1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright (c) 1989, 2010, Oracle and/or its affiliates. All rights reserved. 24 */ 25 26 /* Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T */ 27 /* All Rights Reserved */ 28 /* 29 * Copyright (c) 2019, Joyent, Inc. 30 * Copyright 2021 Oxide Computer Company 31 */ 32 33 #include <sys/types.h> 34 #include <sys/param.h> 35 #include <sys/thread.h> 36 #include <sys/sysmacros.h> 37 #include <sys/signal.h> 38 #include <sys/cred.h> 39 #include <sys/user.h> 40 #include <sys/errno.h> 41 #include <sys/vnode.h> 42 #include <sys/mman.h> 43 #include <sys/kmem.h> 44 #include <sys/proc.h> 45 #include <sys/pathname.h> 46 #include <sys/policy.h> 47 #include <sys/cmn_err.h> 48 #include <sys/systm.h> 49 #include <sys/elf.h> 50 #include <sys/vmsystm.h> 51 #include <sys/debug.h> 52 #include <sys/auxv.h> 53 #include <sys/exec.h> 54 #include <sys/prsystm.h> 55 #include <vm/as.h> 56 #include <vm/rm.h> 57 #include <vm/seg.h> 58 #include <vm/seg_vn.h> 59 #include <sys/modctl.h> 60 #include <sys/systeminfo.h> 61 #include <sys/vmparam.h> 62 #include <sys/machelf.h> 63 #include <sys/shm_impl.h> 64 #include <sys/archsystm.h> 65 #include <sys/fasttrap.h> 66 #include <sys/brand.h> 67 #include "elf_impl.h" 68 #include <sys/sdt.h> 69 #include <sys/siginfo.h> 70 #include <sys/random.h> 71 72 #include <core_shstrtab.h> 73 74 #if defined(__x86) 75 #include <sys/comm_page_util.h> 76 #include <sys/fp.h> 77 #endif /* defined(__x86) */ 78 79 80 extern int at_flags; 81 extern volatile size_t aslr_max_brk_skew; 82 83 #define ORIGIN_STR "ORIGIN" 84 #define ORIGIN_STR_SIZE 6 85 86 static int getelfhead(vnode_t *, cred_t *, Ehdr *, int *, int *, int *); 87 static int getelfphdr(vnode_t *, cred_t *, const Ehdr *, int, caddr_t *, 88 ssize_t *); 89 static int getelfshdr(vnode_t *, cred_t *, const Ehdr *, int, int, caddr_t *, 90 ssize_t *, caddr_t *, ssize_t *); 91 static size_t elfsize(Ehdr *, int, caddr_t, uintptr_t *); 92 static int mapelfexec(vnode_t *, Ehdr *, int, caddr_t, 93 Phdr **, Phdr **, Phdr **, Phdr **, Phdr *, 94 caddr_t *, caddr_t *, intptr_t *, intptr_t *, size_t, long *, size_t *); 95 96 static int 97 dtrace_safe_phdr(Phdr *phdrp, struct uarg *args, uintptr_t base) 98 { 99 ASSERT(phdrp->p_type == PT_SUNWDTRACE); 100 101 /* 102 * See the comment in fasttrap.h for information on how to safely 103 * update this program header. 104 */ 105 if (phdrp->p_memsz < PT_SUNWDTRACE_SIZE || 106 (phdrp->p_flags & (PF_R | PF_W | PF_X)) != (PF_R | PF_W | PF_X)) 107 return (-1); 108 109 args->thrptr = phdrp->p_vaddr + base; 110 111 return (0); 112 } 113 114 static int 115 handle_secflag_dt(proc_t *p, uint_t dt, uint_t val) 116 { 117 uint_t flag; 118 119 switch (dt) { 120 case DT_SUNW_ASLR: 121 flag = PROC_SEC_ASLR; 122 break; 123 default: 124 return (EINVAL); 125 } 126 127 if (val == 0) { 128 if (secflag_isset(p->p_secflags.psf_lower, flag)) 129 return (EPERM); 130 if ((secpolicy_psecflags(CRED(), p, p) != 0) && 131 secflag_isset(p->p_secflags.psf_inherit, flag)) 132 return (EPERM); 133 134 secflag_clear(&p->p_secflags.psf_effective, flag); 135 } else { 136 if (!secflag_isset(p->p_secflags.psf_upper, flag)) 137 return (EPERM); 138 139 if ((secpolicy_psecflags(CRED(), p, p) != 0) && 140 !secflag_isset(p->p_secflags.psf_inherit, flag)) 141 return (EPERM); 142 143 secflag_set(&p->p_secflags.psf_effective, flag); 144 } 145 146 return (0); 147 } 148 149 /* 150 * Map in the executable pointed to by vp. Returns 0 on success. 151 */ 152 int 153 mapexec_brand(vnode_t *vp, uarg_t *args, Ehdr *ehdr, Addr *uphdr_vaddr, 154 intptr_t *voffset, caddr_t exec_file, int *interp, caddr_t *bssbase, 155 caddr_t *brkbase, size_t *brksize, uintptr_t *lddatap) 156 { 157 size_t len; 158 struct vattr vat; 159 caddr_t phdrbase = NULL; 160 ssize_t phdrsize; 161 int nshdrs, shstrndx, nphdrs; 162 int error = 0; 163 Phdr *uphdr = NULL; 164 Phdr *junk = NULL; 165 Phdr *dynphdr = NULL; 166 Phdr *dtrphdr = NULL; 167 uintptr_t lddata; 168 long execsz; 169 intptr_t minaddr; 170 171 if (lddatap != NULL) 172 *lddatap = 0; 173 174 if (error = execpermissions(vp, &vat, args)) { 175 uprintf("%s: Cannot execute %s\n", exec_file, args->pathname); 176 return (error); 177 } 178 179 if ((error = getelfhead(vp, CRED(), ehdr, &nshdrs, &shstrndx, 180 &nphdrs)) != 0 || 181 (error = getelfphdr(vp, CRED(), ehdr, nphdrs, &phdrbase, 182 &phdrsize)) != 0) { 183 uprintf("%s: Cannot read %s\n", exec_file, args->pathname); 184 return (error); 185 } 186 187 if ((len = elfsize(ehdr, nphdrs, phdrbase, &lddata)) == 0) { 188 uprintf("%s: Nothing to load in %s", exec_file, args->pathname); 189 kmem_free(phdrbase, phdrsize); 190 return (ENOEXEC); 191 } 192 if (lddatap != NULL) 193 *lddatap = lddata; 194 195 if (error = mapelfexec(vp, ehdr, nphdrs, phdrbase, &uphdr, &dynphdr, 196 &junk, &dtrphdr, NULL, bssbase, brkbase, voffset, &minaddr, 197 len, &execsz, brksize)) { 198 uprintf("%s: Cannot map %s\n", exec_file, args->pathname); 199 kmem_free(phdrbase, phdrsize); 200 return (error); 201 } 202 203 /* 204 * Inform our caller if the executable needs an interpreter. 205 */ 206 *interp = (dynphdr == NULL) ? 0 : 1; 207 208 /* 209 * If this is a statically linked executable, voffset should indicate 210 * the address of the executable itself (it normally holds the address 211 * of the interpreter). 