1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved. 24 */ 25 26 /* Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */ 27 /* All Rights Reserved */ 28 /* 29 * Copyright (c) 2018, Joyent, Inc. 30 */ 31 32 #include <sys/types.h> 33 #include <sys/param.h> 34 #include <sys/thread.h> 35 #include <sys/sysmacros.h> 36 #include <sys/signal.h> 37 #include <sys/cred.h> 38 #include <sys/user.h> 39 #include <sys/errno.h> 40 #include <sys/vnode.h> 41 #include <sys/mman.h> 42 #include <sys/kmem.h> 43 #include <sys/proc.h> 44 #include <sys/pathname.h> 45 #include <sys/policy.h> 46 #include <sys/cmn_err.h> 47 #include <sys/systm.h> 48 #include <sys/elf.h> 49 #include <sys/vmsystm.h> 50 #include <sys/debug.h> 51 #include <sys/auxv.h> 52 #include <sys/exec.h> 53 #include <sys/prsystm.h> 54 #include <vm/as.h> 55 #include <vm/rm.h> 56 #include <vm/seg.h> 57 #include <vm/seg_vn.h> 58 #include <sys/modctl.h> 59 #include <sys/systeminfo.h> 60 #include <sys/vmparam.h> 61 #include <sys/machelf.h> 62 #include <sys/shm_impl.h> 63 #include <sys/archsystm.h> 64 #include <sys/fasttrap.h> 65 #include <sys/brand.h> 66 #include "elf_impl.h" 67 #include <sys/sdt.h> 68 #include <sys/siginfo.h> 69 #include <sys/random.h> 70 71 #if defined(__x86) 72 #include <sys/comm_page_util.h> 73 #include <sys/fp.h> 74 #endif /* defined(__x86) */ 75 76 77 extern int at_flags; 78 extern volatile size_t aslr_max_brk_skew; 79 80 #define ORIGIN_STR "ORIGIN" 81 #define ORIGIN_STR_SIZE 6 82 83 static int getelfhead(vnode_t *, cred_t *, Ehdr *, int *, int *, int *); 84 static int getelfphdr(vnode_t *, cred_t *, const Ehdr *, int, caddr_t *, 85 ssize_t *); 86 static int getelfshdr(vnode_t *, cred_t *, const Ehdr *, int, int, caddr_t *, 87 ssize_t *, caddr_t *, ssize_t *); 88 static size_t elfsize(Ehdr *, int, caddr_t, uintptr_t *); 89 static int mapelfexec(vnode_t *, Ehdr *, int, caddr_t, 90 Phdr **, Phdr **, Phdr **, Phdr **, Phdr *, 91 caddr_t *, caddr_t *, intptr_t *, intptr_t *, size_t, long *, size_t *); 92 93 typedef enum { 94 STR_CTF, 95 STR_SYMTAB, 96 STR_DYNSYM, 97 STR_STRTAB, 98 STR_DYNSTR, 99 STR_SHSTRTAB, 100 STR_NUM 101 } shstrtype_t; 102 103 static const char *shstrtab_data[] = { 104 ".SUNW_ctf", 105 ".symtab", 106 ".dynsym", 107 ".strtab", 108 ".dynstr", 109 ".shstrtab" 110 }; 111 112 typedef struct shstrtab { 113 int sst_ndx[STR_NUM]; 114 int sst_cur; 115 } shstrtab_t; 116 117 static void 118 shstrtab_init(shstrtab_t *s) 119 { 120 bzero(&s->sst_ndx, sizeof (s->sst_ndx)); 121 s->sst_cur = 1; 122 } 123 124 static int 125 shstrtab_ndx(shstrtab_t *s, shstrtype_t type) 126 { 127 int ret; 128 129 if ((ret = s->sst_ndx[type]) != 0) 130 return (ret); 131 132 ret = s->sst_ndx[type] = s->sst_cur; 133 s->sst_cur += strlen(shstrtab_data[type]) + 1; 134 135 return (ret); 136 } 137 138 static size_t 139 shstrtab_size(const shstrtab_t *s) 140 { 141 return (s->sst_cur); 142 } 143 144 static void 145 shstrtab_dump(const shstrtab_t *s, char *buf) 146 { 147 int i, ndx; 148 149 *buf = '\0'; 150 for (i = 0; i < STR_NUM; i++) { 151 if ((ndx = s->sst_ndx[i]) != 0) 152 (void) strcpy(buf + ndx, shstrtab_data[i]); 153 } 154 } 155 156 static int 157 dtrace_safe_phdr(Phdr *phdrp, struct uarg *args, uintptr_t base) 158 { 159 ASSERT(phdrp->p_type == PT_SUNWDTRACE); 160 161 /* 162 * See the comment in fasttrap.h for information on how to safely 163 * update this program header. 164 */ 165 if (phdrp->p_memsz < PT_SUNWDTRACE_SIZE || 166 (phdrp->p_flags & (PF_R | PF_W | PF_X)) != (PF_R | PF_W | PF_X)) 167 return (-1); 168 169 args->thrptr = phdrp->p_vaddr + base; 170 171 return (0); 172 } 173 174 static int 175 handle_secflag_dt(proc_t *p, uint_t dt, uint_t val) 176 { 177 uint_t flag; 178 179 switch (dt) { 180 case DT_SUNW_ASLR: 181 flag = PROC_SEC_ASLR; 182 break; 183 default: 184 return (EINVAL); 185 } 186 187 if (val == 0) { 188 if (secflag_isset(p->p_secflags.psf_lower, flag)) 189 return (EPERM); 190 if ((secpolicy_psecflags(CRED(), p, p) != 0) && 191 secflag_isset(p->p_secflags.psf_inherit, flag)) 192 return (EPERM); 193 194 secflag_clear(&p->p_secflags.psf_effective, flag); 195 } else { 196 if (!secflag_isset(p->p_secflags.psf_upper, flag)) 197 return (EPERM); 198 199 if ((secpolicy_psecflags(CRED(), p, p) != 0) && 200 !secflag_isset(p->p_secflags.psf_inherit, flag)) 201 return (EPERM); 202 203 secflag_set(&p->p_secflags.psf_effective, flag); 204 } 205 206 return (0); 207 } 208 209 /* 210 * Map in the executable pointed to by vp. Returns 0 on success. 211 */ 212 int 213 mapexec_brand(vnode_t *vp, uarg_t *args, Ehdr *ehdr, Addr *uphdr_vaddr, 214 intptr_t *voffset, caddr_t exec_file, int *interp, caddr_t *bssbase, 215 caddr_t *brkbase, size_t *brksize, uintptr_t *lddatap) 216 { 217 size_t len; 218 struct vattr vat; 219 caddr_t phdrbase = NULL; 220 ssize_t phdrsize; 221 int nshdrs, shstrndx, nphdrs; 222 int error = 0; 223 Phdr *uphdr = NULL; 224 Phdr *junk = NULL; 225 Phdr *dynphdr = NULL; 226 Phdr *dtrphdr = NULL; 227 uintptr_t lddata; 228 long execsz; 229 intptr_t minaddr; 230 231 if (lddatap != NULL) 232 *lddatap = NULL; 233 234 if (error = execpermissions(vp, &vat, args)) { 235 uprintf("%s: Cannot execute %s\n", exec_file, args->pathname); 236 return (error); 237 } 238 239 if ((error = getelfhead(vp, CRED(), ehdr, &nshdrs, &shstrndx, 240 &nphdrs)) != 0 || 241 (error = getelfphdr(vp, CRED(), ehdr, nphdrs, &phdrbase, 242 &phdrsize)) != 0) { 243 uprintf("%s: Cannot read %s\n", exec_file, args->pathname); 244 return (error); 245 } 246 247 if ((len = elfsize(ehdr, nphdrs, phdrbase, &lddata)) == 0) { 248 uprintf("%s: Nothing to load in %s", exec_file, args->pathname); 249 kmem_free(phdrbase, phdrsize); 250 return (ENOEXEC); 251 } 252 if (lddatap != NULL) 253 *lddatap = lddata; 254 255 if (error = mapelfexec(vp, ehdr, nphdrs, phdrbase, &uphdr, &dynphdr, 256 &junk, &dtrphdr, NULL, bssbase, brkbase, voffset, &minaddr, 257 len, &execsz, brksize)) { 258 uprintf("%s: Cannot map %s\n", exec_file, args->pathname); 259 kmem_free(phdrbase, phdrsize); 260 return (error); 261 } 262 263 /* 264 * Inform our caller if the executable needs an interpreter. 265 */ 266 *interp = (dynphdr == NULL) ? 0 : 1; 267 268 /* 269 * If this is a statically linked executable, voffset should indicate 270 * the address of the executable itself (it normally holds the address 271 * of the interpreter). 272 */ 273 if (ehdr->e_type == ET_EXEC && *interp == 0) 274 *voffset = minaddr; 275 276 if (uphdr != NULL) { 277 *uphdr_vaddr = uphdr->p_vaddr; 278 } else { 279 *uphdr_vaddr = (Addr)-1; 280 } 281 282 kmem_free(phdrbase, phdrsize); 283 return (error); 284 } 285 286 /*ARGSUSED*/ 287 int 288 elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap, 289 int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred, 290 int brand_action) 291 { 292 caddr_t phdrbase = NULL; 293 caddr_t bssbase = 0; 294 caddr_t brkbase = 0; 295 size_t brksize = 0; 296 ssize_t dlnsize; 297 aux_entry_t *aux; 298 int error; 299 ssize_t resid; 300 int fd = -1; 301 intptr_t voffset; 302 Phdr *intphdr = NULL; 303 Phdr *dynamicphdr = NULL; 304 Phdr *stphdr = NULL; 305 Phdr *uphdr = NULL; 306 Phdr *junk = NULL; 307 size_t len; 308 ssize_t phdrsize; 309 int postfixsize = 0; 310 int i, hsize; 311 Phdr *phdrp; 312 Phdr *dataphdrp = NULL; 313 Phdr *dtrphdr; 314 Phdr *capphdr = NULL; 315 Cap *cap = NULL; 316 ssize_t capsize; 317 Dyn *dyn = NULL; 318 int hasu = 0; 319 int hasauxv = 0; 320 int hasintp = 0; 321 int branded = 0; 322 323 struct proc *p = ttoproc(curthread); 324 struct user *up = PTOU(p); 325 struct bigwad { 326 Ehdr ehdr; 327 aux_entry_t elfargs[__KERN_NAUXV_IMPL]; 328 char dl_name[MAXPATHLEN]; 329 char pathbuf[MAXPATHLEN]; 330 struct vattr vattr; 331 struct execenv exenv; 332 } *bigwad; /* kmem_alloc this behemoth so we don't blow stack */ 333 Ehdr *ehdrp; 334 int nshdrs, shstrndx, nphdrs; 335 char *dlnp; 336 char *pathbufp; 337 rlim64_t limit; 338 rlim64_t roundlimit; 339 340 ASSERT(p->p_model == DATAMODEL_ILP32 || p->p_model == DATAMODEL_LP64); 341 342 bigwad = kmem_alloc(sizeof (struct bigwad), KM_SLEEP); 343 ehdrp = &bigwad->ehdr; 344 dlnp = bigwad->dl_name; 345 pathbufp = bigwad->pathbuf; 346 347 /* 348 * Obtain ELF and program header information. 