1825 						    shstrtab_data[STR_SYMTAB],
1826 						    &v[i].sh_name)) {
1827 							error = ENOMEM;
1828 							goto done;
1829 						}
1830 						if (!shstrtab_ndx(&shstrtab,
1831 						    shstrtab_data[STR_STRTAB],
1832 						    &v[i + 1].sh_name)) {
1833 							error = ENOMEM;
1834 							goto done;
1835 						}
1836 					}
1837 
1838 					v[i].sh_type = symtab->sh_type;
1839 					v[i].sh_addr = symtab->sh_addr;
1840 					if (ehdr.e_type == ET_DYN ||
1841 					    v[i].sh_addr == 0)
1842 						v[i].sh_addr +=
1843 						    (Addr)(uintptr_t)saddr;
1844 					v[i].sh_addralign =
1845 					    symtab->sh_addralign;
1846 					*doffsetp = roundup(*doffsetp,
1847 					    v[i].sh_addralign);
1848 					v[i].sh_offset = *doffsetp;
1849 					v[i].sh_size = symtab->sh_size;
1850 					v[i].sh_link = i + 1;
1851 					v[i].sh_entsize = symtab->sh_entsize;
1852 					v[i].sh_info = symtab->sh_info;
1853 
1854 					copy_scn(symtab, mvp, &v[i], vp,
1855 					    doffsetp, data, datasz, credp,
1856 					    rlimit);
1857 
1858 					v[i + 1].sh_type = SHT_STRTAB;
1859 					v[i + 1].sh_flags = SHF_STRINGS;
1860 					v[i + 1].sh_addr = symtab->sh_addr;
1861 					if (ehdr.e_type == ET_DYN ||
1862 					    v[i + 1].sh_addr == 0)
1863 						v[i + 1].sh_addr +=
1864 						    (Addr)(uintptr_t)saddr;
1865 					v[i + 1].sh_addralign =
1866 					    strtab->sh_addralign;
1867 					*doffsetp = roundup(*doffsetp,
1868 					    v[i + 1].sh_addralign);
1869 					v[i + 1].sh_offset = *doffsetp;
1870 					v[i + 1].sh_size = strtab->sh_size;
1871 
1872 					copy_scn(strtab, mvp, &v[i + 1], vp,
1873 					    doffsetp, data, datasz, credp,
1874 					    rlimit);
1875 				}
1876 
1877 				if (symtab->sh_type == SHT_SYMTAB)
1878 					symtab_ndx = i;
1879 				i += 2;
1880 			}
1881 		}
1882 
1883 		kmem_free(shstrbase, shstrsize);
1884 		kmem_free(shbase, shsize);
1885 
1886 		lastvp = mvp;
1887 	}
1888 
1889 	if (v == NULL) {
1890 		if (i == 1)
1891 			*nshdrsp = 0;
1892 		else
1893 			*nshdrsp = i + 1;
1894 		goto done;
1895 	}
1896 
1897 	if (i != nv - 1) {
1898 		cmn_err(CE_WARN, "elfcore: core dump failed for "
1899 		    "process %d; address space is changing", p->p_pid);
1900 		error = EIO;
1901 		goto done;
1902 	}
1903 
1904 	if (!shstrtab_ndx(&shstrtab, shstrtab_data[STR_SHSTRTAB],
1905 	    &v[i].sh_name)) {
1906 		error = ENOMEM;
1907 		goto done;
1908 	}
1909 	v[i].sh_size = shstrtab_size(&shstrtab);
1910 	v[i].sh_addralign = 1;
1911 	*doffsetp = roundup(*doffsetp, v[i].sh_addralign);
1912 	v[i].sh_offset = *doffsetp;
1913 	v[i].sh_flags = SHF_STRINGS;
1914 	v[i].sh_type = SHT_STRTAB;
1915 
1916 	if (v[i].sh_size > datasz) {
1917 		if (data != NULL)
1918 			kmem_free(data, datasz);
1919 
1920 		datasz = v[i].sh_size;
1921 		data = kmem_alloc(datasz,
1922 		    KM_SLEEP);
1923 	}
1924 
1925 	shstrtab_dump(&shstrtab, data);
1926 
1927 	if ((error = core_write(vp, UIO_SYSSPACE, *doffsetp,
1928 	    data, v[i].sh_size, rlimit, credp)) != 0)
1929 		goto done;
1930 
1931 	*doffsetp += v[i].sh_size;
1932 
1933 done:
1934 	if (data != NULL)
1935 		kmem_free(data, datasz);
1936 
1937 	shstrtab_fini(&shstrtab);
1938 
1939 	return (error);
1940 }
1941 
1942 int