212 */ 213 if (ehdr->e_type == ET_EXEC && *interp == 0) 214 *voffset = minaddr; 215 216 if (uphdr != NULL) { 217 *uphdr_vaddr = uphdr->p_vaddr; 218 } else { 219 *uphdr_vaddr = (Addr)-1; 220 } 221 222 kmem_free(phdrbase, phdrsize); 223 return (error); 224 } 225 226 /*ARGSUSED*/ 227 int 228 elfexec(vnode_t *vp, execa_t *uap, uarg_t *args, intpdata_t *idatap, 229 int level, long *execsz, int setid, caddr_t exec_file, cred_t *cred, 230 int brand_action) 231 { 232 caddr_t phdrbase = NULL; 233 caddr_t bssbase = 0; 234 caddr_t brkbase = 0; 235 size_t brksize = 0; 236 ssize_t dlnsize; 237 aux_entry_t *aux; 238 int error; 239 ssize_t resid; 240 int fd = -1; 241 intptr_t voffset; 242 Phdr *intphdr = NULL; 243 Phdr *dynamicphdr = NULL; 244 Phdr *stphdr = NULL; 245 Phdr *uphdr = NULL; 246 Phdr *junk = NULL; 247 size_t len; 248 size_t i; 249 ssize_t phdrsize; 250 int postfixsize = 0; 251 int hsize; 252 Phdr *phdrp; 253 Phdr *dataphdrp = NULL; 254 Phdr *dtrphdr; 255 Phdr *capphdr = NULL; 256 Cap *cap = NULL; 257 ssize_t capsize; 258 int hasu = 0; 259 int hasauxv = 0; 260 int hasintp = 0; 261 int branded = 0; 262 263 struct proc *p = ttoproc(curthread); 264 struct user *up = PTOU(p); 265 struct bigwad { 266 Ehdr ehdr; 267 aux_entry_t elfargs[__KERN_NAUXV_IMPL]; 268 char dl_name[MAXPATHLEN]; 269 char pathbuf[MAXPATHLEN]; 270 struct vattr vattr; 271 struct execenv exenv; 272 } *bigwad; /* kmem_alloc this behemoth so we don't blow stack */ 273 Ehdr *ehdrp; 274 int nshdrs, shstrndx, nphdrs; 275 char *dlnp; 276 char *pathbufp; 277 rlim64_t limit; 278 rlim64_t roundlimit; 279 280 ASSERT(p->p_model == DATAMODEL_ILP32 || p->p_model == DATAMODEL_LP64); 281 282 bigwad = kmem_alloc(sizeof (struct bigwad), KM_SLEEP); 283 ehdrp = &bigwad->ehdr; 284 dlnp = bigwad->dl_name; 285 pathbufp = bigwad->pathbuf; 286 287 /* 288 * Obtain ELF and program header information. 289 */ 290 if ((error = getelfhead(vp, CRED(), ehdrp, &nshdrs, &shstrndx, 291 &nphdrs)) != 0 || 292 (error = getelfphdr(vp, CRED(), ehdrp, nphdrs, &phdrbase, 293 &phdrsize)) != 0) 294 goto out; 295 296 /* 297 * Prevent executing an ELF file that has no entry point. 298 */ 299 if (ehdrp->e_entry == 0) { 300 uprintf("%s: Bad entry point\n", exec_file); 301 goto bad; 302 } 303 304 /* 305 * Put data model that we're exec-ing to into the args passed to 306 * exec_args(), so it will know what it is copying to on new stack. 307 * Now that we know whether we are exec-ing a 32-bit or 64-bit 308 * executable, we can set execsz with the appropriate NCARGS. 309 */ 310 #ifdef _LP64 311 if (ehdrp->e_ident[EI_CLASS] == ELFCLASS32) { 312 args->to_model = DATAMODEL_ILP32; 313 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS32-1); 314 } else { 315 args->to_model = DATAMODEL_LP64; 316 args->stk_prot &= ~PROT_EXEC; 317 #if defined(__x86) 318 args->dat_prot &= ~PROT_EXEC; 319 #endif 320 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS64-1); 321 } 322 #else /* _LP64 */ 323 args->to_model = DATAMODEL_ILP32; 324 *execsz = btopr(SINCR) + btopr(SSIZE) + btopr(NCARGS-1); 325 #endif /* _LP64 */ 326 327 /* 328 * We delay invoking the brand callback until we've figured out 329 * what kind of elf binary we're trying to run, 32-bit or 64-bit. 330 * We do this because now the brand library can just check 331 * args->to_model to see if the target is 32-bit or 64-bit without 332 * having do duplicate all the code above. 333 * 334 * The level checks associated with brand handling below are used to 335 * prevent a loop since the brand elfexec function typically comes back 336 * through this function. We must check <= here since the nested 337 * handling in the #! interpreter code will increment the level before 338 * calling gexec to run the final elfexec interpreter. 339 */ 340 if ((level <= INTP_MAXDEPTH) && 341 (brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) { 342 error = BROP(p)->b_elfexec(vp, uap, args, 343 idatap, level + 1, execsz, setid, exec_file, cred, 344 brand_action); 345 goto out; 346 } 347 348 /* 349 * Determine aux size now so that stack can be built 350 * in one shot (except actual copyout of aux image), 351 * determine any non-default stack protections, 352 * and still have this code be machine independent. 353 */ 354 hsize = ehdrp->e_phentsize; 355 phdrp = (Phdr *)phdrbase; 356 for (i = nphdrs; i > 0; i--) { 357 switch (phdrp->p_type) { 358 case PT_INTERP: 359 hasauxv = hasintp = 1; 360 break; 361 case PT_PHDR: 362 hasu = 1; 363 break; 364 case PT_SUNWSTACK: 365 args->stk_prot = PROT_USER; 366 if (phdrp->p_flags & PF_R) 367 args->stk_prot |= PROT_READ; 368 if (phdrp->p_flags & PF_W) 369 args->stk_prot |= PROT_WRITE; 370 if (phdrp->p_flags & PF_X) 371 args->stk_prot |= PROT_EXEC; 372 break; 373 case PT_LOAD: 374 dataphdrp = phdrp; 375 break; 376 case PT_SUNWCAP: 377 capphdr = phdrp; 378 break; 379 case PT_DYNAMIC: 380 dynamicphdr = phdrp; 381 break; 382 } 383 phdrp = (Phdr *)((caddr_t)phdrp + hsize); 384 } 385 386 if (ehdrp->e_type != ET_EXEC) { 387 dataphdrp = NULL; 388 hasauxv = 1; 389 } 390 391 /* Copy BSS permissions to args->dat_prot */ 392 if (dataphdrp != NULL) { 393 args->dat_prot = PROT_USER; 394 if (dataphdrp->p_flags & PF_R) 395 args->dat_prot |= PROT_READ; 396 if (dataphdrp->p_flags & PF_W) 397 args->dat_prot |= PROT_WRITE; 398 if (dataphdrp->p_flags & PF_X) 399 args->dat_prot |= PROT_EXEC; 400 } 401 402 /* 403 * If a auxvector will be required - reserve the space for 404 * it now. This may be increased by exec_args if there are 405 * ISA-specific types (included in __KERN_NAUXV_IMPL). 406 */ 407 if (hasauxv) { 408 /* 409 * If a AUX vector is being built - the base AUX 410 * entries are: 411 * 412 * AT_BASE 413 * AT_FLAGS 414 * AT_PAGESZ 415 * AT_SUN_AUXFLAGS 416 * AT_SUN_HWCAP 417 * AT_SUN_HWCAP2 418 * AT_SUN_PLATFORM (added in stk_copyout) 419 * AT_SUN_EXECNAME (added in stk_copyout) 420 * AT_NULL 421 * 422 * total == 9 423 */ 424 if (hasintp && hasu) { 425 /* 426 * Has PT_INTERP & PT_PHDR - the auxvectors that 427 * will be built are: 428 * 429 * AT_PHDR 430 * AT_PHENT 431 * AT_PHNUM 432 * AT_ENTRY 433 * AT_LDDATA 434 * 435 * total = 5 436 */ 437 args->auxsize = (9 + 5) * sizeof (aux_entry_t); 438 } else if (hasintp) { 439 /* 440 * Has PT_INTERP but no PT_PHDR 441 * 442 * AT_EXECFD 443 * AT_LDDATA 444 * 445 * total = 2 446 */ 447 args->auxsize = (9 + 2) * sizeof (aux_entry_t); 448 } else { 449 args->auxsize = 9 * sizeof (aux_entry_t); 450 } 451 } else { 452 args->auxsize = 0; 453 } 454 455 /* 456 * If this binary is using an emulator, we need to add an 457 * AT_SUN_EMULATOR aux entry. 