349 */ 350 if ((error = getelfhead(vp, CRED(), ehdrp, &nshdrs, &shstrndx, 351 &nphdrs)) != 0 || 352 (error = getelfphdr(vp, CRED(), ehdrp, nphdrs, &phdrbase, 353 &phdrsize)) != 0) 354 goto out; 355 356 /* 357 * Prevent executing an ELF file that has no entry point. 358 */ 359 if (ehdrp->e_entry == 0) { 360 uprintf("%s: Bad entry point\n", exec_file); 361 goto bad; 362 } 363 364 /* 365 * Put data model that we're exec-ing to into the args passed to 366 * exec_args(), so it will know what it is copying to on new stack. 367 * Now that we know whether we are exec-ing a 32-bit or 64-bit 368 * executable, we can set execsz with the appropriate NCARGS. 369 */ 370 #ifdef _LP64 371 if (ehdrp->e_ident[EI_CLASS] == ELFCLASS32) { 372 args->to_model = DATAMODEL_ILP32; 373 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS32-1); 374 } else { 375 args->to_model = DATAMODEL_LP64; 376 args->stk_prot &= ~PROT_EXEC; 377 #if defined(__i386) || defined(__amd64) 378 args->dat_prot &= ~PROT_EXEC; 379 #endif 380 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS64-1); 381 } 382 #else /* _LP64 */ 383 args->to_model = DATAMODEL_ILP32; 384 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS-1); 385 #endif /* _LP64 */ 386 387 /* 388 * We delay invoking the brand callback until we've figured out 389 * what kind of elf binary we're trying to run, 32-bit or 64-bit. 390 * We do this because now the brand library can just check 391 * args->to_model to see if the target is 32-bit or 64-bit without 392 * having do duplicate all the code above. 393 * 394 * The level checks associated with brand handling below are used to 395 * prevent a loop since the brand elfexec function typically comes back 396 * through this function. We must check <= here since the nested 397 * handling in the #! interpreter code will increment the level before 398 * calling gexec to run the final elfexec interpreter. 399 */ 400 if ((level <= INTP_MAXDEPTH) && 401 (brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) { 402 error = BROP(p)->b_elfexec(vp, uap, args, 403 idatap, level + 1, execsz, setid, exec_file, cred, 404 brand_action); 405 goto out; 406 } 407 408 /* 409 * Determine aux size now so that stack can be built 410 * in one shot (except actual copyout of aux image), 411 * determine any non-default stack protections, 412 * and still have this code be machine independent. 413 */ 414 hsize = ehdrp->e_phentsize; 415 phdrp = (Phdr *)phdrbase; 416 for (i = nphdrs; i > 0; i--) { 417 switch (phdrp->p_type) { 418 case PT_INTERP: 419 hasauxv = hasintp = 1; 420 break; 421 case PT_PHDR: 422 hasu = 1; 423 break; 424 case PT_SUNWSTACK: 425 args->stk_prot = PROT_USER; 426 if (phdrp->p_flags & PF_R) 427 args->stk_prot |= PROT_READ; 428 if (phdrp->p_flags & PF_W) 429 args->stk_prot |= PROT_WRITE; 430 if (phdrp->p_flags & PF_X) 431 args->stk_prot |= PROT_EXEC; 432 break; 433 case PT_LOAD: 434 dataphdrp = phdrp; 435 break; 436 case PT_SUNWCAP: 437 capphdr = phdrp; 438 break; 439 case PT_DYNAMIC: 440 dynamicphdr = phdrp; 441 break; 442 } 443 phdrp = (Phdr *)((caddr_t)phdrp + hsize); 444 } 445 446 if (ehdrp->e_type != ET_EXEC) { 447 dataphdrp = NULL; 448 hasauxv = 1; 449 } 450 451 /* Copy BSS permissions to args->dat_prot */ 452 if (dataphdrp != NULL) { 453 args->dat_prot = PROT_USER; 454 if (dataphdrp->p_flags & PF_R) 455 args->dat_prot |= PROT_READ; 456 if (dataphdrp->p_flags & PF_W) 457 args->dat_prot |= PROT_WRITE; 458 if (dataphdrp->p_flags & PF_X) 459 args->dat_prot |= PROT_EXEC; 460 } 461 462 /* 463 * If a auxvector will be required - reserve the space for 464 * it now. This may be increased by exec_args if there are 465 * ISA-specific types (included in __KERN_NAUXV_IMPL). 466 */ 467 if (hasauxv) { 468 /* 469 * If a AUX vector is being built - the base AUX 470 * entries are: 471 * 472 * AT_BASE 473 * AT_FLAGS 474 * AT_PAGESZ 475 * AT_SUN_AUXFLAGS 476 * AT_SUN_HWCAP 477 * AT_SUN_HWCAP2 478 * AT_SUN_PLATFORM (added in stk_copyout) 479 * AT_SUN_EXECNAME (added in stk_copyout) 480 * AT_NULL 481 * 482 * total == 9 483 */ 484 if (hasintp && hasu) { 485 /* 486 * Has PT_INTERP & PT_PHDR - the auxvectors that 487 * will be built are: 488 * 489 * AT_PHDR 490 * AT_PHENT 491 * AT_PHNUM 492 * AT_ENTRY 493 * AT_LDDATA 494 * 495 * total = 5 496 */ 497 args->auxsize = (9 + 5) * sizeof (aux_entry_t); 498 } else if (hasintp) { 499 /* 500 * Has PT_INTERP but no PT_PHDR 501 * 502 * AT_EXECFD 503 * AT_LDDATA 504 * 505 * total = 2 506 */ 507 args->auxsize = (9 + 2) * sizeof (aux_entry_t); 508 } else { 509 args->auxsize = 9 * sizeof (aux_entry_t); 510 } 511 } else { 512 args->auxsize = 0; 513 } 514 515 /* 516 * If this binary is using an emulator, we need to add an 517 * AT_SUN_EMULATOR aux entry. 518 */ 519 if (args->emulator != NULL) 520 args->auxsize += sizeof (aux_entry_t); 521 522 /* 523 * On supported kernels (x86_64) make room in the auxv for the 524 * AT_SUN_COMMPAGE entry. This will go unpopulated on i86xpv systems 525 * which do not provide such functionality. 526 * 527 * Additionally cover the floating point information AT_SUN_FPSIZE and 528 * AT_SUN_FPTYPE. 529 */ 530 #if defined(__amd64) 531 args->auxsize += 3 * sizeof (aux_entry_t); 532 #endif /* defined(__amd64) */ 533 534 if ((brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) { 535 branded = 1; 536 /* 537 * We will be adding 4 entries to the aux vectors. One for 538 * the the brandname and 3 for the brand specific aux vectors. 539 */ 540 args->auxsize += 4 * sizeof (aux_entry_t); 541 } 542 543 /* If the binary has an explicit ASLR flag, it must be honoured */ 544 if ((dynamicphdr != NULL) && 545 (dynamicphdr->p_filesz > 0)) { 546 Dyn *dp; 547 off_t i = 0; 548 549 #define DYN_STRIDE 100 550 for (i = 0; i < dynamicphdr->p_filesz; 551 i += sizeof (*dyn) * DYN_STRIDE) { 552 int ndyns = (dynamicphdr->p_filesz - i) / sizeof (*dyn); 553 size_t dynsize; 554 555 ndyns = MIN(DYN_STRIDE, ndyns); 556 dynsize = ndyns * sizeof (*dyn); 557 558 dyn = kmem_alloc(dynsize, KM_SLEEP); 559 560 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)dyn, 561 dynsize, (offset_t)(dynamicphdr->p_offset + i), 562 UIO_SYSSPACE, 0, (rlim64_t)0, 563 CRED(), &resid)) != 0) { 564 uprintf("%s: cannot read .dynamic section\n", 565 exec_file); 566 goto out; 567 } 568 569 for (dp = dyn; dp < (dyn + ndyns); dp++) { 570 if (dp->d_tag == DT_SUNW_ASLR) { 571 if ((error = handle_secflag_dt(p, 572 DT_SUNW_ASLR, 573 dp->d_un.d_val)) != 0) { 574 uprintf("%s: error setting " 575 "security-flag from " 576 "DT_SUNW_ASLR: %d\n", 577 exec_file, error); 578 goto out; 579 } 580 } 581 } 582 583 kmem_free(dyn, dynsize); 584 } 585 } 586 587 /* Hardware/Software capabilities */ 588 if (capphdr != NULL && 589 (capsize = capphdr->p_filesz) > 0 && 590 capsize <= 16 * sizeof (*cap)) { 591 int ncaps = capsize / sizeof (*cap); 592 Cap *cp; 593 594 cap = kmem_alloc(capsize, KM_SLEEP); 595 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)cap, 596 capsize, (offset_t)capphdr->p_offset, 597 UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid)) != 0) { 598 uprintf("%s: Cannot read capabilities section\n", 599 exec_file); 600 goto out; 601 } 602 for (cp = cap; cp < cap + ncaps; cp++) { 603 if (cp->c_tag == CA_SUNW_SF_1 && 604 (cp->c_un.c_val & SF1_SUNW_ADDR32)) { 605 if (args->to_model == DATAMODEL_LP64) 606 args->addr32 = 1; 607 break; 608 } 609 } 610 } 611 612 aux = bigwad->elfargs; 613 /* 614 * Move args to the user's stack. 615 * This can fill in the AT_SUN_PLATFORM and AT_SUN_EXECNAME aux entries. 616 */ 617 if ((error = exec_args(uap, args, idatap, (void **)&aux)) != 0) { 618 if (error == -1) { 619 error = ENOEXEC; 620 goto bad; 621 } 622 goto out; 623 } 624 /* we're single threaded after this point */ 625 626 /* 627 * If this is an ET_DYN executable (shared object), 628 * determine its memory size so that mapelfexec() can load it. 629 */ 630 if (ehdrp->e_type == ET_DYN) 631 len = elfsize(ehdrp, nphdrs, phdrbase, NULL); 632 else 633 len = 0; 634 635 dtrphdr = NULL; 636 637 if ((error = mapelfexec(vp, ehdrp, nphdrs, phdrbase, &uphdr, &intphdr, 638 &stphdr, &dtrphdr, dataphdrp, &bssbase, &brkbase, &voffset, NULL, 639 len, execsz, &brksize)) != 0) 640 goto bad; 641 642 if (uphdr != NULL && intphdr == NULL) 643 goto bad; 644 645 if (dtrphdr != NULL && dtrace_safe_phdr(dtrphdr, args, voffset) != 0) { 646 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, exec_file); 647 goto bad; 648 } 649 650 if (intphdr != NULL) { 651 size_t len; 652 uintptr_t lddata; 653 char *p; 654 struct vnode *nvp; 655 656 dlnsize = intphdr->p_filesz; 657 658 if (dlnsize > MAXPATHLEN || dlnsize <= 0) 659 goto bad; 660 661 /* 662 * Read in "interpreter" pathname. 