elfcore(vnode_t * vp,proc_t * p,cred_t * credp,rlim64_t rlimit,int sig,core_content_t content)1943 elfcore(vnode_t *vp, proc_t *p, cred_t *credp, rlim64_t rlimit, int sig,
1944     core_content_t content)
1945 {
1946 	offset_t poffset, soffset;
1947 	Off doffset;
1948 	int error, i, nphdrs, nshdrs;
1949 	int overflow = 0;
1950 	struct seg *seg;
1951 	struct as *as = p->p_as;
1952 	union {
1953 		Ehdr ehdr;
1954 		Phdr phdr[1];
1955 		Shdr shdr[1];
1956 	} *bigwad;
1957 	size_t bigsize;
1958 	size_t phdrsz, shdrsz;
1959 	Ehdr *ehdr;
1960 	Phdr *v;
1961 	void *zeropg = NULL;
1962 	caddr_t brkbase;
1963 	size_t brksize;
1964 	caddr_t stkbase;
1965 	size_t stksize;
1966 	int ntries = 0;
1967 	klwp_t *lwp = ttolwp(curthread);
1968 
1969 top:
1970 	/*
1971 	 * Make sure we have everything we need (registers, etc.).
1972 	 * All other lwps have already stopped and are in an orderly state.
1973 	 */
1974 	ASSERT(p == ttoproc(curthread));
1975 	prstop(0, 0);
1976 
1977 	AS_LOCK_ENTER(as, RW_WRITER);
1978 	nphdrs = prnsegs(as, 0) + 2;		/* two CORE note sections */
1979 
1980 	/*
1981 	 * Count the number of section headers we're going to need.
1982 	 */
1983 	nshdrs = 0;
1984 	if (content & (CC_CONTENT_CTF | CC_CONTENT_SYMTAB | CC_CONTENT_DEBUG)) {
1985 		(void) process_scns(content, p, credp, NULL, NULL, 0, 0,
1986 		    NULL, &nshdrs);
1987 	}
1988 	AS_LOCK_EXIT(as);
1989 
1990 	ASSERT(nshdrs == 0 || nshdrs > 1);
1991 
1992 	/*
1993 	 * The core file contents may required zero section headers, but if
1994 	 * we overflow the 16 bits allotted to the program header count in
1995 	 * the ELF header, we'll need that program header at index zero.
1996 	 */
1997 	if (nshdrs == 0 && nphdrs >= PN_XNUM)
1998 		nshdrs = 1;
1999 
2000 	phdrsz = nphdrs * sizeof (Phdr);
2001 	shdrsz = nshdrs * sizeof (Shdr);
2002 
2003 	bigsize = MAX(sizeof (*bigwad), MAX(phdrsz, shdrsz));
2004 	bigwad = kmem_alloc(bigsize, KM_SLEEP);
2005 
2006 	ehdr = &bigwad->ehdr;
2007 	bzero(ehdr, sizeof (*ehdr));
2008 
2009 	ehdr->e_ident[EI_MAG0] = ELFMAG0;
2010 	ehdr->e_ident[EI_MAG1] = ELFMAG1;
2011 	ehdr->e_ident[EI_MAG2] = ELFMAG2;
2012 	ehdr->e_ident[EI_MAG3] = ELFMAG3;
2013 	ehdr->e_ident[EI_CLASS] = ELFCLASS;
2014 	ehdr->e_type = ET_CORE;
2015 
2016 #if !defined(_LP64) || defined(_ELF32_COMPAT)
2017 
2018 #if defined(__sparc)
2019 	ehdr->e_ident[EI_DATA] = ELFDATA2MSB;
2020 	ehdr->e_machine = EM_SPARC;
2021 #elif defined(__i386_COMPAT)
2022 	ehdr->e_ident[EI_DATA] = ELFDATA2LSB;
2023 	ehdr->e_machine = EM_386;
2024 #else
2025 #error "no recognized machine type is defined"
2026 #endif
2027 
2028 #else	/* !defined(_LP64) || defined(_ELF32_COMPAT) */
2029 
2030 #if defined(__sparc)
2031 	ehdr->e_ident[EI_DATA] = ELFDATA2MSB;
2032 	ehdr->e_machine = EM_SPARCV9;
2033 #elif defined(__amd64)
2034 	ehdr->e_ident[EI_DATA] = ELFDATA2LSB;
2035 	ehdr->e_machine = EM_AMD64;
2036 #else
2037 #error "no recognized 64-bit machine type is defined"
2038 #endif
2039 
2040 #endif	/* !defined(_LP64) || defined(_ELF32_COMPAT) */
2041 
2042 	/*
2043 	 * If the count of program headers or section headers or the index
2044 	 * of the section string table can't fit in the mere 16 bits
2045 	 * shortsightedly allotted to them in the ELF header, we use the
2046 	 * extended formats and put the real values in the section header
2047 	 * as index 0.