458 */ 459 if (args->emulator != NULL) 460 args->auxsize += sizeof (aux_entry_t); 461 462 /* 463 * On supported kernels (x86_64) make room in the auxv for the 464 * AT_SUN_COMMPAGE entry. This will go unpopulated on i86xpv systems 465 * which do not provide such functionality. 466 * 467 * Additionally cover the floating point information AT_SUN_FPSIZE and 468 * AT_SUN_FPTYPE. 469 */ 470 #if defined(__amd64) 471 args->auxsize += 3 * sizeof (aux_entry_t); 472 #endif /* defined(__amd64) */ 473 474 if ((brand_action != EBA_NATIVE) && (PROC_IS_BRANDED(p))) { 475 branded = 1; 476 /* 477 * We will be adding 4 entries to the aux vectors. One for 478 * the the brandname and 3 for the brand specific aux vectors. 479 */ 480 args->auxsize += 4 * sizeof (aux_entry_t); 481 } 482 483 /* If the binary has an explicit ASLR flag, it must be honoured */ 484 if ((dynamicphdr != NULL) && (dynamicphdr->p_filesz > 0)) { 485 const size_t dynfilesz = dynamicphdr->p_filesz; 486 const size_t dynoffset = dynamicphdr->p_offset; 487 Dyn *dyn, *dp; 488 489 if (dynoffset > MAXOFFSET_T || 490 dynfilesz > MAXOFFSET_T || 491 dynoffset + dynfilesz > MAXOFFSET_T) { 492 uprintf("%s: cannot read full .dynamic section\n", 493 exec_file); 494 error = EINVAL; 495 goto out; 496 } 497 498 #define DYN_STRIDE 100 499 for (i = 0; i < dynfilesz; i += sizeof (*dyn) * DYN_STRIDE) { 500 const size_t remdyns = (dynfilesz - i) / sizeof (*dyn); 501 const size_t ndyns = MIN(DYN_STRIDE, remdyns); 502 const size_t dynsize = ndyns * sizeof (*dyn); 503 504 dyn = kmem_alloc(dynsize, KM_SLEEP); 505 506 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)dyn, 507 (ssize_t)dynsize, (offset_t)(dynoffset + i), 508 UIO_SYSSPACE, 0, (rlim64_t)0, 509 CRED(), &resid)) != 0) { 510 uprintf("%s: cannot read .dynamic section\n", 511 exec_file); 512 goto out; 513 } 514 515 for (dp = dyn; dp < (dyn + ndyns); dp++) { 516 if (dp->d_tag == DT_SUNW_ASLR) { 517 if ((error = handle_secflag_dt(p, 518 DT_SUNW_ASLR, 519 dp->d_un.d_val)) != 0) { 520 uprintf("%s: error setting " 521 "security-flag from " 522 "DT_SUNW_ASLR: %d\n", 523 exec_file, error); 524 goto out; 525 } 526 } 527 } 528 529 kmem_free(dyn, dynsize); 530 } 531 } 532 533 /* Hardware/Software capabilities */ 534 if (capphdr != NULL && 535 (capsize = capphdr->p_filesz) > 0 && 536 capsize <= 16 * sizeof (*cap)) { 537 int ncaps = capsize / sizeof (*cap); 538 Cap *cp; 539 540 cap = kmem_alloc(capsize, KM_SLEEP); 541 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)cap, 542 capsize, (offset_t)capphdr->p_offset, 543 UIO_SYSSPACE, 0, (rlim64_t)0, CRED(), &resid)) != 0) { 544 uprintf("%s: Cannot read capabilities section\n", 545 exec_file); 546 goto out; 547 } 548 for (cp = cap; cp < cap + ncaps; cp++) { 549 if (cp->c_tag == CA_SUNW_SF_1 && 550 (cp->c_un.c_val & SF1_SUNW_ADDR32)) { 551 if (args->to_model == DATAMODEL_LP64) 552 args->addr32 = 1; 553 break; 554 } 555 } 556 } 557 558 aux = bigwad->elfargs; 559 /* 560 * Move args to the user's stack. 561 * This can fill in the AT_SUN_PLATFORM and AT_SUN_EXECNAME aux entries. 562 */ 563 if ((error = exec_args(uap, args, idatap, (void **)&aux)) != 0) { 564 if (error == -1) { 565 error = ENOEXEC; 566 goto bad; 567 } 568 goto out; 569 } 570 /* we're single threaded after this point */ 571 572 /* 573 * If this is an ET_DYN executable (shared object), 574 * determine its memory size so that mapelfexec() can load it. 575 */ 576 if (ehdrp->e_type == ET_DYN) 577 len = elfsize(ehdrp, nphdrs, phdrbase, NULL); 578 else 579 len = 0; 580 581 dtrphdr = NULL; 582 583 if ((error = mapelfexec(vp, ehdrp, nphdrs, phdrbase, &uphdr, &intphdr, 584 &stphdr, &dtrphdr, dataphdrp, &bssbase, &brkbase, &voffset, NULL, 585 len, execsz, &brksize)) != 0) 586 goto bad; 587 588 if (uphdr != NULL && intphdr == NULL) 589 goto bad; 590 591 if (dtrphdr != NULL && dtrace_safe_phdr(dtrphdr, args, voffset) != 0) { 592 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, exec_file); 593 goto bad; 594 } 595 596 if (intphdr != NULL) { 597 size_t len; 598 uintptr_t lddata; 599 char *p; 600 struct vnode *nvp; 601 602 dlnsize = intphdr->p_filesz; 603 604 if (dlnsize > MAXPATHLEN || dlnsize <= 0) 605 goto bad; 606 607 /* 608 * Read in "interpreter" pathname. 609 */ 610 if ((error = vn_rdwr(UIO_READ, vp, dlnp, intphdr->p_filesz, 611 (offset_t)intphdr->p_offset, UIO_SYSSPACE, 0, (rlim64_t)0, 612 CRED(), &resid)) != 0) { 613 uprintf("%s: Cannot obtain interpreter pathname\n", 614 exec_file); 615 goto bad; 616 } 617 618 if (resid != 0 || dlnp[dlnsize - 1] != '\0') 619 goto bad; 620 621 /* 622 * Search for '$ORIGIN' token in interpreter path. 623 * If found, expand it. 624 */ 625 for (p = dlnp; p = strchr(p, '$'); ) { 626 uint_t len, curlen; 627 char *_ptr; 628 629 if (strncmp(++p, ORIGIN_STR, ORIGIN_STR_SIZE)) 630 continue; 631 632 /* 633 * We don't support $ORIGIN on setid programs to close 634 * a potential attack vector. 635 */ 636 if ((setid & EXECSETID_SETID) != 0) { 637 error = ENOEXEC; 638 goto bad; 639 } 640 641 curlen = 0; 642 len = p - dlnp - 1; 643 if (len) { 644 bcopy(dlnp, pathbufp, len); 645 curlen += len; 646 } 647 if (_ptr = strrchr(args->pathname, '/')) { 648 len = _ptr - args->pathname; 649 if ((curlen + len) > MAXPATHLEN) 650 break; 651 652 bcopy(args->pathname, &pathbufp[curlen], len); 653 curlen += len; 654 } else { 655 /* 656 * executable is a basename found in the 657 * current directory. So - just substitue 658 * '.' for ORIGIN. 