663 */ 664 if ((error = vn_rdwr(UIO_READ, vp, dlnp, intphdr->p_filesz, 665 (offset_t)intphdr->p_offset, UIO_SYSSPACE, 0, (rlim64_t)0, 666 CRED(), &resid)) != 0) { 667 uprintf("%s: Cannot obtain interpreter pathname\n", 668 exec_file); 669 goto bad; 670 } 671 672 if (resid != 0 || dlnp[dlnsize - 1] != '\0') 673 goto bad; 674 675 /* 676 * Search for '$ORIGIN' token in interpreter path. 677 * If found, expand it. 678 */ 679 for (p = dlnp; p = strchr(p, '$'); ) { 680 uint_t len, curlen; 681 char *_ptr; 682 683 if (strncmp(++p, ORIGIN_STR, ORIGIN_STR_SIZE)) 684 continue; 685 686 /* 687 * We don't support $ORIGIN on setid programs to close 688 * a potential attack vector. 689 */ 690 if ((setid & EXECSETID_SETID) != 0) { 691 error = ENOEXEC; 692 goto bad; 693 } 694 695 curlen = 0; 696 len = p - dlnp - 1; 697 if (len) { 698 bcopy(dlnp, pathbufp, len); 699 curlen += len; 700 } 701 if (_ptr = strrchr(args->pathname, '/')) { 702 len = _ptr - args->pathname; 703 if ((curlen + len) > MAXPATHLEN) 704 break; 705 706 bcopy(args->pathname, &pathbufp[curlen], len); 707 curlen += len; 708 } else { 709 /* 710 * executable is a basename found in the 711 * current directory. So - just substitue 712 * '.' for ORIGIN. 713 */ 714 pathbufp[curlen] = '.'; 715 curlen++; 716 } 717 p += ORIGIN_STR_SIZE; 718 len = strlen(p); 719 720 if ((curlen + len) > MAXPATHLEN) 721 break; 722 bcopy(p, &pathbufp[curlen], len); 723 curlen += len; 724 pathbufp[curlen++] = '\0'; 725 bcopy(pathbufp, dlnp, curlen); 726 } 727 728 /* 729 * /usr/lib/ld.so.1 is known to be a symlink to /lib/ld.so.1 730 * (and /usr/lib/64/ld.so.1 is a symlink to /lib/64/ld.so.1). 731 * Just in case /usr is not mounted, change it now. 732 */ 733 if (strcmp(dlnp, USR_LIB_RTLD) == 0) 734 dlnp += 4; 735 error = lookupname(dlnp, UIO_SYSSPACE, FOLLOW, NULLVPP, &nvp); 736 if (error && dlnp != bigwad->dl_name) { 737 /* new kernel, old user-level */ 738 error = lookupname(dlnp -= 4, UIO_SYSSPACE, FOLLOW, 739 NULLVPP, &nvp); 740 } 741 if (error) { 742 uprintf("%s: Cannot find %s\n", exec_file, dlnp); 743 goto bad; 744 } 745 746 /* 747 * Setup the "aux" vector. 748 */ 749 if (uphdr) { 750 if (ehdrp->e_type == ET_DYN) { 751 /* don't use the first page */ 752 bigwad->exenv.ex_brkbase = (caddr_t)PAGESIZE; 753 bigwad->exenv.ex_bssbase = (caddr_t)PAGESIZE; 754 } else { 755 bigwad->exenv.ex_bssbase = bssbase; 756 bigwad->exenv.ex_brkbase = brkbase; 757 } 758 bigwad->exenv.ex_brksize = brksize; 759 bigwad->exenv.ex_magic = elfmagic; 760 bigwad->exenv.ex_vp = vp; 761 setexecenv(&bigwad->exenv); 762 763 ADDAUX(aux, AT_PHDR, uphdr->p_vaddr + voffset) 764 ADDAUX(aux, AT_PHENT, ehdrp->e_phentsize) 765 ADDAUX(aux, AT_PHNUM, nphdrs) 766 ADDAUX(aux, AT_ENTRY, ehdrp->e_entry + voffset) 767 } else { 768 if ((error = execopen(&vp, &fd)) != 0) { 769 VN_RELE(nvp); 770 goto bad; 771 } 772 773 ADDAUX(aux, AT_EXECFD, fd) 774 } 775 776 if ((error = execpermissions(nvp, &bigwad->vattr, args)) != 0) { 777 VN_RELE(nvp); 778 uprintf("%s: Cannot execute %s\n", exec_file, dlnp); 779 goto bad; 780 } 781 782 /* 783 * Now obtain the ELF header along with the entire program 784 * header contained in "nvp". 785 */ 786 kmem_free(phdrbase, phdrsize); 787 phdrbase = NULL; 788 if ((error = getelfhead(nvp, CRED(), ehdrp, &nshdrs, 789 &shstrndx, &nphdrs)) != 0 || 790 (error = getelfphdr(nvp, CRED(), ehdrp, nphdrs, &phdrbase, 791 &phdrsize)) != 0) { 792 VN_RELE(nvp); 793 uprintf("%s: Cannot read %s\n", exec_file, dlnp); 794 goto bad; 795 } 796 797 /* 798 * Determine memory size of the "interpreter's" loadable 799 * sections. This size is then used to obtain the virtual 800 * address of a hole, in the user's address space, large 801 * enough to map the "interpreter". 802 */ 803 if ((len = elfsize(ehdrp, nphdrs, phdrbase, &lddata)) == 0) { 804 VN_RELE(nvp); 805 uprintf("%s: Nothing to load in %s\n", exec_file, dlnp); 806 goto bad; 807 } 808 809 dtrphdr = NULL; 810 811 error = mapelfexec(nvp, ehdrp, nphdrs, phdrbase, &junk, &junk, 812 &junk, &dtrphdr, NULL, NULL, NULL, &voffset, NULL, len, 813 execsz, NULL); 814 if (error || junk != NULL) { 815 VN_RELE(nvp); 816 uprintf("%s: Cannot map %s\n", exec_file, dlnp); 817 goto bad; 818 } 819 820 /* 821 * We use the DTrace program header to initialize the 822 * architecture-specific user per-LWP location. The dtrace 823 * fasttrap provider requires ready access to per-LWP scratch 824 * space. We assume that there is only one such program header 825 * in the interpreter. 826 */ 827 if (dtrphdr != NULL && 828 dtrace_safe_phdr(dtrphdr, args, voffset) != 0) { 829 VN_RELE(nvp); 830 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, dlnp); 831 goto bad; 832 } 833 834 VN_RELE(nvp); 835 ADDAUX(aux, AT_SUN_LDDATA, voffset + lddata) 836 } 837 838 if (hasauxv) { 839 int auxf = AF_SUN_HWCAPVERIFY; 840 #if defined(__amd64) 841 size_t fpsize; 842 int fptype; 843 #endif /* defined(__amd64) */ 844 845 /* 846 * Note: AT_SUN_PLATFORM and AT_SUN_EXECNAME were filled in via 847 * exec_args() 848 */ 849 ADDAUX(aux, AT_BASE, voffset) 850 ADDAUX(aux, AT_FLAGS, at_flags) 851 ADDAUX(aux, AT_PAGESZ, PAGESIZE) 852 /* 853 * Linker flags. (security) 854 * p_flag not yet set at this time. 855 * We rely on gexec() to provide us with the information. 856 * If the application is set-uid but this is not reflected 857 * in a mismatch between real/effective uids/gids, then 858 * don't treat this as a set-uid exec. So we care about 859 * the EXECSETID_UGIDS flag but not the ...SETID flag. 860 */ 861 if ((setid &= ~EXECSETID_SETID) != 0) 862 auxf |= AF_SUN_SETUGID; 863 864 /* 865 * If we're running a native process from within a branded 866 * zone under pfexec then we clear the AF_SUN_SETUGID flag so 867 * that the native ld.so.1 is able to link with the native 868 * libraries instead of using the brand libraries that are 869 * installed in the zone. We only do this for processes 870 * which we trust because we see they are already running 871 * under pfexec (where uid != euid). This prevents a 872 * malicious user within the zone from crafting a wrapper to 873 * run native suid commands with unsecure libraries interposed. 874 */ 875 if ((brand_action == EBA_NATIVE) && (PROC_IS_BRANDED(p) && 876 (setid &= ~EXECSETID_SETID) != 0)) 877 auxf &= ~AF_SUN_SETUGID; 878 879 /* 880 * Record the user addr of the auxflags aux vector entry 881 * since brands may optionally want to manipulate this field. 882 */ 883 args->auxp_auxflags = 884 (char *)((char *)args->stackend + 885 ((char *)&aux->a_type - 886 (char *)bigwad->elfargs)); 887 ADDAUX(aux, AT_SUN_AUXFLAGS, auxf); 888 889 /* 890 * Hardware capability flag word (performance hints) 891 * Used for choosing faster library routines. 892 * (Potentially different between 32-bit and 64-bit ABIs) 893 */ 894 #if defined(_LP64) 895 if (args->to_model == DATAMODEL_NATIVE) { 896 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap) 897 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2) 898 } else { 899 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap32) 900 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap32_2) 901 } 902 #else 903 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap) 904 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2) 905 #endif 906 if (branded) { 907 /* 908 * Reserve space for the brand-private aux vectors, 909 * and record the user addr of that space. 910 */ 911 args->auxp_brand = 912 (char *)((char *)args->stackend + 913 ((char *)&aux->a_type - 914 (char *)bigwad->elfargs)); 915 ADDAUX(aux, AT_SUN_BRAND_AUX1, 0) 916 ADDAUX(aux, AT_SUN_BRAND_AUX2, 0) 917 ADDAUX(aux, AT_SUN_BRAND_AUX3, 0) 918 } 919 920 /* 921 * Add the comm page auxv entry, mapping it in if needed. Also 922 * take care of the FPU entries. 