2048 	 */
2049 	ehdr->e_ident[EI_VERSION] = EV_CURRENT;
2050 	ehdr->e_version = EV_CURRENT;
2051 	ehdr->e_ehsize = sizeof (Ehdr);
2052 
2053 	if (nphdrs >= PN_XNUM)
2054 		ehdr->e_phnum = PN_XNUM;
2055 	else
2056 		ehdr->e_phnum = (unsigned short)nphdrs;
2057 
2058 	ehdr->e_phoff = sizeof (Ehdr);
2059 	ehdr->e_phentsize = sizeof (Phdr);
2060 
2061 	if (nshdrs > 0) {
2062 		if (nshdrs >= SHN_LORESERVE)
2063 			ehdr->e_shnum = 0;
2064 		else
2065 			ehdr->e_shnum = (unsigned short)nshdrs;
2066 
2067 		if (nshdrs - 1 >= SHN_LORESERVE)
2068 			ehdr->e_shstrndx = SHN_XINDEX;
2069 		else
2070 			ehdr->e_shstrndx = (unsigned short)(nshdrs - 1);
2071 
2072 		ehdr->e_shoff = ehdr->e_phoff + ehdr->e_phentsize * nphdrs;
2073 		ehdr->e_shentsize = sizeof (Shdr);
2074 	}
2075 
2076 	if (error = core_write(vp, UIO_SYSSPACE, (offset_t)0, ehdr,
2077 	    sizeof (Ehdr), rlimit, credp))
2078 		goto done;
2079 
2080 	poffset = sizeof (Ehdr);
2081 	soffset = sizeof (Ehdr) + phdrsz;
2082 	doffset = sizeof (Ehdr) + phdrsz + shdrsz;
2083 
2084 	v = &bigwad->phdr[0];
2085 	bzero(v, phdrsz);
2086 
2087 	setup_old_note_header(&v[0], p);
2088 	v[0].p_offset = doffset = roundup(doffset, sizeof (Word));
2089 	doffset += v[0].p_filesz;
2090 
2091 	setup_note_header(&v[1], p);
2092 	v[1].p_offset = doffset = roundup(doffset, sizeof (Word));
2093 	doffset += v[1].p_filesz;
2094 
2095 	mutex_enter(&p->p_lock);
2096 
2097 	brkbase = p->p_brkbase;
2098 	brksize = p->p_brksize;
2099 
2100 	stkbase = p->p_usrstack - p->p_stksize;
2101 	stksize = p->p_stksize;
2102 
2103 	mutex_exit(&p->p_lock);
2104 
2105 	AS_LOCK_ENTER(as, RW_WRITER);
2106 	i = 2;
2107 	for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) {
2108 		caddr_t eaddr = seg->s_base + pr_getsegsize(seg, 0);
2109 		caddr_t saddr, naddr;
2110 		void *tmp = NULL;
2111 		extern struct seg_ops segspt_shmops;
2112 
2113 		if ((seg->s_flags & S_HOLE) != 0) {
2114 			continue;
2115 		}
2116 
2117 		for (saddr = seg->s_base; saddr < eaddr; saddr = naddr) {
2118 			uint_t prot;
2119 			size_t size;
2120 			int type;
2121 			vnode_t *mvp;
2122 
2123 			prot = pr_getprot(seg, 0, &tmp, &saddr, &naddr, eaddr);
2124 			prot &= PROT_READ | PROT_WRITE | PROT_EXEC;
2125 			if ((size = (size_t)(naddr - saddr)) == 0)
2126 				continue;
2127 			if (i == nphdrs) {
2128 				overflow++;
2129 				continue;
2130 			}
2131 			v[i].p_type = PT_LOAD;
2132 			v[i].p_vaddr = (Addr)(uintptr_t)saddr;
2133 			v[i].p_memsz = size;
2134 			if (prot & PROT_READ)
2135 				v[i].p_flags |= PF_R;
2136 			if (prot & PROT_WRITE)
2137 				v[i].p_flags |= PF_W;
2138 			if (prot & PROT_EXEC)
2139 				v[i].p_flags |= PF_X;
2140 
2141 			/*
2142 			 * Figure out which mappings to include in the core.