659 */ 660 pathbufp[curlen] = '.'; 661 curlen++; 662 } 663 p += ORIGIN_STR_SIZE; 664 len = strlen(p); 665 666 if ((curlen + len) > MAXPATHLEN) 667 break; 668 bcopy(p, &pathbufp[curlen], len); 669 curlen += len; 670 pathbufp[curlen++] = '\0'; 671 bcopy(pathbufp, dlnp, curlen); 672 } 673 674 /* 675 * /usr/lib/ld.so.1 is known to be a symlink to /lib/ld.so.1 676 * (and /usr/lib/64/ld.so.1 is a symlink to /lib/64/ld.so.1). 677 * Just in case /usr is not mounted, change it now. 678 */ 679 if (strcmp(dlnp, USR_LIB_RTLD) == 0) 680 dlnp += 4; 681 error = lookupname(dlnp, UIO_SYSSPACE, FOLLOW, NULLVPP, &nvp); 682 if (error && dlnp != bigwad->dl_name) { 683 /* new kernel, old user-level */ 684 error = lookupname(dlnp -= 4, UIO_SYSSPACE, FOLLOW, 685 NULLVPP, &nvp); 686 } 687 if (error) { 688 uprintf("%s: Cannot find %s\n", exec_file, dlnp); 689 goto bad; 690 } 691 692 /* 693 * Setup the "aux" vector. 694 */ 695 if (uphdr) { 696 if (ehdrp->e_type == ET_DYN) { 697 /* don't use the first page */ 698 bigwad->exenv.ex_brkbase = (caddr_t)PAGESIZE; 699 bigwad->exenv.ex_bssbase = (caddr_t)PAGESIZE; 700 } else { 701 bigwad->exenv.ex_bssbase = bssbase; 702 bigwad->exenv.ex_brkbase = brkbase; 703 } 704 bigwad->exenv.ex_brksize = brksize; 705 bigwad->exenv.ex_magic = elfmagic; 706 bigwad->exenv.ex_vp = vp; 707 setexecenv(&bigwad->exenv); 708 709 ADDAUX(aux, AT_PHDR, uphdr->p_vaddr + voffset) 710 ADDAUX(aux, AT_PHENT, ehdrp->e_phentsize) 711 ADDAUX(aux, AT_PHNUM, nphdrs) 712 ADDAUX(aux, AT_ENTRY, ehdrp->e_entry + voffset) 713 } else { 714 if ((error = execopen(&vp, &fd)) != 0) { 715 VN_RELE(nvp); 716 goto bad; 717 } 718 719 ADDAUX(aux, AT_EXECFD, fd) 720 } 721 722 if ((error = execpermissions(nvp, &bigwad->vattr, args)) != 0) { 723 VN_RELE(nvp); 724 uprintf("%s: Cannot execute %s\n", exec_file, dlnp); 725 goto bad; 726 } 727 728 /* 729 * Now obtain the ELF header along with the entire program 730 * header contained in "nvp". 731 */ 732 kmem_free(phdrbase, phdrsize); 733 phdrbase = NULL; 734 if ((error = getelfhead(nvp, CRED(), ehdrp, &nshdrs, 735 &shstrndx, &nphdrs)) != 0 || 736 (error = getelfphdr(nvp, CRED(), ehdrp, nphdrs, &phdrbase, 737 &phdrsize)) != 0) { 738 VN_RELE(nvp); 739 uprintf("%s: Cannot read %s\n", exec_file, dlnp); 740 goto bad; 741 } 742 743 /* 744 * Determine memory size of the "interpreter's" loadable 745 * sections. This size is then used to obtain the virtual 746 * address of a hole, in the user's address space, large 747 * enough to map the "interpreter". 748 */ 749 if ((len = elfsize(ehdrp, nphdrs, phdrbase, &lddata)) == 0) { 750 VN_RELE(nvp); 751 uprintf("%s: Nothing to load in %s\n", exec_file, dlnp); 752 goto bad; 753 } 754 755 dtrphdr = NULL; 756 757 error = mapelfexec(nvp, ehdrp, nphdrs, phdrbase, &junk, &junk, 758 &junk, &dtrphdr, NULL, NULL, NULL, &voffset, NULL, len, 759 execsz, NULL); 760 if (error || junk != NULL) { 761 VN_RELE(nvp); 762 uprintf("%s: Cannot map %s\n", exec_file, dlnp); 763 goto bad; 764 } 765 766 /* 767 * We use the DTrace program header to initialize the 768 * architecture-specific user per-LWP location. The dtrace 769 * fasttrap provider requires ready access to per-LWP scratch 770 * space. We assume that there is only one such program header 771 * in the interpreter. 772 */ 773 if (dtrphdr != NULL && 774 dtrace_safe_phdr(dtrphdr, args, voffset) != 0) { 775 VN_RELE(nvp); 776 uprintf("%s: Bad DTrace phdr in %s\n", exec_file, dlnp); 777 goto bad; 778 } 779 780 VN_RELE(nvp); 781 ADDAUX(aux, AT_SUN_LDDATA, voffset + lddata) 782 } 783 784 if (hasauxv) { 785 int auxf = AF_SUN_HWCAPVERIFY; 786 #if defined(__amd64) 787 size_t fpsize; 788 int fptype; 789 #endif /* defined(__amd64) */ 790 791 /* 792 * Note: AT_SUN_PLATFORM and AT_SUN_EXECNAME were filled in via 793 * exec_args() 794 */ 795 ADDAUX(aux, AT_BASE, voffset) 796 ADDAUX(aux, AT_FLAGS, at_flags) 797 ADDAUX(aux, AT_PAGESZ, PAGESIZE) 798 /* 799 * Linker flags. (security) 800 * p_flag not yet set at this time. 801 * We rely on gexec() to provide us with the information. 802 * If the application is set-uid but this is not reflected 803 * in a mismatch between real/effective uids/gids, then 804 * don't treat this as a set-uid exec. So we care about 805 * the EXECSETID_UGIDS flag but not the ...SETID flag. 806 */ 807 if ((setid &= ~EXECSETID_SETID) != 0) 808 auxf |= AF_SUN_SETUGID; 809 810 /* 811 * If we're running a native process from within a branded 812 * zone under pfexec then we clear the AF_SUN_SETUGID flag so 813 * that the native ld.so.1 is able to link with the native 814 * libraries instead of using the brand libraries that are 815 * installed in the zone. We only do this for processes 816 * which we trust because we see they are already running 817 * under pfexec (where uid != euid). This prevents a 818 * malicious user within the zone from crafting a wrapper to 819 * run native suid commands with unsecure libraries interposed. 820 */ 821 if ((brand_action == EBA_NATIVE) && (PROC_IS_BRANDED(p) && 822 (setid &= ~EXECSETID_SETID) != 0)) 823 auxf &= ~AF_SUN_SETUGID; 824 825 /* 826 * Record the user addr of the auxflags aux vector entry 827 * since brands may optionally want to manipulate this field. 828 */ 829 args->auxp_auxflags = 830 (char *)((char *)args->stackend + 831 ((char *)&aux->a_type - 832 (char *)bigwad->elfargs)); 833 ADDAUX(aux, AT_SUN_AUXFLAGS, auxf); 834 835 /* 836 * Hardware capability flag word (performance hints) 837 * Used for choosing faster library routines. 838 * (Potentially different between 32-bit and 64-bit ABIs) 839 */ 840 #if defined(_LP64) 841 if (args->to_model == DATAMODEL_NATIVE) { 842 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap) 843 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2) 844 } else { 845 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap32) 846 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap32_2) 847 } 848 #else 849 ADDAUX(aux, AT_SUN_HWCAP, auxv_hwcap) 850 ADDAUX(aux, AT_SUN_HWCAP2, auxv_hwcap_2) 851 #endif 852 if (branded) { 853 /* 854 * Reserve space for the brand-private aux vectors, 855 * and record the user addr of that space. 