923 */ 924 #if defined(__amd64) 925 if (args->commpage != NULL || 926 (args->commpage = (uintptr_t)comm_page_mapin()) != NULL) { 927 ADDAUX(aux, AT_SUN_COMMPAGE, args->commpage) 928 } else { 929 /* 930 * If the comm page cannot be mapped, pad out the auxv 931 * to satisfy later size checks. 932 */ 933 ADDAUX(aux, AT_NULL, 0) 934 } 935 936 fptype = AT_386_FPINFO_NONE; 937 fpu_auxv_info(&fptype, &fpsize); 938 if (fptype != AT_386_FPINFO_NONE) { 939 ADDAUX(aux, AT_SUN_FPTYPE, fptype) 940 ADDAUX(aux, AT_SUN_FPSIZE, fpsize) 941 } else { 942 ADDAUX(aux, AT_NULL, 0) 943 ADDAUX(aux, AT_NULL, 0) 944 } 945 #endif /* defined(__amd64) */ 946 947 ADDAUX(aux, AT_NULL, 0) 948 postfixsize = (char *)aux - (char *)bigwad->elfargs; 949 950 /* 951 * We make assumptions above when we determine how many aux 952 * vector entries we will be adding. However, if we have an 953 * invalid elf file, it is possible that mapelfexec might 954 * behave differently (but not return an error), in which case 955 * the number of aux entries we actually add will be different. 956 * We detect that now and error out. 957 */ 958 if (postfixsize != args->auxsize) { 959 DTRACE_PROBE2(elfexec_badaux, int, postfixsize, 960 int, args->auxsize); 961 goto bad; 962 } 963 ASSERT(postfixsize <= __KERN_NAUXV_IMPL * sizeof (aux_entry_t)); 964 } 965 966 /* 967 * For the 64-bit kernel, the limit is big enough that rounding it up 968 * to a page can overflow the 64-bit limit, so we check for btopr() 969 * overflowing here by comparing it with the unrounded limit in pages. 970 * If it hasn't overflowed, compare the exec size with the rounded up 971 * limit in pages. Otherwise, just compare with the unrounded limit. 972 */ 973 limit = btop(p->p_vmem_ctl); 974 roundlimit = btopr(p->p_vmem_ctl); 975 if ((roundlimit > limit && *execsz > roundlimit) || 976 (roundlimit < limit && *execsz > limit)) { 977 mutex_enter(&p->p_lock); 978 (void) rctl_action(rctlproc_legacy[RLIMIT_VMEM], p->p_rctls, p, 979 RCA_SAFE); 980 mutex_exit(&p->p_lock); 981 error = ENOMEM; 982 goto bad; 983 } 984 985 bzero(up->u_auxv, sizeof (up->u_auxv)); 986 up->u_commpagep = args->commpage; 987 if (postfixsize) { 988 int num_auxv; 989 990 /* 991 * Copy the aux vector to the user stack. 992 */ 993 error = execpoststack(args, bigwad->elfargs, postfixsize); 994 if (error) 995 goto bad; 996 997 /* 998 * Copy auxv to the process's user structure for use by /proc. 999 * If this is a branded process, the brand's exec routine will 1000 * copy it's private entries to the user structure later. It 1001 * relies on the fact that the blank entries are at the end. 1002 */ 1003 num_auxv = postfixsize / sizeof (aux_entry_t); 1004 ASSERT(num_auxv <= sizeof (up->u_auxv) / sizeof (auxv_t)); 1005 aux = bigwad->elfargs; 1006 for (i = 0; i < num_auxv; i++) { 1007 up->u_auxv[i].a_type = aux[i].a_type; 1008 up->u_auxv[i].a_un.a_val = (aux_val_t)aux[i].a_un.a_val; 1009 } 1010 } 1011 1012 /* 1013 * Pass back the starting address so we can set the program counter. 1014 */ 1015 args->entry = (uintptr_t)(ehdrp->e_entry + voffset); 1016 1017 if (!uphdr) { 1018 if (ehdrp->e_type == ET_DYN) { 1019 /* 1020 * If we are executing a shared library which doesn't 1021 * have a interpreter (probably ld.so.1) then 1022 * we don't set the brkbase now. Instead we 1023 * delay it's setting until the first call 1024 * via grow.c::brk(). This permits ld.so.1 to 1025 * initialize brkbase to the tail of the executable it 1026 * loads (which is where it needs to be). 1027 */ 1028 bigwad->exenv.ex_brkbase = (caddr_t)0; 1029 bigwad->exenv.ex_bssbase = (caddr_t)0; 1030 bigwad->exenv.ex_brksize = 0; 1031 } else { 1032 bigwad->exenv.ex_brkbase = brkbase; 1033 bigwad->exenv.ex_bssbase = bssbase; 1034 bigwad->exenv.ex_brksize = brksize; 1035 } 1036 bigwad->exenv.ex_magic = elfmagic; 1037 bigwad->exenv.ex_vp = vp; 1038 setexecenv(&bigwad->exenv); 1039 } 1040 1041 ASSERT(error == 0); 1042 goto out; 1043 1044 bad: 1045 if (fd != -1) /* did we open the a.out yet */ 1046 (void) execclose(fd); 1047 1048 psignal(p, SIGKILL); 1049 1050 if (error == 0) 1051 error = ENOEXEC; 1052 out: 1053 if (phdrbase != NULL) 1054 kmem_free(phdrbase, phdrsize); 1055 if (cap != NULL) 1056 kmem_free(cap, capsize); 1057 kmem_free(bigwad, sizeof (struct bigwad)); 1058 return (error); 1059 } 1060 1061 /* 1062 * Compute the memory size requirement for the ELF file. 1063 */ 1064 static size_t 1065 elfsize(Ehdr *ehdrp, int nphdrs, caddr_t phdrbase, uintptr_t *lddata) 1066 { 1067 size_t len; 1068 Phdr *phdrp = (Phdr *)phdrbase; 1069 int hsize = ehdrp->e_phentsize; 1070 int first = 1; 1071 int dfirst = 1; /* first data segment */ 1072 uintptr_t loaddr = 0; 1073 uintptr_t hiaddr = 0; 1074 uintptr_t lo, hi; 1075 int i; 1076 1077 for (i = nphdrs; i > 0; i--) { 1078 if (phdrp->p_type == PT_LOAD) { 1079 lo = phdrp->p_vaddr; 1080 hi = lo + phdrp->p_memsz; 1081 if (first) { 1082 loaddr = lo; 1083 hiaddr = hi; 1084 first = 0; 1085 } else { 1086 if (loaddr > lo) 1087 loaddr = lo; 1088 if (hiaddr < hi) 1089 hiaddr = hi; 1090 } 1091 1092 /* 1093 * save the address of the first data segment 1094 * of a object - used for the AT_SUNW_LDDATA 1095 * aux entry. 1096 */ 1097 if ((lddata != NULL) && dfirst && 1098 (phdrp->p_flags & PF_W)) { 1099 *lddata = lo; 1100 dfirst = 0; 1101 } 1102 } 1103 phdrp = (Phdr *)((caddr_t)phdrp + hsize); 1104 } 1105 1106 len = hiaddr - (loaddr & PAGEMASK); 1107 len = roundup(len, PAGESIZE); 1108 1109 return (len); 1110 } 1111 1112 /* 1113 * Read in the ELF header and program header table. 1114 * SUSV3 requires: 1115 * ENOEXEC File format is not recognized 1116 * EINVAL Format recognized but execution not supported 1117 */ 1118 static int 1119 getelfhead(vnode_t *vp, cred_t *credp, Ehdr *ehdr, int *nshdrs, int *shstrndx, 1120 int *nphdrs) 1121 { 1122 int error; 1123 ssize_t resid; 1124 1125 /* 1126 * We got here by the first two bytes in ident, 1127 * now read the entire ELF header. 1128 */ 1129 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)ehdr, 1130 sizeof (Ehdr), (offset_t)0, UIO_SYSSPACE, 0, 1131 (rlim64_t)0, credp, &resid)) != 0) 1132 return (error); 1133 1134 /* 1135 * Since a separate version is compiled for handling 32-bit and 1136 * 64-bit ELF executables on a 64-bit kernel, the 64-bit version 1137 * doesn't need to be able to deal with 32-bit ELF files. 1138 */ 1139 if (resid != 0 || 1140 ehdr->e_ident[EI_MAG2] != ELFMAG2 || 1141 ehdr->e_ident[EI_MAG3] != ELFMAG3) 1142 return (ENOEXEC); 1143 1144 if ((ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) || 1145 #if defined(_ILP32) || defined(_ELF32_COMPAT) 1146 ehdr->e_ident[EI_CLASS] != ELFCLASS32 || 1147 #else 1148 ehdr->e_ident[EI_CLASS] != ELFCLASS64 || 1149 #endif 1150 !elfheadcheck(ehdr->e_ident[EI_DATA], ehdr->e_machine, 1151 ehdr->e_flags)) 1152 return (EINVAL); 1153 1154 *nshdrs = ehdr->e_shnum; 1155 *shstrndx = ehdr->e_shstrndx; 1156 *nphdrs = ehdr->e_phnum; 1157 1158 /* 1159 * If e_shnum, e_shstrndx, or e_phnum is its sentinel value, we need 1160 * to read in the section header at index zero to acces the true 1161 * values for those fields. 1162 */ 1163 if ((*nshdrs == 0 && ehdr->e_shoff != 0) || 1164 *shstrndx == SHN_XINDEX || *nphdrs == PN_XNUM) { 1165 Shdr shdr; 1166 1167 if (ehdr->e_shoff == 0) 1168 return (EINVAL); 1169 1170 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)&shdr, 1171 sizeof (shdr), (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, 1172 (rlim64_t)0, credp, &resid)) != 0) 1173 return (error); 1174 1175 if (*nshdrs == 0) 1176 *nshdrs = shdr.sh_size; 1177 if (*shstrndx == SHN_XINDEX) 1178 *shstrndx = shdr.sh_link; 1179 if (*nphdrs == PN_XNUM && shdr.sh_info != 0) 1180 *nphdrs = shdr.sh_info; 1181 } 1182 1183 return (0); 1184 } 1185 1186 #ifdef _ELF32_COMPAT 1187 extern size_t elf_nphdr_max; 1188 #else 1189 size_t elf_nphdr_max = 1000; 1190 #endif 1191 1192 static int 1193 getelfphdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, int nphdrs, 1194 caddr_t *phbasep, ssize_t *phsizep) 1195 { 1196 ssize_t resid, minsize; 1197 int err; 1198 1199 /* 1200 * Since we're going to be using e_phentsize to iterate down the 1201 * array of program headers, it must be 8-byte aligned or else 1202 * a we might cause a misaligned access. We use all members through 1203 * p_flags on 32-bit ELF files and p_memsz on 64-bit ELF files so 1204 * e_phentsize must be at least large enough to include those 1205 * members. 