2143 			 */
2144 			type = SEGOP_GETTYPE(seg, saddr);
2145 
2146 			if (saddr == stkbase && size == stksize) {
2147 				if (!(content & CC_CONTENT_STACK))
2148 					goto exclude;
2149 
2150 			} else if (saddr == brkbase && size == brksize) {
2151 				if (!(content & CC_CONTENT_HEAP))
2152 					goto exclude;
2153 
2154 			} else if (seg->s_ops == &segspt_shmops) {
2155 				if (type & MAP_NORESERVE) {
2156 					if (!(content & CC_CONTENT_DISM))
2157 						goto exclude;
2158 				} else {
2159 					if (!(content & CC_CONTENT_ISM))
2160 						goto exclude;
2161 				}
2162 
2163 			} else if (seg->s_ops != &segvn_ops) {
2164 				goto exclude;
2165 
2166 			} else if (type & MAP_SHARED) {
2167 				if (shmgetid(p, saddr) != SHMID_NONE) {
2168 					if (!(content & CC_CONTENT_SHM))
2169 						goto exclude;
2170 
2171 				} else if (SEGOP_GETVP(seg, seg->s_base,
2172 				    &mvp) != 0 || mvp == NULL ||
2173 				    mvp->v_type != VREG) {
2174 					if (!(content & CC_CONTENT_SHANON))
2175 						goto exclude;
2176 
2177 				} else {
2178 					if (!(content & CC_CONTENT_SHFILE))
2179 						goto exclude;
2180 				}
2181 
2182 			} else if (SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 ||
2183 			    mvp == NULL || mvp->v_type != VREG) {
2184 				if (!(content & CC_CONTENT_ANON))
2185 					goto exclude;
2186 
2187 			} else if (prot == (PROT_READ | PROT_EXEC)) {
2188 				if (!(content & CC_CONTENT_TEXT))
2189 					goto exclude;
2190 
2191 			} else if (prot == PROT_READ) {
2192 				if (!(content & CC_CONTENT_RODATA))
2193 					goto exclude;
2194 
2195 			} else {
2196 				if (!(content & CC_CONTENT_DATA))
2197 					goto exclude;
2198 			}
2199 
2200 			doffset = roundup(doffset, sizeof (Word));
2201 			v[i].p_offset = doffset;
2202 			v[i].p_filesz = size;
2203 			doffset += size;
2204 exclude:
2205 			i++;
2206 		}
2207 		ASSERT(tmp == NULL);
2208 	}
2209 	AS_LOCK_EXIT(as);
2210 
2211 	if (overflow || i != nphdrs) {
2212 		if (ntries++ == 0) {
2213 			kmem_free(bigwad, bigsize);
2214 			overflow = 0;
2215 			goto top;
2216 		}
2217 		cmn_err(CE_WARN, "elfcore: core dump failed for "
2218 		    "process %d; address space is changing", p->p_pid);
2219 		error = EIO;
2220 		goto done;
2221 	}
2222 
2223 	if ((error = core_write(vp, UIO_SYSSPACE, poffset,
2224 	    v, phdrsz, rlimit, credp)) != 0)
2225 		goto done;
2226 
2227 	if ((error = write_old_elfnotes(p, sig, vp, v[0].p_offset, rlimit,
2228 	    credp)) != 0)
2229 		goto done;
2230 
2231 	if ((error = write_elfnotes(p, sig, vp, v[1].p_offset, rlimit,
2232 	    credp, content)) != 0)
2233 		goto done;
2234 
2235 	for (i = 2; i < nphdrs; i++) {
2236 		prkillinfo_t killinfo;
2237 		sigqueue_t *sq;
2238 		int sig, j;
2239 
2240 		if (v[i].p_filesz == 0)
2241 			continue;
2242 
2243 		/*
2244 		 * If we hit a region that was mapped PROT_NONE then we cannot
2245 		 * continue dumping this normally as the kernel would be unable
2246 		 * to read from the page and that would result in us failing to
2247 		 * dump the page. As such, any region mapped PROT_NONE, we dump
2248 		 * as a zero-filled page such that this is still represented in
2249 		 * the map.