856 */ 857 args->auxp_brand = 858 (char *)((char *)args->stackend + 859 ((char *)&aux->a_type - 860 (char *)bigwad->elfargs)); 861 ADDAUX(aux, AT_SUN_BRAND_AUX1, 0) 862 ADDAUX(aux, AT_SUN_BRAND_AUX2, 0) 863 ADDAUX(aux, AT_SUN_BRAND_AUX3, 0) 864 } 865 866 /* 867 * Add the comm page auxv entry, mapping it in if needed. Also 868 * take care of the FPU entries. 869 */ 870 #if defined(__amd64) 871 if (args->commpage != (uintptr_t)NULL || 872 (args->commpage = (uintptr_t)comm_page_mapin()) != 873 (uintptr_t)NULL) { 874 ADDAUX(aux, AT_SUN_COMMPAGE, args->commpage) 875 } else { 876 /* 877 * If the comm page cannot be mapped, pad out the auxv 878 * to satisfy later size checks. 879 */ 880 ADDAUX(aux, AT_NULL, 0) 881 } 882 883 fptype = AT_386_FPINFO_NONE; 884 fpu_auxv_info(&fptype, &fpsize); 885 if (fptype != AT_386_FPINFO_NONE) { 886 ADDAUX(aux, AT_SUN_FPTYPE, fptype) 887 ADDAUX(aux, AT_SUN_FPSIZE, fpsize) 888 } else { 889 ADDAUX(aux, AT_NULL, 0) 890 ADDAUX(aux, AT_NULL, 0) 891 } 892 #endif /* defined(__amd64) */ 893 894 ADDAUX(aux, AT_NULL, 0) 895 postfixsize = (char *)aux - (char *)bigwad->elfargs; 896 897 /* 898 * We make assumptions above when we determine how many aux 899 * vector entries we will be adding. However, if we have an 900 * invalid elf file, it is possible that mapelfexec might 901 * behave differently (but not return an error), in which case 902 * the number of aux entries we actually add will be different. 903 * We detect that now and error out. 904 */ 905 if (postfixsize != args->auxsize) { 906 DTRACE_PROBE2(elfexec_badaux, int, postfixsize, 907 int, args->auxsize); 908 goto bad; 909 } 910 ASSERT(postfixsize <= __KERN_NAUXV_IMPL * sizeof (aux_entry_t)); 911 } 912 913 /* 914 * For the 64-bit kernel, the limit is big enough that rounding it up 915 * to a page can overflow the 64-bit limit, so we check for btopr() 916 * overflowing here by comparing it with the unrounded limit in pages. 917 * If it hasn't overflowed, compare the exec size with the rounded up 918 * limit in pages. Otherwise, just compare with the unrounded limit. 919 */ 920 limit = btop(p->p_vmem_ctl); 921 roundlimit = btopr(p->p_vmem_ctl); 922 if ((roundlimit > limit && *execsz > roundlimit) || 923 (roundlimit < limit && *execsz > limit)) { 924 mutex_enter(&p->p_lock); 925 (void) rctl_action(rctlproc_legacy[RLIMIT_VMEM], p->p_rctls, p, 926 RCA_SAFE); 927 mutex_exit(&p->p_lock); 928 error = ENOMEM; 929 goto bad; 930 } 931 932 bzero(up->u_auxv, sizeof (up->u_auxv)); 933 up->u_commpagep = args->commpage; 934 if (postfixsize) { 935 int num_auxv; 936 937 /* 938 * Copy the aux vector to the user stack. 939 */ 940 error = execpoststack(args, bigwad->elfargs, postfixsize); 941 if (error) 942 goto bad; 943 944 /* 945 * Copy auxv to the process's user structure for use by /proc. 946 * If this is a branded process, the brand's exec routine will 947 * copy it's private entries to the user structure later. It 948 * relies on the fact that the blank entries are at the end. 949 */ 950 num_auxv = postfixsize / sizeof (aux_entry_t); 951 ASSERT(num_auxv <= sizeof (up->u_auxv) / sizeof (auxv_t)); 952 aux = bigwad->elfargs; 953 for (i = 0; i < num_auxv; i++) { 954 up->u_auxv[i].a_type = aux[i].a_type; 955 up->u_auxv[i].a_un.a_val = (aux_val_t)aux[i].a_un.a_val; 956 } 957 } 958 959 /* 960 * Pass back the starting address so we can set the program counter. 961 */ 962 args->entry = (uintptr_t)(ehdrp->e_entry + voffset); 963 964 if (!uphdr) { 965 if (ehdrp->e_type == ET_DYN) { 966 /* 967 * If we are executing a shared library which doesn't 968 * have a interpreter (probably ld.so.1) then 969 * we don't set the brkbase now. Instead we 970 * delay it's setting until the first call 971 * via grow.c::brk(). This permits ld.so.1 to 972 * initialize brkbase to the tail of the executable it 973 * loads (which is where it needs to be). 974 */ 975 bigwad->exenv.ex_brkbase = (caddr_t)0; 976 bigwad->exenv.ex_bssbase = (caddr_t)0; 977 bigwad->exenv.ex_brksize = 0; 978 } else { 979 bigwad->exenv.ex_brkbase = brkbase; 980 bigwad->exenv.ex_bssbase = bssbase; 981 bigwad->exenv.ex_brksize = brksize; 982 } 983 bigwad->exenv.ex_magic = elfmagic; 984 bigwad->exenv.ex_vp = vp; 985 setexecenv(&bigwad->exenv); 986 } 987 988 ASSERT(error == 0); 989 goto out; 990 991 bad: 992 if (fd != -1) /* did we open the a.out yet */ 993 (void) execclose(fd); 994 995 psignal(p, SIGKILL); 996 997 if (error == 0) 998 error = ENOEXEC; 999 out: 1000 if (phdrbase != NULL) 1001 kmem_free(phdrbase, phdrsize); 1002 if (cap != NULL) 1003 kmem_free(cap, capsize); 1004 kmem_free(bigwad, sizeof (struct bigwad)); 1005 return (error); 1006 } 1007 1008 /* 1009 * Compute the memory size requirement for the ELF file. 1010 */ 1011 static size_t 1012 elfsize(Ehdr *ehdrp, int nphdrs, caddr_t phdrbase, uintptr_t *lddata) 1013 { 1014 size_t len; 1015 Phdr *phdrp = (Phdr *)phdrbase; 1016 int hsize = ehdrp->e_phentsize; 1017 int first = 1; 1018 int dfirst = 1; /* first data segment */ 1019 uintptr_t loaddr = 0; 1020 uintptr_t hiaddr = 0; 1021 uintptr_t lo, hi; 1022 int i; 1023 1024 for (i = nphdrs; i > 0; i--) { 1025 if (phdrp->p_type == PT_LOAD) { 1026 lo = phdrp->p_vaddr; 1027 hi = lo + phdrp->p_memsz; 1028 if (first) { 1029 loaddr = lo; 1030 hiaddr = hi; 1031 first = 0; 1032 } else { 1033 if (loaddr > lo) 1034 loaddr = lo; 1035 if (hiaddr < hi) 1036 hiaddr = hi; 1037 } 1038 1039 /* 1040 * save the address of the first data segment 1041 * of a object - used for the AT_SUNW_LDDATA 1042 * aux entry. 