1206 */ 1207 #if !defined(_LP64) || defined(_ELF32_COMPAT) 1208 minsize = offsetof(Phdr, p_flags) + sizeof (((Phdr *)NULL)->p_flags); 1209 #else 1210 minsize = offsetof(Phdr, p_memsz) + sizeof (((Phdr *)NULL)->p_memsz); 1211 #endif 1212 if (ehdr->e_phentsize < minsize || (ehdr->e_phentsize & 3)) 1213 return (EINVAL); 1214 1215 *phsizep = nphdrs * ehdr->e_phentsize; 1216 1217 if (*phsizep > sizeof (Phdr) * elf_nphdr_max) { 1218 if ((*phbasep = kmem_alloc(*phsizep, KM_NOSLEEP)) == NULL) 1219 return (ENOMEM); 1220 } else { 1221 *phbasep = kmem_alloc(*phsizep, KM_SLEEP); 1222 } 1223 1224 if ((err = vn_rdwr(UIO_READ, vp, *phbasep, *phsizep, 1225 (offset_t)ehdr->e_phoff, UIO_SYSSPACE, 0, (rlim64_t)0, 1226 credp, &resid)) != 0) { 1227 kmem_free(*phbasep, *phsizep); 1228 *phbasep = NULL; 1229 return (err); 1230 } 1231 1232 return (0); 1233 } 1234 1235 #ifdef _ELF32_COMPAT 1236 extern size_t elf_nshdr_max; 1237 extern size_t elf_shstrtab_max; 1238 #else 1239 size_t elf_nshdr_max = 10000; 1240 size_t elf_shstrtab_max = 100 * 1024; 1241 #endif 1242 1243 1244 static int 1245 getelfshdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, 1246 int nshdrs, int shstrndx, caddr_t *shbasep, ssize_t *shsizep, 1247 char **shstrbasep, ssize_t *shstrsizep) 1248 { 1249 ssize_t resid, minsize; 1250 int err; 1251 Shdr *shdr; 1252 1253 /* 1254 * Since we're going to be using e_shentsize to iterate down the 1255 * array of section headers, it must be 8-byte aligned or else 1256 * a we might cause a misaligned access. We use all members through 1257 * sh_entsize (on both 32- and 64-bit ELF files) so e_shentsize 1258 * must be at least large enough to include that member. The index 1259 * of the string table section must also be valid. 1260 */ 1261 minsize = offsetof(Shdr, sh_entsize) + sizeof (shdr->sh_entsize); 1262 if (ehdr->e_shentsize < minsize || (ehdr->e_shentsize & 3) || 1263 shstrndx >= nshdrs) 1264 return (EINVAL); 1265 1266 *shsizep = nshdrs * ehdr->e_shentsize; 1267 1268 if (*shsizep > sizeof (Shdr) * elf_nshdr_max) { 1269 if ((*shbasep = kmem_alloc(*shsizep, KM_NOSLEEP)) == NULL) 1270 return (ENOMEM); 1271 } else { 1272 *shbasep = kmem_alloc(*shsizep, KM_SLEEP); 1273 } 1274 1275 if ((err = vn_rdwr(UIO_READ, vp, *shbasep, *shsizep, 1276 (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, (rlim64_t)0, 1277 credp, &resid)) != 0) { 1278 kmem_free(*shbasep, *shsizep); 1279 return (err); 1280 } 1281 1282 /* 1283 * Pull the section string table out of the vnode; fail if the size 1284 * is zero. 1285 */ 1286 shdr = (Shdr *)(*shbasep + shstrndx * ehdr->e_shentsize); 1287 if ((*shstrsizep = shdr->sh_size) == 0) { 1288 kmem_free(*shbasep, *shsizep); 1289 return (EINVAL); 1290 } 1291 1292 if (*shstrsizep > elf_shstrtab_max) { 1293 if ((*shstrbasep = kmem_alloc(*shstrsizep, 1294 KM_NOSLEEP)) == NULL) { 1295 kmem_free(*shbasep, *shsizep); 1296 return (ENOMEM); 1297 } 1298 } else { 1299 *shstrbasep = kmem_alloc(*shstrsizep, KM_SLEEP); 1300 } 1301 1302 if ((err = vn_rdwr(UIO_READ, vp, *shstrbasep, *shstrsizep, 1303 (offset_t)shdr->sh_offset, UIO_SYSSPACE, 0, (rlim64_t)0, 1304 credp, &resid)) != 0) { 1305 kmem_free(*shbasep, *shsizep); 1306 kmem_free(*shstrbasep, *shstrsizep); 1307 return (err); 1308 } 1309 1310 /* 1311 * Make sure the strtab is null-terminated to make sure we 1312 * don't run off the end of the table. 1313 */ 1314 (*shstrbasep)[*shstrsizep - 1] = '\0'; 1315 1316 return (0); 1317 } 1318 1319 static int 1320 mapelfexec( 1321 vnode_t *vp, 1322 Ehdr *ehdr, 1323 int nphdrs, 1324 caddr_t phdrbase, 1325 Phdr **uphdr, 1326 Phdr **intphdr, 1327 Phdr **stphdr, 1328 Phdr **dtphdr, 1329 Phdr *dataphdrp, 1330 caddr_t *bssbase, 1331 caddr_t *brkbase, 1332 intptr_t *voffset, 1333 intptr_t *minaddr, 1334 size_t len, 1335 long *execsz, 1336 size_t *brksize) 1337 { 1338 Phdr *phdr; 1339 int i, prot, error; 1340 caddr_t addr = NULL; 1341 size_t zfodsz; 1342 int ptload = 0; 1343 int page; 1344 off_t offset; 1345 int hsize = ehdr->e_phentsize; 1346 caddr_t mintmp = (caddr_t)-1; 1347 extern int use_brk_lpg; 1348 1349 if (ehdr->e_type == ET_DYN) { 1350 secflagset_t flags = 0; 1351 /* 1352 * Obtain the virtual address of a hole in the 1353 * address space to map the "interpreter". 1354 */ 1355 if (secflag_enabled(curproc, PROC_SEC_ASLR)) 1356 flags |= _MAP_RANDOMIZE; 1357 1358 map_addr(&addr, len, (offset_t)0, 1, flags); 1359 if (addr == NULL) 1360 return (ENOMEM); 1361 *voffset = (intptr_t)addr; 1362 1363 /* 1364 * Calculate the minimum vaddr so it can be subtracted out. 1365 * According to the ELF specification, since PT_LOAD sections 1366 * must be sorted by increasing p_vaddr values, this is 1367 * guaranteed to be the first PT_LOAD section. 1368 */ 1369 phdr = (Phdr *)phdrbase; 1370 for (i = nphdrs; i > 0; i--) { 1371 if (phdr->p_type == PT_LOAD) { 1372 *voffset -= (uintptr_t)phdr->p_vaddr; 1373 break; 1374 } 1375 phdr = (Phdr *)((caddr_t)phdr + hsize); 1376 } 1377 1378 } else { 1379 *voffset = 0; 1380 } 1381 phdr = (Phdr *)phdrbase; 1382 for (i = nphdrs; i > 0; i--) { 1383 switch (phdr->p_type) { 1384 case PT_LOAD: 1385 if ((*intphdr != NULL) && (*uphdr == NULL)) 1386 return (0); 1387 1388 ptload = 1; 1389 prot = PROT_USER; 1390 if (phdr->p_flags & PF_R) 1391 prot |= PROT_READ; 1392 if (phdr->p_flags & PF_W) 1393 prot |= PROT_WRITE; 1394 if (phdr->p_flags & PF_X) 1395 prot |= PROT_EXEC; 1396 1397 addr = (caddr_t)((uintptr_t)phdr->p_vaddr + *voffset); 1398 1399 /* 1400 * Keep track of the segment with the lowest starting 1401 * address. 1402 */ 1403 if (addr < mintmp) 1404 mintmp = addr; 1405 1406 zfodsz = (size_t)phdr->p_memsz - phdr->p_filesz; 1407 1408 offset = phdr->p_offset; 1409 if (((uintptr_t)offset & PAGEOFFSET) == 1410 ((uintptr_t)addr & PAGEOFFSET) && 1411 (!(vp->v_flag & VNOMAP))) { 1412 page = 1; 1413 } else { 1414 page = 0; 1415 } 1416 1417 /* 1418 * Set the heap pagesize for OOB when the bss size 1419 * is known and use_brk_lpg is not 0. 1420 */ 1421 if (brksize != NULL && use_brk_lpg && 1422 zfodsz != 0 && phdr == dataphdrp && 1423 (prot & PROT_WRITE)) { 1424 size_t tlen = P2NPHASE((uintptr_t)addr + 1425 phdr->p_filesz, PAGESIZE); 1426 1427 if (zfodsz > tlen) { 1428 curproc->p_brkpageszc = 1429 page_szc(map_pgsz(MAPPGSZ_HEAP, 1430 curproc, addr + phdr->p_filesz + 1431 tlen, zfodsz - tlen, 0)); 1432 } 1433 } 1434 1435 if (curproc->p_brkpageszc != 0 && phdr == dataphdrp && 1436 (prot & PROT_WRITE)) { 1437 uint_t szc = curproc->p_brkpageszc; 1438 size_t pgsz = page_get_pagesize(szc); 1439 caddr_t ebss = addr + phdr->p_memsz; 1440 /* 1441 * If we need extra space to keep the BSS an 1442 * integral number of pages in size, some of 1443 * that space may fall beyond p_brkbase, so we 1444 * need to set p_brksize to account for it 1445 * being (logically) part of the brk. 1446 */ 1447 size_t extra_zfodsz; 1448 1449 ASSERT(pgsz > PAGESIZE); 1450 1451 extra_zfodsz = P2NPHASE((uintptr_t)ebss, pgsz); 1452 1453 if (error = execmap(vp, addr, phdr->p_filesz, 1454 zfodsz + extra_zfodsz, phdr->p_offset, 1455 prot, page, szc)) 1456 goto bad; 1457 if (brksize != NULL) 1458 *brksize = extra_zfodsz; 1459 } else { 1460 if (error = execmap(vp, addr, phdr->p_filesz, 1461 zfodsz, phdr->p_offset, prot, page, 0)) 1462 goto bad; 1463 } 1464 1465 if (bssbase != NULL && addr >= *bssbase && 1466 phdr == dataphdrp) { 1467 *bssbase = addr + phdr->p_filesz; 1468 } 1469 if (brkbase != NULL && addr >= *brkbase) { 1470 *brkbase = addr + phdr->p_memsz; 1471 } 1472 1473 *execsz += btopr(phdr->p_memsz); 1474 break; 1475 1476 case PT_INTERP: 1477 if (ptload) 1478 goto bad; 1479 *intphdr = phdr; 1480 break; 1481 1482 case PT_SHLIB: 1483 *stphdr = phdr; 1484 break; 1485 1486 case PT_PHDR: 1487 if (ptload) 1488 goto bad; 1489 *uphdr = phdr; 1490 break; 1491 1492 case PT_NULL: 1493 case PT_DYNAMIC: 1494 case PT_NOTE: 1495 break; 1496 1497 case PT_SUNWDTRACE: 1498 if (dtphdr != NULL) 1499 *dtphdr = phdr; 1500 break; 1501 1502 default: 1503 break; 1504 } 1505 phdr = (Phdr *)((caddr_t)phdr + hsize); 1506 } 1507 1508 if (minaddr != NULL) { 1509 ASSERT(mintmp != (caddr_t)-1); 1510 *minaddr = (intptr_t)mintmp; 1511 } 1512 1513 if (brkbase != NULL && secflag_enabled(curproc, PROC_SEC_ASLR)) { 1514 size_t off; 1515 uintptr_t base = (uintptr_t)*brkbase; 1516 uintptr_t oend = base + *brksize; 1517 1518 ASSERT(ISP2(aslr_max_brk_skew)); 1519 1520 (void) random_get_pseudo_bytes((uint8_t *)&off, sizeof (off)); 1521 base += P2PHASE(off, aslr_max_brk_skew); 1522 base = P2ROUNDUP(base, PAGESIZE); 1523 *brkbase = (caddr_t)base; 1524 /* 1525 * Above, we set *brksize to account for the possibility we 1526 * had to grow the 'brk' in padding out the BSS to a page 1527 * boundary. 