2250 		 *
2251 		 * If dumping out this segment fails, rather than failing
2252 		 * the core dump entirely, we reset the size of the mapping
2253 		 * to zero to indicate that the data is absent from the core
2254 		 * file and or in the PF_SUNW_FAILURE flag to differentiate
2255 		 * this from mappings that were excluded due to the core file
2256 		 * content settings.
2257 		 */
2258 		if ((v[i].p_flags & (PF_R | PF_W | PF_X)) == 0) {
2259 			size_t towrite = v[i].p_filesz;
2260 			size_t curoff = 0;
2261 
2262 			if (zeropg == NULL) {
2263 				zeropg = kmem_zalloc(elf_zeropg_sz, KM_SLEEP);
2264 			}
2265 
2266 			error = 0;
2267 			while (towrite != 0) {
2268 				size_t len = MIN(towrite, elf_zeropg_sz);
2269 
2270 				error = core_write(vp, UIO_SYSSPACE,
2271 				    v[i].p_offset + curoff, zeropg, len, rlimit,
2272 				    credp);
2273 				if (error != 0)
2274 					break;
2275 
2276 				towrite -= len;
2277 				curoff += len;
2278 			}
2279 
2280 			if (error == 0)
2281 				continue;
2282 		} else {
2283 			error = core_seg(p, vp, v[i].p_offset,
2284 			    (caddr_t)(uintptr_t)v[i].p_vaddr, v[i].p_filesz,
2285 			    rlimit, credp);
2286 			if (error == 0)
2287 				continue;
2288 		}
2289 
2290 		if ((sig = lwp->lwp_cursig) == 0) {
2291 			/*
2292 			 * We failed due to something other than a signal.
2293 			 * Since the space reserved for the segment is now
2294 			 * unused, we stash the errno in the first four
2295 			 * bytes. This undocumented interface will let us
2296 			 * understand the nature of the failure.
2297 			 */
2298 			(void) core_write(vp, UIO_SYSSPACE, v[i].p_offset,
2299 			    &error, sizeof (error), rlimit, credp);
2300 
2301 			v[i].p_filesz = 0;
2302 			v[i].p_flags |= PF_SUNW_FAILURE;
2303 			if ((error = core_write(vp, UIO_SYSSPACE,
2304 			    poffset + sizeof (v[i]) * i, &v[i], sizeof (v[i]),
2305 			    rlimit, credp)) != 0)
2306 				goto done;
2307 
2308 			continue;
2309 		}
2310 
2311 		/*
2312 		 * We took a signal.  We want to abort the dump entirely, but
2313 		 * we also want to indicate what failed and why.  We therefore
2314 		 * use the space reserved for the first failing segment to
2315 		 * write our error (which, for purposes of compatability with
2316 		 * older core dump readers, we set to EINTR) followed by any
2317 		 * siginfo associated with the signal.
2318 		 */
2319 		bzero(&killinfo, sizeof (killinfo));
2320 		killinfo.prk_error = EINTR;
2321 
2322 		sq = sig == SIGKILL ? curproc->p_killsqp : lwp->lwp_curinfo;
2323 
2324 		if (sq != NULL) {
2325 			bcopy(&sq->sq_info, &killinfo.prk_info,
2326 			    sizeof (sq->sq_info));
2327 		} else {
2328 			killinfo.prk_info.si_signo = lwp->lwp_cursig;
2329 			killinfo.prk_info.si_code = SI_NOINFO;
2330 		}
2331 
2332 #if (defined(_SYSCALL32_IMPL) || defined(_LP64))
2333 		/*
2334 		 * If this is a 32-bit process, we need to translate from the
2335 		 * native siginfo to the 32-bit variant.  (Core readers must
2336 		 * always have the same data model as their target or must
2337 		 * be aware of -- and compensate for -- data model differences.)
2338 		 */
2339 		if (curproc->p_model == DATAMODEL_ILP32) {
2340 			siginfo32_t si32;
2341 
2342 			siginfo_kto32((k_siginfo_t *)&killinfo.prk_info, &si32);
2343 			bcopy(&si32, &killinfo.prk_info, sizeof (si32));
2344 		}
2345 #endif
2346 
2347 		(void) core_write(vp, UIO_SYSSPACE, v[i].p_offset,
2348 		    &killinfo, sizeof (killinfo), rlimit, credp);
2349 
2350 		/*
2351 		 * For the segment on which we took the signal, indicate that
2352 		 * its data now refers to a siginfo.