1043 */ 1044 if ((lddata != NULL) && dfirst && 1045 (phdrp->p_flags & PF_W)) { 1046 *lddata = lo; 1047 dfirst = 0; 1048 } 1049 } 1050 phdrp = (Phdr *)((caddr_t)phdrp + hsize); 1051 } 1052 1053 len = hiaddr - (loaddr & PAGEMASK); 1054 len = roundup(len, PAGESIZE); 1055 1056 return (len); 1057 } 1058 1059 /* 1060 * Read in the ELF header and program header table. 1061 * SUSV3 requires: 1062 * ENOEXEC File format is not recognized 1063 * EINVAL Format recognized but execution not supported 1064 */ 1065 static int 1066 getelfhead(vnode_t *vp, cred_t *credp, Ehdr *ehdr, int *nshdrs, int *shstrndx, 1067 int *nphdrs) 1068 { 1069 int error; 1070 ssize_t resid; 1071 1072 /* 1073 * We got here by the first two bytes in ident, 1074 * now read the entire ELF header. 1075 */ 1076 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)ehdr, 1077 sizeof (Ehdr), (offset_t)0, UIO_SYSSPACE, 0, 1078 (rlim64_t)0, credp, &resid)) != 0) 1079 return (error); 1080 1081 /* 1082 * Since a separate version is compiled for handling 32-bit and 1083 * 64-bit ELF executables on a 64-bit kernel, the 64-bit version 1084 * doesn't need to be able to deal with 32-bit ELF files. 1085 */ 1086 if (resid != 0 || 1087 ehdr->e_ident[EI_MAG2] != ELFMAG2 || 1088 ehdr->e_ident[EI_MAG3] != ELFMAG3) 1089 return (ENOEXEC); 1090 1091 if ((ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) || 1092 #if defined(_ILP32) || defined(_ELF32_COMPAT) 1093 ehdr->e_ident[EI_CLASS] != ELFCLASS32 || 1094 #else 1095 ehdr->e_ident[EI_CLASS] != ELFCLASS64 || 1096 #endif 1097 !elfheadcheck(ehdr->e_ident[EI_DATA], ehdr->e_machine, 1098 ehdr->e_flags)) 1099 return (EINVAL); 1100 1101 *nshdrs = ehdr->e_shnum; 1102 *shstrndx = ehdr->e_shstrndx; 1103 *nphdrs = ehdr->e_phnum; 1104 1105 /* 1106 * If e_shnum, e_shstrndx, or e_phnum is its sentinel value, we need 1107 * to read in the section header at index zero to acces the true 1108 * values for those fields. 1109 */ 1110 if ((*nshdrs == 0 && ehdr->e_shoff != 0) || 1111 *shstrndx == SHN_XINDEX || *nphdrs == PN_XNUM) { 1112 Shdr shdr; 1113 1114 if (ehdr->e_shoff == 0) 1115 return (EINVAL); 1116 1117 if ((error = vn_rdwr(UIO_READ, vp, (caddr_t)&shdr, 1118 sizeof (shdr), (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, 1119 (rlim64_t)0, credp, &resid)) != 0) 1120 return (error); 1121 1122 if (*nshdrs == 0) 1123 *nshdrs = shdr.sh_size; 1124 if (*shstrndx == SHN_XINDEX) 1125 *shstrndx = shdr.sh_link; 1126 if (*nphdrs == PN_XNUM && shdr.sh_info != 0) 1127 *nphdrs = shdr.sh_info; 1128 } 1129 1130 return (0); 1131 } 1132 1133 #ifdef _ELF32_COMPAT 1134 extern size_t elf_nphdr_max; 1135 #else 1136 size_t elf_nphdr_max = 1000; 1137 #endif 1138 1139 static int 1140 getelfphdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, int nphdrs, 1141 caddr_t *phbasep, ssize_t *phsizep) 1142 { 1143 ssize_t resid, minsize; 1144 int err; 1145 1146 /* 1147 * Since we're going to be using e_phentsize to iterate down the 1148 * array of program headers, it must be 8-byte aligned or else 1149 * a we might cause a misaligned access. We use all members through 1150 * p_flags on 32-bit ELF files and p_memsz on 64-bit ELF files so 1151 * e_phentsize must be at least large enough to include those 1152 * members. 1153 */ 1154 #if !defined(_LP64) || defined(_ELF32_COMPAT) 1155 minsize = offsetof(Phdr, p_flags) + sizeof (((Phdr *)NULL)->p_flags); 1156 #else 1157 minsize = offsetof(Phdr, p_memsz) + sizeof (((Phdr *)NULL)->p_memsz); 1158 #endif 1159 if (ehdr->e_phentsize < minsize || (ehdr->e_phentsize & 3)) 1160 return (EINVAL); 1161 1162 *phsizep = nphdrs * ehdr->e_phentsize; 1163 1164 if (*phsizep > sizeof (Phdr) * elf_nphdr_max) { 1165 if ((*phbasep = kmem_alloc(*phsizep, KM_NOSLEEP)) == NULL) 1166 return (ENOMEM); 1167 } else { 1168 *phbasep = kmem_alloc(*phsizep, KM_SLEEP); 1169 } 1170 1171 if ((err = vn_rdwr(UIO_READ, vp, *phbasep, *phsizep, 1172 (offset_t)ehdr->e_phoff, UIO_SYSSPACE, 0, (rlim64_t)0, 1173 credp, &resid)) != 0) { 1174 kmem_free(*phbasep, *phsizep); 1175 *phbasep = NULL; 1176 return (err); 1177 } 1178 1179 return (0); 1180 } 1181 1182 #ifdef _ELF32_COMPAT 1183 extern size_t elf_nshdr_max; 1184 extern size_t elf_shstrtab_max; 1185 #else 1186 size_t elf_nshdr_max = 10000; 1187 size_t elf_shstrtab_max = 100 * 1024; 1188 #endif 1189 1190 1191 static int 1192 getelfshdr(vnode_t *vp, cred_t *credp, const Ehdr *ehdr, 1193 int nshdrs, int shstrndx, caddr_t *shbasep, ssize_t *shsizep, 1194 char **shstrbasep, ssize_t *shstrsizep) 1195 { 1196 ssize_t resid, minsize; 1197 int err; 1198 Shdr *shdr; 1199 1200 /* 1201 * Since we're going to be using e_shentsize to iterate down the 1202 * array of section headers, it must be 8-byte aligned or else 1203 * a we might cause a misaligned access. We use all members through 1204 * sh_entsize (on both 32- and 64-bit ELF files) so e_shentsize 1205 * must be at least large enough to include that member. The index 1206 * of the string table section must also be valid. 1207 */ 1208 minsize = offsetof(Shdr, sh_entsize) + sizeof (shdr->sh_entsize); 1209 if (ehdr->e_shentsize < minsize || (ehdr->e_shentsize & 3) || 1210 shstrndx >= nshdrs) 1211 return (EINVAL); 1212 1213 *shsizep = nshdrs * ehdr->e_shentsize; 1214 1215 if (*shsizep > sizeof (Shdr) * elf_nshdr_max) { 1216 if ((*shbasep = kmem_alloc(*shsizep, KM_NOSLEEP)) == NULL) 1217 return (ENOMEM); 1218 } else { 1219 *shbasep = kmem_alloc(*shsizep, KM_SLEEP); 1220 } 1221 1222 if ((err = vn_rdwr(UIO_READ, vp, *shbasep, *shsizep, 1223 (offset_t)ehdr->e_shoff, UIO_SYSSPACE, 0, (rlim64_t)0, 1224 credp, &resid)) != 0) { 1225 kmem_free(*shbasep, *shsizep); 1226 return (err); 1227 } 1228 1229 /* 1230 * Pull the section string table out of the vnode; fail if the size 1231 * is zero. 1232 */ 1233 shdr = (Shdr *)(*shbasep + shstrndx * ehdr->e_shentsize); 1234 if ((*shstrsizep = shdr->sh_size) == 0) { 1235 kmem_free(*shbasep, *shsizep); 1236 return (EINVAL); 1237 } 1238 1239 if (*shstrsizep > elf_shstrtab_max) { 1240 if ((*shstrbasep = kmem_alloc(*shstrsizep, 1241 KM_NOSLEEP)) == NULL) { 1242 kmem_free(*shbasep, *shsizep); 1243 return (ENOMEM); 1244 } 1245 } else { 1246 *shstrbasep = kmem_alloc(*shstrsizep, KM_SLEEP); 1247 } 1248 1249 if ((err = vn_rdwr(UIO_READ, vp, *shstrbasep, *shstrsizep, 1250 (offset_t)shdr->sh_offset, UIO_SYSSPACE, 0, (rlim64_t)0, 1251 credp, &resid)) != 0) { 1252 kmem_free(*shbasep, *shsizep); 1253 kmem_free(*shstrbasep, *shstrsizep); 1254 return (err); 1255 } 1256 1257 /* 1258 * Make sure the strtab is null-terminated to make sure we 1259 * don't run off the end of the table. 