1528 * 1529 * We now need to adjust that based on where we now are 1530 * actually putting the brk. 1531 */ 1532 if (oend > base) 1533 *brksize = oend - base; 1534 else 1535 *brksize = 0; 1536 } 1537 1538 return (0); 1539 bad: 1540 if (error == 0) 1541 error = EINVAL; 1542 return (error); 1543 } 1544 1545 int 1546 elfnote(vnode_t *vp, offset_t *offsetp, int type, int descsz, void *desc, 1547 rlim64_t rlimit, cred_t *credp) 1548 { 1549 Note note; 1550 int error; 1551 1552 bzero(¬e, sizeof (note)); 1553 bcopy("CORE", note.name, 4); 1554 note.nhdr.n_type = type; 1555 /* 1556 * The System V ABI states that n_namesz must be the length of the 1557 * string that follows the Nhdr structure including the terminating 1558 * null. The ABI also specifies that sufficient padding should be 1559 * included so that the description that follows the name string 1560 * begins on a 4- or 8-byte boundary for 32- and 64-bit binaries 1561 * respectively. However, since this change was not made correctly 1562 * at the time of the 64-bit port, both 32- and 64-bit binaries 1563 * descriptions are only guaranteed to begin on a 4-byte boundary. 1564 */ 1565 note.nhdr.n_namesz = 5; 1566 note.nhdr.n_descsz = roundup(descsz, sizeof (Word)); 1567 1568 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, ¬e, 1569 sizeof (note), rlimit, credp)) 1570 return (error); 1571 1572 *offsetp += sizeof (note); 1573 1574 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, desc, 1575 note.nhdr.n_descsz, rlimit, credp)) 1576 return (error); 1577 1578 *offsetp += note.nhdr.n_descsz; 1579 return (0); 1580 } 1581 1582 /* 1583 * Copy the section data from one vnode to the section of another vnode. 1584 */ 1585 static void 1586 copy_scn(Shdr *src, vnode_t *src_vp, Shdr *dst, vnode_t *dst_vp, Off *doffset, 1587 void *buf, size_t size, cred_t *credp, rlim64_t rlimit) 1588 { 1589 ssize_t resid; 1590 size_t len, n = src->sh_size; 1591 offset_t off = 0; 1592 1593 while (n != 0) { 1594 len = MIN(size, n); 1595 if (vn_rdwr(UIO_READ, src_vp, buf, len, src->sh_offset + off, 1596 UIO_SYSSPACE, 0, (rlim64_t)0, credp, &resid) != 0 || 1597 resid >= len || 1598 core_write(dst_vp, UIO_SYSSPACE, *doffset + off, 1599 buf, len - resid, rlimit, credp) != 0) { 1600 dst->sh_size = 0; 1601 dst->sh_offset = 0; 1602 return; 1603 } 1604 1605 ASSERT(n >= len - resid); 1606 1607 n -= len - resid; 1608 off += len - resid; 1609 } 1610 1611 *doffset += src->sh_size; 1612 } 1613 1614 #ifdef _ELF32_COMPAT 1615 extern size_t elf_datasz_max; 1616 #else 1617 size_t elf_datasz_max = 1 * 1024 * 1024; 1618 #endif 1619 1620 /* 1621 * This function processes mappings that correspond to load objects to 1622 * examine their respective sections for elfcore(). It's called once with 1623 * v set to NULL to count the number of sections that we're going to need 1624 * and then again with v set to some allocated buffer that we fill in with 1625 * all the section data. 1626 */ 1627 static int 1628 process_scns(core_content_t content, proc_t *p, cred_t *credp, vnode_t *vp, 1629 Shdr *v, int nv, rlim64_t rlimit, Off *doffsetp, int *nshdrsp) 1630 { 1631 vnode_t *lastvp = NULL; 1632 struct seg *seg; 1633 int i, j; 1634 void *data = NULL; 1635 size_t datasz = 0; 1636 shstrtab_t shstrtab; 1637 struct as *as = p->p_as; 1638 int error = 0; 1639 1640 if (v != NULL) 1641 shstrtab_init(&shstrtab); 1642 1643 i = 1; 1644 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) { 1645 uint_t prot; 1646 vnode_t *mvp; 1647 void *tmp = NULL; 1648 caddr_t saddr = seg->s_base; 1649 caddr_t naddr; 1650 caddr_t eaddr; 1651 size_t segsize; 1652 1653 Ehdr ehdr; 1654 int nshdrs, shstrndx, nphdrs; 1655 caddr_t shbase; 1656 ssize_t shsize; 1657 char *shstrbase; 1658 ssize_t shstrsize; 1659 1660 Shdr *shdr; 1661 const char *name; 1662 size_t sz; 1663 uintptr_t off; 1664 1665 int ctf_ndx = 0; 1666 int symtab_ndx = 0; 1667 1668 /* 1669 * Since we're just looking for text segments of load 1670 * objects, we only care about the protection bits; we don't 1671 * care about the actual size of the segment so we use the 1672 * reserved size. If the segment's size is zero, there's 1673 * something fishy going on so we ignore this segment. 1674 */ 1675 if (seg->s_ops != &segvn_ops || 1676 SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 || 1677 mvp == lastvp || mvp == NULL || mvp->v_type != VREG || 1678 (segsize = pr_getsegsize(seg, 1)) == 0) 1679 continue; 1680 1681 eaddr = saddr + segsize; 1682 prot = pr_getprot(seg, 1, &tmp, &saddr, &naddr, eaddr); 1683 pr_getprot_done(&tmp); 1684 1685 /* 1686 * Skip this segment unless the protection bits look like 1687 * what we'd expect for a text segment. 1688 */ 1689 if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC) 1690 continue; 1691 1692 if (getelfhead(mvp, credp, &ehdr, &nshdrs, &shstrndx, 1693 &nphdrs) != 0 || 1694 getelfshdr(mvp, credp, &ehdr, nshdrs, shstrndx, 1695 &shbase, &shsize, &shstrbase, &shstrsize) != 0) 1696 continue; 1697 1698 off = ehdr.e_shentsize; 1699 for (j = 1; j < nshdrs; j++, off += ehdr.e_shentsize) { 1700 Shdr *symtab = NULL, *strtab; 1701 1702 shdr = (Shdr *)(shbase + off); 1703 1704 if (shdr->sh_name >= shstrsize) 1705 continue; 1706 1707 name = shstrbase + shdr->sh_name; 1708 1709 if (strcmp(name, shstrtab_data[STR_CTF]) == 0) { 1710 if ((content & CC_CONTENT_CTF) == 0 || 1711 ctf_ndx != 0) 1712 continue; 1713 1714 if (shdr->sh_link > 0 && 1715 shdr->sh_link < nshdrs) { 1716 symtab = (Shdr *)(shbase + 1717 shdr->sh_link * ehdr.e_shentsize); 1718 } 1719 1720 if (v != NULL && i < nv - 1) { 1721 if (shdr->sh_size > datasz && 1722 shdr->sh_size <= elf_datasz_max) { 1723 if (data != NULL) 1724 kmem_free(data, datasz); 1725 1726 datasz = shdr->sh_size; 1727 data = kmem_alloc(datasz, 1728 KM_SLEEP); 1729 } 1730 1731 v[i].sh_name = shstrtab_ndx(&shstrtab, 1732 STR_CTF); 1733 v[i].sh_addr = (Addr)(uintptr_t)saddr; 1734 v[i].sh_type = SHT_PROGBITS; 1735 v[i].sh_addralign = 4; 1736 *doffsetp = roundup(*doffsetp, 1737 v[i].sh_addralign); 1738 v[i].sh_offset = *doffsetp; 1739 v[i].sh_size = shdr->sh_size; 1740 if (symtab == NULL) { 1741 v[i].sh_link = 0; 1742 } else if (symtab->sh_type == 1743 SHT_SYMTAB && 1744 symtab_ndx != 0) { 1745 v[i].sh_link = 1746 symtab_ndx; 1747 } else { 1748 v[i].sh_link = i + 1; 1749 } 1750 1751 copy_scn(shdr, mvp, &v[i], vp, 1752 doffsetp, data, datasz, credp, 1753 rlimit); 1754 } 1755 1756 ctf_ndx = i++; 1757 1758 /* 1759 * We've already dumped the symtab. 