2353 		 */
2354 		v[i].p_filesz = 0;
2355 		v[i].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED |
2356 		    PF_SUNW_SIGINFO;
2357 
2358 		/*
2359 		 * And for every other segment, indicate that its absence
2360 		 * is due to a signal.
2361 		 */
2362 		for (j = i + 1; j < nphdrs; j++) {
2363 			v[j].p_filesz = 0;
2364 			v[j].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED;
2365 		}
2366 
2367 		/*
2368 		 * Finally, write out our modified program headers.
2369 		 */
2370 		if ((error = core_write(vp, UIO_SYSSPACE,
2371 		    poffset + sizeof (v[i]) * i, &v[i],
2372 		    sizeof (v[i]) * (nphdrs - i), rlimit, credp)) != 0)
2373 			goto done;
2374 
2375 		break;
2376 	}
2377 
2378 	if (nshdrs > 0) {
2379 		bzero(&bigwad->shdr[0], shdrsz);
2380 
2381 		if (nshdrs >= SHN_LORESERVE)
2382 			bigwad->shdr[0].sh_size = nshdrs;
2383 
2384 		if (nshdrs - 1 >= SHN_LORESERVE)
2385 			bigwad->shdr[0].sh_link = nshdrs - 1;
2386 
2387 		if (nphdrs >= PN_XNUM)
2388 			bigwad->shdr[0].sh_info = nphdrs;
2389 
2390 		if (nshdrs > 1) {
2391 			AS_LOCK_ENTER(as, RW_WRITER);
2392 			if ((error = process_scns(content, p, credp, vp,
2393 			    &bigwad->shdr[0], nshdrs, rlimit, &doffset,
2394 			    NULL)) != 0) {
2395 				AS_LOCK_EXIT(as);
2396 				goto done;
2397 			}
2398 			AS_LOCK_EXIT(as);
2399 		}
2400 
2401 		if ((error = core_write(vp, UIO_SYSSPACE, soffset,
2402 		    &bigwad->shdr[0], shdrsz, rlimit, credp)) != 0)
2403 			goto done;
2404 	}
2405 
2406 done:
2407 	if (zeropg != NULL) {
2408 		kmem_free(zeropg, elf_zeropg_sz);
2409 	}
2410 	kmem_free(bigwad, bigsize);
2411 	return (error);
2412 }
2413 
2414 #ifndef	_ELF32_COMPAT
2415 
2416 static struct execsw esw = {
2417 #ifdef	_LP64
2418 	elf64magicstr,
2419 #else	/* _LP64 */
2420 	elf32magicstr,
2421 #endif	/* _LP64 */
2422 	0,
2423 	5,
2424 	elfexec,
2425 	elfcore
2426 };
2427 
2428 static struct modlexec modlexec = {
2429 	&mod_execops, "exec module for elf", &esw
2430 };
2431 
2432 #ifdef	_LP64
2433 extern int elf32exec(vnode_t *vp, execa_t *uap, uarg_t *args,
2434 			intpdata_t *idatap, int level, long *execsz,
2435 			int setid, caddr_t exec_file, cred_t *cred,
2436 			int brand_action);
2437 extern int elf32core(vnode_t *vp, proc_t *p, cred_t *credp,
2438 			rlim64_t rlimit, int sig, core_content_t content);
2439 
2440 static struct execsw esw32 = {
2441 	elf32magicstr,
2442 	0,
2443 	5,
2444 	elf32exec,
2445 	elf32core
2446 };
2447 
2448 static struct modlexec modlexec32 = {
2449 	&mod_execops, "32-bit exec module for elf", &esw32
2450 };
2451 #endif	/* _LP64 */
2452 
2453 static struct modlinkage modlinkage = {
2454 	MODREV_1,
2455 	(void *)&modlexec,
2456 #ifdef	_LP64
2457 	(void *)&modlexec32,
2458 #endif	/* _LP64 */
2459 	NULL
2460 };
2461 
2462 int
_init(void)2463 _init(void)
2464 {
2465 	return (mod_install(&modlinkage));
2466 }
2467 
2468 int
_fini(void)2469 _fini(void)
2470 {
2471 	return (mod_remove(&modlinkage));
2472 }
2473 
2474 int
_info(struct modinfo * modinfop)2475 _info(struct modinfo *modinfop)
2476 {
2477 	return (mod_info(&modlinkage, modinfop));
2478 }
2479 
2480 #endif	/* !_ELF32_COMPAT */
2481