1260 */ 1261 (*shstrbasep)[*shstrsizep - 1] = '\0'; 1262 1263 return (0); 1264 } 1265 1266 static int 1267 mapelfexec( 1268 vnode_t *vp, 1269 Ehdr *ehdr, 1270 int nphdrs, 1271 caddr_t phdrbase, 1272 Phdr **uphdr, 1273 Phdr **intphdr, 1274 Phdr **stphdr, 1275 Phdr **dtphdr, 1276 Phdr *dataphdrp, 1277 caddr_t *bssbase, 1278 caddr_t *brkbase, 1279 intptr_t *voffset, 1280 intptr_t *minaddr, 1281 size_t len, 1282 long *execsz, 1283 size_t *brksize) 1284 { 1285 Phdr *phdr; 1286 int i, prot, error; 1287 caddr_t addr = NULL; 1288 size_t zfodsz; 1289 int ptload = 0; 1290 int page; 1291 off_t offset; 1292 int hsize = ehdr->e_phentsize; 1293 caddr_t mintmp = (caddr_t)-1; 1294 extern int use_brk_lpg; 1295 1296 if (ehdr->e_type == ET_DYN) { 1297 secflagset_t flags = 0; 1298 /* 1299 * Obtain the virtual address of a hole in the 1300 * address space to map the "interpreter". 1301 */ 1302 if (secflag_enabled(curproc, PROC_SEC_ASLR)) 1303 flags |= _MAP_RANDOMIZE; 1304 1305 map_addr(&addr, len, (offset_t)0, 1, flags); 1306 if (addr == NULL) 1307 return (ENOMEM); 1308 *voffset = (intptr_t)addr; 1309 1310 /* 1311 * Calculate the minimum vaddr so it can be subtracted out. 1312 * According to the ELF specification, since PT_LOAD sections 1313 * must be sorted by increasing p_vaddr values, this is 1314 * guaranteed to be the first PT_LOAD section. 1315 */ 1316 phdr = (Phdr *)phdrbase; 1317 for (i = nphdrs; i > 0; i--) { 1318 if (phdr->p_type == PT_LOAD) { 1319 *voffset -= (uintptr_t)phdr->p_vaddr; 1320 break; 1321 } 1322 phdr = (Phdr *)((caddr_t)phdr + hsize); 1323 } 1324 1325 } else { 1326 *voffset = 0; 1327 } 1328 phdr = (Phdr *)phdrbase; 1329 for (i = nphdrs; i > 0; i--) { 1330 switch (phdr->p_type) { 1331 case PT_LOAD: 1332 if ((*intphdr != NULL) && (*uphdr == NULL)) 1333 return (0); 1334 1335 ptload = 1; 1336 prot = PROT_USER; 1337 if (phdr->p_flags & PF_R) 1338 prot |= PROT_READ; 1339 if (phdr->p_flags & PF_W) 1340 prot |= PROT_WRITE; 1341 if (phdr->p_flags & PF_X) 1342 prot |= PROT_EXEC; 1343 1344 addr = (caddr_t)((uintptr_t)phdr->p_vaddr + *voffset); 1345 1346 /* 1347 * Keep track of the segment with the lowest starting 1348 * address. 1349 */ 1350 if (addr < mintmp) 1351 mintmp = addr; 1352 1353 zfodsz = (size_t)phdr->p_memsz - phdr->p_filesz; 1354 1355 offset = phdr->p_offset; 1356 if (((uintptr_t)offset & PAGEOFFSET) == 1357 ((uintptr_t)addr & PAGEOFFSET) && 1358 (!(vp->v_flag & VNOMAP))) { 1359 page = 1; 1360 } else { 1361 page = 0; 1362 } 1363 1364 /* 1365 * Set the heap pagesize for OOB when the bss size 1366 * is known and use_brk_lpg is not 0. 1367 */ 1368 if (brksize != NULL && use_brk_lpg && 1369 zfodsz != 0 && phdr == dataphdrp && 1370 (prot & PROT_WRITE)) { 1371 size_t tlen = P2NPHASE((uintptr_t)addr + 1372 phdr->p_filesz, PAGESIZE); 1373 1374 if (zfodsz > tlen) { 1375 curproc->p_brkpageszc = 1376 page_szc(map_pgsz(MAPPGSZ_HEAP, 1377 curproc, addr + phdr->p_filesz + 1378 tlen, zfodsz - tlen, 0)); 1379 } 1380 } 1381 1382 if (curproc->p_brkpageszc != 0 && phdr == dataphdrp && 1383 (prot & PROT_WRITE)) { 1384 uint_t szc = curproc->p_brkpageszc; 1385 size_t pgsz = page_get_pagesize(szc); 1386 caddr_t ebss = addr + phdr->p_memsz; 1387 /* 1388 * If we need extra space to keep the BSS an 1389 * integral number of pages in size, some of 1390 * that space may fall beyond p_brkbase, so we 1391 * need to set p_brksize to account for it 1392 * being (logically) part of the brk. 1393 */ 1394 size_t extra_zfodsz; 1395 1396 ASSERT(pgsz > PAGESIZE); 1397 1398 extra_zfodsz = P2NPHASE((uintptr_t)ebss, pgsz); 1399 1400 if (error = execmap(vp, addr, phdr->p_filesz, 1401 zfodsz + extra_zfodsz, phdr->p_offset, 1402 prot, page, szc)) 1403 goto bad; 1404 if (brksize != NULL) 1405 *brksize = extra_zfodsz; 1406 } else { 1407 if (error = execmap(vp, addr, phdr->p_filesz, 1408 zfodsz, phdr->p_offset, prot, page, 0)) 1409 goto bad; 1410 } 1411 1412 if (bssbase != NULL && addr >= *bssbase && 1413 phdr == dataphdrp) { 1414 *bssbase = addr + phdr->p_filesz; 1415 } 1416 if (brkbase != NULL && addr >= *brkbase) { 1417 *brkbase = addr + phdr->p_memsz; 1418 } 1419 1420 *execsz += btopr(phdr->p_memsz); 1421 break; 1422 1423 case PT_INTERP: 1424 if (ptload) 1425 goto bad; 1426 *intphdr = phdr; 1427 break; 1428 1429 case PT_SHLIB: 1430 *stphdr = phdr; 1431 break; 1432 1433 case PT_PHDR: 1434 if (ptload) 1435 goto bad; 1436 *uphdr = phdr; 1437 break; 1438 1439 case PT_NULL: 1440 case PT_DYNAMIC: 1441 case PT_NOTE: 1442 break; 1443 1444 case PT_SUNWDTRACE: 1445 if (dtphdr != NULL) 1446 *dtphdr = phdr; 1447 break; 1448 1449 default: 1450 break; 1451 } 1452 phdr = (Phdr *)((caddr_t)phdr + hsize); 1453 } 1454 1455 if (minaddr != NULL) { 1456 ASSERT(mintmp != (caddr_t)-1); 1457 *minaddr = (intptr_t)mintmp; 1458 } 1459 1460 if (brkbase != NULL && secflag_enabled(curproc, PROC_SEC_ASLR)) { 1461 size_t off; 1462 uintptr_t base = (uintptr_t)*brkbase; 1463 uintptr_t oend = base + *brksize; 1464 1465 ASSERT(ISP2(aslr_max_brk_skew)); 1466 1467 (void) random_get_pseudo_bytes((uint8_t *)&off, sizeof (off)); 1468 base += P2PHASE(off, aslr_max_brk_skew); 1469 base = P2ROUNDUP(base, PAGESIZE); 1470 *brkbase = (caddr_t)base; 1471 /* 1472 * Above, we set *brksize to account for the possibility we 1473 * had to grow the 'brk' in padding out the BSS to a page 1474 * boundary. 