1760 */ 1761 if (symtab != NULL && 1762 symtab->sh_type == SHT_SYMTAB && 1763 symtab_ndx != 0) 1764 continue; 1765 1766 } else if (strcmp(name, 1767 shstrtab_data[STR_SYMTAB]) == 0) { 1768 if ((content & CC_CONTENT_SYMTAB) == 0 || 1769 symtab != 0) 1770 continue; 1771 1772 symtab = shdr; 1773 } 1774 1775 if (symtab != NULL) { 1776 if ((symtab->sh_type != SHT_DYNSYM && 1777 symtab->sh_type != SHT_SYMTAB) || 1778 symtab->sh_link == 0 || 1779 symtab->sh_link >= nshdrs) 1780 continue; 1781 1782 strtab = (Shdr *)(shbase + 1783 symtab->sh_link * ehdr.e_shentsize); 1784 1785 if (strtab->sh_type != SHT_STRTAB) 1786 continue; 1787 1788 if (v != NULL && i < nv - 2) { 1789 sz = MAX(symtab->sh_size, 1790 strtab->sh_size); 1791 if (sz > datasz && 1792 sz <= elf_datasz_max) { 1793 if (data != NULL) 1794 kmem_free(data, datasz); 1795 1796 datasz = sz; 1797 data = kmem_alloc(datasz, 1798 KM_SLEEP); 1799 } 1800 1801 if (symtab->sh_type == SHT_DYNSYM) { 1802 v[i].sh_name = shstrtab_ndx( 1803 &shstrtab, STR_DYNSYM); 1804 v[i + 1].sh_name = shstrtab_ndx( 1805 &shstrtab, STR_DYNSTR); 1806 } else { 1807 v[i].sh_name = shstrtab_ndx( 1808 &shstrtab, STR_SYMTAB); 1809 v[i + 1].sh_name = shstrtab_ndx( 1810 &shstrtab, STR_STRTAB); 1811 } 1812 1813 v[i].sh_type = symtab->sh_type; 1814 v[i].sh_addr = symtab->sh_addr; 1815 if (ehdr.e_type == ET_DYN || 1816 v[i].sh_addr == 0) 1817 v[i].sh_addr += 1818 (Addr)(uintptr_t)saddr; 1819 v[i].sh_addralign = 1820 symtab->sh_addralign; 1821 *doffsetp = roundup(*doffsetp, 1822 v[i].sh_addralign); 1823 v[i].sh_offset = *doffsetp; 1824 v[i].sh_size = symtab->sh_size; 1825 v[i].sh_link = i + 1; 1826 v[i].sh_entsize = symtab->sh_entsize; 1827 v[i].sh_info = symtab->sh_info; 1828 1829 copy_scn(symtab, mvp, &v[i], vp, 1830 doffsetp, data, datasz, credp, 1831 rlimit); 1832 1833 v[i + 1].sh_type = SHT_STRTAB; 1834 v[i + 1].sh_flags = SHF_STRINGS; 1835 v[i + 1].sh_addr = symtab->sh_addr; 1836 if (ehdr.e_type == ET_DYN || 1837 v[i + 1].sh_addr == 0) 1838 v[i + 1].sh_addr += 1839 (Addr)(uintptr_t)saddr; 1840 v[i + 1].sh_addralign = 1841 strtab->sh_addralign; 1842 *doffsetp = roundup(*doffsetp, 1843 v[i + 1].sh_addralign); 1844 v[i + 1].sh_offset = *doffsetp; 1845 v[i + 1].sh_size = strtab->sh_size; 1846 1847 copy_scn(strtab, mvp, &v[i + 1], vp, 1848 doffsetp, data, datasz, credp, 1849 rlimit); 1850 } 1851 1852 if (symtab->sh_type == SHT_SYMTAB) 1853 symtab_ndx = i; 1854 i += 2; 1855 } 1856 } 1857 1858 kmem_free(shstrbase, shstrsize); 1859 kmem_free(shbase, shsize); 1860 1861 lastvp = mvp; 1862 } 1863 1864 if (v == NULL) { 1865 if (i == 1) 1866 *nshdrsp = 0; 1867 else 1868 *nshdrsp = i + 1; 1869 goto done; 1870 } 1871 1872 if (i != nv - 1) { 1873 cmn_err(CE_WARN, "elfcore: core dump failed for " 1874 "process %d; address space is changing", p->p_pid); 1875 error = EIO; 1876 goto done; 1877 } 1878 1879 v[i].sh_name = shstrtab_ndx(&shstrtab, STR_SHSTRTAB); 1880 v[i].sh_size = shstrtab_size(&shstrtab); 1881 v[i].sh_addralign = 1; 1882 *doffsetp = roundup(*doffsetp, v[i].sh_addralign); 1883 v[i].sh_offset = *doffsetp; 1884 v[i].sh_flags = SHF_STRINGS; 1885 v[i].sh_type = SHT_STRTAB; 1886 1887 if (v[i].sh_size > datasz) { 1888 if (data != NULL) 1889 kmem_free(data, datasz); 1890 1891 datasz = v[i].sh_size; 1892 data = kmem_alloc(datasz, 1893 KM_SLEEP); 1894 } 1895 1896 shstrtab_dump(&shstrtab, data); 1897 1898 if ((error = core_write(vp, UIO_SYSSPACE, *doffsetp, 1899 data, v[i].sh_size, rlimit, credp)) != 0) 1900 goto done; 1901 1902 *doffsetp += v[i].sh_size; 1903 1904 done: 1905 if (data != NULL) 1906 kmem_free(data, datasz); 1907 1908 return (error); 1909 } 1910 1911 int 1912 elfcore(vnode_t *vp, proc_t *p, cred_t *credp, rlim64_t rlimit, int sig, 1913 core_content_t content) 1914 { 1915 offset_t poffset, soffset; 1916 Off doffset; 1917 int error, i, nphdrs, nshdrs; 1918 int overflow = 0; 1919 struct seg *seg; 1920 struct as *as = p->p_as; 1921 union { 1922 Ehdr ehdr; 1923 Phdr phdr[1]; 1924 Shdr shdr[1]; 1925 } *bigwad; 1926 size_t bigsize; 1927 size_t phdrsz, shdrsz; 1928 Ehdr *ehdr; 1929 Phdr *v; 1930 caddr_t brkbase; 1931 size_t brksize; 1932 caddr_t stkbase; 1933 size_t stksize; 1934 int ntries = 0; 1935 klwp_t *lwp = ttolwp(curthread); 1936 1937 top: 1938 /* 1939 * Make sure we have everything we need (registers, etc.). 1940 * All other lwps have already stopped and are in an orderly state. 1941 */ 1942 ASSERT(p == ttoproc(curthread)); 1943 prstop(0, 0); 1944 1945 AS_LOCK_ENTER(as, RW_WRITER); 1946 nphdrs = prnsegs(as, 0) + 2; /* two CORE note sections */ 1947 1948 /* 1949 * Count the number of section headers we're going to need. 1950 */ 1951 nshdrs = 0; 1952 if (content & (CC_CONTENT_CTF | CC_CONTENT_SYMTAB)) { 1953 (void) process_scns(content, p, credp, NULL, NULL, NULL, 0, 1954 NULL, &nshdrs); 1955 } 1956 AS_LOCK_EXIT(as); 1957 1958 ASSERT(nshdrs == 0 || nshdrs > 1); 1959 1960 /* 1961 * The core file contents may required zero section headers, but if 1962 * we overflow the 16 bits allotted to the program header count in 1963 * the ELF header, we'll need that program header at index zero. 1964 */ 1965 if (nshdrs == 0 && nphdrs >= PN_XNUM) 1966 nshdrs = 1; 1967 1968 phdrsz = nphdrs * sizeof (Phdr); 1969 shdrsz = nshdrs * sizeof (Shdr); 1970 1971 bigsize = MAX(sizeof (*bigwad), MAX(phdrsz, shdrsz)); 1972 bigwad = kmem_alloc(bigsize, KM_SLEEP); 1973 1974 ehdr = &bigwad->ehdr; 1975 bzero(ehdr, sizeof (*ehdr)); 1976 1977 ehdr->e_ident[EI_MAG0] = ELFMAG0; 1978 ehdr->e_ident[EI_MAG1] = ELFMAG1; 1979 ehdr->e_ident[EI_MAG2] = ELFMAG2; 1980 ehdr->e_ident[EI_MAG3] = ELFMAG3; 1981 ehdr->e_ident[EI_CLASS] = ELFCLASS; 1982 ehdr->e_type = ET_CORE; 1983 1984 #if !defined(_LP64) || defined(_ELF32_COMPAT) 1985 1986 #if defined(__sparc) 1987 ehdr->e_ident[EI_DATA] = ELFDATA2MSB; 1988 ehdr->e_machine = EM_SPARC; 1989 #elif defined(__i386) || defined(__i386_COMPAT) 1990 ehdr->e_ident[EI_DATA] = ELFDATA2LSB; 1991 ehdr->e_machine = EM_386; 1992 #else 1993 #error "no recognized machine type is defined" 1994 #endif 1995 1996 #else /* !defined(_LP64) || defined(_ELF32_COMPAT) */ 1997 1998 #if defined(__sparc) 1999 ehdr->e_ident[EI_DATA] = ELFDATA2MSB; 2000 ehdr->e_machine = EM_SPARCV9; 2001 #elif defined(__amd64) 2002 ehdr->e_ident[EI_DATA] = ELFDATA2LSB; 2003 ehdr->e_machine = EM_AMD64; 2004 #else 2005 #error "no recognized 64-bit machine type is defined" 2006 #endif 2007 2008 #endif /* !defined(_LP64) || defined(_ELF32_COMPAT) */ 2009 2010 /* 2011 * If the count of program headers or section headers or the index 2012 * of the section string table can't fit in the mere 16 bits 2013 * shortsightedly allotted to them in the ELF header, we use the 2014 * extended formats and put the real values in the section header 2015 * as index 0. 2016 */ 2017 ehdr->e_version = EV_CURRENT; 2018 ehdr->e_ehsize = sizeof (Ehdr); 2019 2020 if (nphdrs >= PN_XNUM) 2021 ehdr->e_phnum = PN_XNUM; 2022 else 2023 ehdr->e_phnum = (unsigned short)nphdrs; 2024 2025 ehdr->e_phoff = sizeof (Ehdr); 2026 ehdr->e_phentsize = sizeof (Phdr); 2027 2028 if (nshdrs > 0) { 2029 if (nshdrs >= SHN_LORESERVE) 2030 ehdr->e_shnum = 0; 2031 else 2032 ehdr->e_shnum = (unsigned short)nshdrs; 2033 2034 if (nshdrs - 1 >= SHN_LORESERVE) 2035 ehdr->e_shstrndx = SHN_XINDEX; 2036 else 2037 ehdr->e_shstrndx = (unsigned short)(nshdrs - 1); 2038 2039 ehdr->e_shoff = ehdr->e_phoff + ehdr->e_phentsize * nphdrs; 2040 ehdr->e_shentsize = sizeof (Shdr); 2041 } 2042 2043 if (error = core_write(vp, UIO_SYSSPACE, (offset_t)0, ehdr, 2044 sizeof (Ehdr), rlimit, credp)) 2045 goto done; 2046 2047 poffset = sizeof (Ehdr); 2048 soffset = sizeof (Ehdr) + phdrsz; 2049 doffset = sizeof (Ehdr) + phdrsz + shdrsz; 2050 2051 v = &bigwad->phdr[0]; 2052 bzero(v, phdrsz); 2053 2054 setup_old_note_header(&v[0], p); 2055 v[0].p_offset = doffset = roundup(doffset, sizeof (Word)); 2056 doffset += v[0].p_filesz; 2057 2058 setup_note_header(&v[1], p); 2059 v[1].p_offset = doffset = roundup(doffset, sizeof (Word)); 2060 doffset += v[1].p_filesz; 2061 2062 mutex_enter(&p->p_lock); 2063 2064 brkbase = p->p_brkbase; 2065 brksize = p->p_brksize; 2066 2067 stkbase = p->p_usrstack - p->p_stksize; 2068 stksize = p->p_stksize; 2069 2070 mutex_exit(&p->p_lock); 2071 2072 AS_LOCK_ENTER(as, RW_WRITER); 2073 i = 2; 2074 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) { 2075 caddr_t eaddr = seg->s_base + pr_getsegsize(seg, 0); 2076 caddr_t saddr, naddr; 2077 void *tmp = NULL; 2078 extern struct seg_ops segspt_shmops; 2079 2080 if ((seg->s_flags & S_HOLE) != 0) { 2081 continue; 2082 } 2083 2084 for (saddr = seg->s_base; saddr < eaddr; saddr = naddr) { 2085 uint_t prot; 2086 size_t size; 2087 int type; 2088 vnode_t *mvp; 2089 2090 prot = pr_getprot(seg, 0, &tmp, &saddr, &naddr, eaddr); 2091 prot &= PROT_READ | PROT_WRITE | PROT_EXEC; 2092 if ((size = (size_t)(naddr - saddr)) == 0) 2093 continue; 2094 if (i == nphdrs) { 2095 overflow++; 2096 continue; 2097 } 2098 v[i].p_type = PT_LOAD; 2099 v[i].p_vaddr = (Addr)(uintptr_t)saddr; 2100 v[i].p_memsz = size; 2101 if (prot & PROT_READ) 2102 v[i].p_flags |= PF_R; 2103 if (prot & PROT_WRITE) 2104 v[i].p_flags |= PF_W; 2105 if (prot & PROT_EXEC) 2106 v[i].p_flags |= PF_X; 2107 2108 /* 2109 * Figure out which mappings to include in the core. 2110 */ 2111 type = SEGOP_GETTYPE(seg, saddr); 2112 2113 if (saddr == stkbase && size == stksize) { 2114 if (!(content & CC_CONTENT_STACK)) 2115 goto exclude; 2116 2117 } else if (saddr == brkbase && size == brksize) { 2118 if (!(content & CC_CONTENT_HEAP)) 2119 goto exclude; 2120 2121 } else if (seg->s_ops == &segspt_shmops) { 2122 if (type & MAP_NORESERVE) { 2123 if (!(content & CC_CONTENT_DISM)) 2124 goto exclude; 2125 } else { 2126 if (!(content & CC_CONTENT_ISM)) 2127 goto exclude; 2128 } 2129 2130 } else if (seg->s_ops != &segvn_ops) { 2131 goto exclude; 2132 2133 } else if (type & MAP_SHARED) { 2134 if (shmgetid(p, saddr) != SHMID_NONE) { 2135 if (!(content & CC_CONTENT_SHM)) 2136 goto exclude; 2137 2138 } else if (SEGOP_GETVP(seg, seg->s_base, 2139 &mvp) != 0 || mvp == NULL || 2140 mvp->v_type != VREG) { 2141 if (!(content & CC_CONTENT_SHANON)) 2142 goto exclude; 2143 2144 } else { 2145 if (!(content & CC_CONTENT_SHFILE)) 2146 goto exclude; 2147 } 2148 2149 } else if (SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 || 2150 mvp == NULL || mvp->v_type != VREG) { 2151 if (!(content & CC_CONTENT_ANON)) 2152 goto exclude; 2153 2154 } else if (prot == (PROT_READ | PROT_EXEC)) { 2155 if (!(content & CC_CONTENT_TEXT)) 2156 goto exclude; 2157 2158 } else if (prot == PROT_READ) { 2159 if (!(content & CC_CONTENT_RODATA)) 2160 goto exclude; 2161 2162 } else { 2163 if (!(content & CC_CONTENT_DATA)) 2164 goto exclude; 2165 } 2166 2167 doffset = roundup(doffset, sizeof (Word)); 2168 v[i].p_offset = doffset; 2169 v[i].p_filesz = size; 2170 doffset += size; 2171 exclude: 2172 i++; 2173 } 2174 ASSERT(tmp == NULL); 2175 } 2176 AS_LOCK_EXIT(as); 2177 2178 if (overflow || i != nphdrs) { 2179 if (ntries++ == 0) { 2180 kmem_free(bigwad, bigsize); 2181 overflow = 0; 2182 goto top; 2183 } 2184 cmn_err(CE_WARN, "elfcore: core dump failed for " 2185 "process %d; address space is changing", p->p_pid); 2186 error = EIO; 2187 goto done; 2188 } 2189 2190 if ((error = core_write(vp, UIO_SYSSPACE, poffset, 2191 v, phdrsz, rlimit, credp)) != 0) 2192 goto done; 2193 2194 if ((error = write_old_elfnotes(p, sig, vp, v[0].p_offset, rlimit, 2195 credp)) != 0) 2196 goto done; 2197 2198 if ((error = write_elfnotes(p, sig, vp, v[1].p_offset, rlimit, 2199 credp, content)) != 0) 2200 goto done; 2201 2202 for (i = 2; i < nphdrs; i++) { 2203 prkillinfo_t killinfo; 2204 sigqueue_t *sq; 2205 int sig, j; 2206 2207 if (v[i].p_filesz == 0) 2208 continue; 2209 2210 /* 2211 * If dumping out this segment fails, rather than failing 2212 * the core dump entirely, we reset the size of the mapping 2213 * to zero to indicate that the data is absent from the core 2214 * file and or in the PF_SUNW_FAILURE flag to differentiate 2215 * this from mappings that were excluded due to the core file 2216 * content settings. 2217 */ 2218 if ((error = core_seg(p, vp, v[i].p_offset, 2219 (caddr_t)(uintptr_t)v[i].p_vaddr, v[i].p_filesz, 2220 rlimit, credp)) == 0) { 2221 continue; 2222 } 2223 2224 if ((sig = lwp->lwp_cursig) == 0) { 2225 /* 2226 * We failed due to something other than a signal. 2227 * Since the space reserved for the segment is now 2228 * unused, we stash the errno in the first four 2229 * bytes. This undocumented interface will let us 2230 * understand the nature of the failure. 2231 */ 2232 (void) core_write(vp, UIO_SYSSPACE, v[i].p_offset, 2233 &error, sizeof (error), rlimit, credp); 2234 2235 v[i].p_filesz = 0; 2236 v[i].p_flags |= PF_SUNW_FAILURE; 2237 if ((error = core_write(vp, UIO_SYSSPACE, 2238 poffset + sizeof (v[i]) * i, &v[i], sizeof (v[i]), 2239 rlimit, credp)) != 0) 2240 goto done; 2241 2242 continue; 2243 } 2244 2245 /* 2246 * We took a signal. We want to abort the dump entirely, but 2247 * we also want to indicate what failed and why. We therefore 2248 * use the space reserved for the first failing segment to 2249 * write our error (which, for purposes of compatability with 2250 * older core dump readers, we set to EINTR) followed by any 2251 * siginfo associated with the signal. 2252 */ 2253 bzero(&killinfo, sizeof (killinfo)); 2254 killinfo.prk_error = EINTR; 2255 2256 sq = sig == SIGKILL ? curproc->p_killsqp : lwp->lwp_curinfo; 2257 2258 if (sq != NULL) { 2259 bcopy(&sq->sq_info, &killinfo.prk_info, 2260 sizeof (sq->sq_info)); 2261 } else { 2262 killinfo.prk_info.si_signo = lwp->lwp_cursig; 2263 killinfo.prk_info.si_code = SI_NOINFO; 2264 } 2265 2266 #if (defined(_SYSCALL32_IMPL) || defined(_LP64)) 2267 /* 2268 * If this is a 32-bit process, we need to translate from the 2269 * native siginfo to the 32-bit variant. (Core readers must 2270 * always have the same data model as their target or must 2271 * be aware of -- and compensate for -- data model differences.) 2272 */ 2273 if (curproc->p_model == DATAMODEL_ILP32) { 2274 siginfo32_t si32; 2275 2276 siginfo_kto32((k_siginfo_t *)&killinfo.prk_info, &si32); 2277 bcopy(&si32, &killinfo.prk_info, sizeof (si32)); 2278 } 2279 #endif 2280 2281 (void) core_write(vp, UIO_SYSSPACE, v[i].p_offset, 2282 &killinfo, sizeof (killinfo), rlimit, credp); 2283 2284 /* 2285 * For the segment on which we took the signal, indicate that 2286 * its data now refers to a siginfo. 2287 */ 2288 v[i].p_filesz = 0; 2289 v[i].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED | 2290 PF_SUNW_SIGINFO; 2291 2292 /* 2293 * And for every other segment, indicate that its absence 2294 * is due to a signal. 2295 */ 2296 for (j = i + 1; j < nphdrs; j++) { 2297 v[j].p_filesz = 0; 2298 v[j].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED; 2299 } 2300 2301 /* 2302 * Finally, write out our modified program headers. 2303 */ 2304 if ((error = core_write(vp, UIO_SYSSPACE, 2305 poffset + sizeof (v[i]) * i, &v[i], 2306 sizeof (v[i]) * (nphdrs - i), rlimit, credp)) != 0) 2307 goto done; 2308 2309 break; 2310 } 2311 2312 if (nshdrs > 0) { 2313 bzero(&bigwad->shdr[0], shdrsz); 2314 2315 if (nshdrs >= SHN_LORESERVE) 2316 bigwad->shdr[0].sh_size = nshdrs; 2317 2318 if (nshdrs - 1 >= SHN_LORESERVE) 2319 bigwad->shdr[0].sh_link = nshdrs - 1; 2320 2321 if (nphdrs >= PN_XNUM) 2322 bigwad->shdr[0].sh_info = nphdrs; 2323 2324 if (nshdrs > 1) { 2325 AS_LOCK_ENTER(as, RW_WRITER); 2326 if ((error = process_scns(content, p, credp, vp, 2327 &bigwad->shdr[0], nshdrs, rlimit, &doffset, 2328 NULL)) != 0) { 2329 AS_LOCK_EXIT(as); 2330 goto done; 2331 } 2332 AS_LOCK_EXIT(as); 2333 } 2334 2335 if ((error = core_write(vp, UIO_SYSSPACE, soffset, 2336 &bigwad->shdr[0], shdrsz, rlimit, credp)) != 0) 2337 goto done; 2338 } 2339 2340 done: 2341 kmem_free(bigwad, bigsize); 2342 return (error); 2343 } 2344 2345 #ifndef _ELF32_COMPAT 2346 2347 static struct execsw esw = { 2348 #ifdef _LP64 2349 elf64magicstr, 2350 #else /* _LP64 */ 2351 elf32magicstr, 2352 #endif /* _LP64 */ 2353 0, 2354 5, 2355 elfexec, 2356 elfcore 2357 }; 2358 2359 static struct modlexec modlexec = { 2360 &mod_execops, "exec module for elf", &esw 2361 }; 2362 2363 #ifdef _LP64 2364 extern int elf32exec(vnode_t *vp, execa_t *uap, uarg_t *args, 2365 intpdata_t *idatap, int level, long *execsz, 2366 int setid, caddr_t exec_file, cred_t *cred, 2367 int brand_action); 2368 extern int elf32core(vnode_t *vp, proc_t *p, cred_t *credp, 2369 rlim64_t rlimit, int sig, core_content_t content); 2370 2371 static struct execsw esw32 = { 2372 elf32magicstr, 2373 0, 2374 5, 2375 elf32exec, 2376 elf32core 2377 }; 2378 2379 static struct modlexec modlexec32 = { 2380 &mod_execops, "32-bit exec module for elf", &esw32 2381 }; 2382 #endif /* _LP64 */ 2383 2384 static struct modlinkage modlinkage = { 2385 MODREV_1, 2386 (void *)&modlexec, 2387 #ifdef _LP64 2388 (void *)&modlexec32, 2389 #endif /* _LP64 */ 2390 NULL 2391 }; 2392 2393 int 2394 _init(void) 2395 { 2396 return (mod_install(&modlinkage)); 2397 } 2398 2399 int 2400 _fini(void) 2401 { 2402 return (mod_remove(&modlinkage)); 2403 } 2404 2405 int 2406 _info(struct modinfo *modinfop) 2407 { 2408 return (mod_info(&modlinkage, modinfop)); 2409 } 2410 2411 #endif /* !_ELF32_COMPAT */ 2412