1475 * 1476 * We now need to adjust that based on where we now are 1477 * actually putting the brk. 1478 */ 1479 if (oend > base) 1480 *brksize = oend - base; 1481 else 1482 *brksize = 0; 1483 } 1484 1485 return (0); 1486 bad: 1487 if (error == 0) 1488 error = EINVAL; 1489 return (error); 1490 } 1491 1492 int 1493 elfnote(vnode_t *vp, offset_t *offsetp, int type, int descsz, void *desc, 1494 rlim64_t rlimit, cred_t *credp) 1495 { 1496 Note note; 1497 int error; 1498 1499 bzero(¬e, sizeof (note)); 1500 bcopy("CORE", note.name, 4); 1501 note.nhdr.n_type = type; 1502 /* 1503 * The System V ABI states that n_namesz must be the length of the 1504 * string that follows the Nhdr structure including the terminating 1505 * null. The ABI also specifies that sufficient padding should be 1506 * included so that the description that follows the name string 1507 * begins on a 4- or 8-byte boundary for 32- and 64-bit binaries 1508 * respectively. However, since this change was not made correctly 1509 * at the time of the 64-bit port, both 32- and 64-bit binaries 1510 * descriptions are only guaranteed to begin on a 4-byte boundary. 1511 */ 1512 note.nhdr.n_namesz = 5; 1513 note.nhdr.n_descsz = roundup(descsz, sizeof (Word)); 1514 1515 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, ¬e, 1516 sizeof (note), rlimit, credp)) 1517 return (error); 1518 1519 *offsetp += sizeof (note); 1520 1521 if (error = core_write(vp, UIO_SYSSPACE, *offsetp, desc, 1522 note.nhdr.n_descsz, rlimit, credp)) 1523 return (error); 1524 1525 *offsetp += note.nhdr.n_descsz; 1526 return (0); 1527 } 1528 1529 /* 1530 * Copy the section data from one vnode to the section of another vnode. 1531 */ 1532 static void 1533 copy_scn(Shdr *src, vnode_t *src_vp, Shdr *dst, vnode_t *dst_vp, Off *doffset, 1534 void *buf, size_t size, cred_t *credp, rlim64_t rlimit) 1535 { 1536 ssize_t resid; 1537 size_t len, n = src->sh_size; 1538 offset_t off = 0; 1539 1540 while (n != 0) { 1541 len = MIN(size, n); 1542 if (vn_rdwr(UIO_READ, src_vp, buf, len, src->sh_offset + off, 1543 UIO_SYSSPACE, 0, (rlim64_t)0, credp, &resid) != 0 || 1544 resid >= len || 1545 core_write(dst_vp, UIO_SYSSPACE, *doffset + off, 1546 buf, len - resid, rlimit, credp) != 0) { 1547 dst->sh_size = 0; 1548 dst->sh_offset = 0; 1549 return; 1550 } 1551 1552 ASSERT(n >= len - resid); 1553 1554 n -= len - resid; 1555 off += len - resid; 1556 } 1557 1558 *doffset += src->sh_size; 1559 } 1560 1561 #ifdef _ELF32_COMPAT 1562 extern size_t elf_datasz_max; 1563 extern size_t elf_zeropg_sz; 1564 #else 1565 size_t elf_datasz_max = 1 * 1024 * 1024; 1566 size_t elf_zeropg_sz = 4 * 1024; 1567 #endif 1568 1569 /* 1570 * This function processes mappings that correspond to load objects to 1571 * examine their respective sections for elfcore(). It's called once with 1572 * v set to NULL to count the number of sections that we're going to need 1573 * and then again with v set to some allocated buffer that we fill in with 1574 * all the section data. 1575 */ 1576 static int 1577 process_scns(core_content_t content, proc_t *p, cred_t *credp, vnode_t *vp, 1578 Shdr *v, int nv, rlim64_t rlimit, Off *doffsetp, int *nshdrsp) 1579 { 1580 vnode_t *lastvp = NULL; 1581 struct seg *seg; 1582 int i, j; 1583 void *data = NULL; 1584 size_t datasz = 0; 1585 shstrtab_t shstrtab; 1586 struct as *as = p->p_as; 1587 int error = 0; 1588 1589 if (!shstrtab_init(&shstrtab)) { 1590 error = ENOMEM; 1591 goto done; 1592 } 1593 1594 i = 1; 1595 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) { 1596 uint_t prot; 1597 vnode_t *mvp; 1598 void *tmp = NULL; 1599 caddr_t saddr = seg->s_base; 1600 caddr_t naddr; 1601 caddr_t eaddr; 1602 size_t segsize; 1603 1604 Ehdr ehdr; 1605 int nshdrs, shstrndx, nphdrs; 1606 caddr_t shbase; 1607 ssize_t shsize; 1608 char *shstrbase; 1609 ssize_t shstrsize; 1610 1611 Shdr *shdr; 1612 const char *name; 1613 size_t sz; 1614 uintptr_t off; 1615 1616 int ctf_ndx = 0; 1617 int symtab_ndx = 0; 1618 1619 /* 1620 * Since we're just looking for text segments of load 1621 * objects, we only care about the protection bits; we don't 1622 * care about the actual size of the segment so we use the 1623 * reserved size. If the segment's size is zero, there's 1624 * something fishy going on so we ignore this segment. 1625 */ 1626 if (seg->s_ops != &segvn_ops || 1627 SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 || 1628 mvp == lastvp || mvp == NULL || mvp->v_type != VREG || 1629 (segsize = pr_getsegsize(seg, 1)) == 0) 1630 continue; 1631 1632 eaddr = saddr + segsize; 1633 prot = pr_getprot(seg, 1, &tmp, &saddr, &naddr, eaddr); 1634 pr_getprot_done(&tmp); 1635 1636 /* 1637 * Skip this segment unless the protection bits look like 1638 * what we'd expect for a text segment. 1639 */ 1640 if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC) 1641 continue; 1642 1643 if (getelfhead(mvp, credp, &ehdr, &nshdrs, &shstrndx, 1644 &nphdrs) != 0 || 1645 getelfshdr(mvp, credp, &ehdr, nshdrs, shstrndx, 1646 &shbase, &shsize, &shstrbase, &shstrsize) != 0) 1647 continue; 1648 1649 off = ehdr.e_shentsize; 1650 for (j = 1; j < nshdrs; j++, off += ehdr.e_shentsize) { 1651 Shdr *symtab = NULL, *strtab; 1652 size_t allocsz; 1653 1654 shdr = (Shdr *)(shbase + off); 1655 allocsz = MIN(shdr->sh_size, elf_datasz_max); 1656 1657 if (shdr->sh_name >= shstrsize) 1658 continue; 1659 1660 name = shstrbase + shdr->sh_name; 1661 1662 if (strcmp(name, shstrtab_data[STR_CTF]) == 0) { 1663 if ((content & CC_CONTENT_CTF) == 0 || 1664 ctf_ndx != 0) 1665 continue; 1666 1667 if (shdr->sh_link > 0 && 1668 shdr->sh_link < nshdrs) { 1669 symtab = (Shdr *)(shbase + 1670 shdr->sh_link * ehdr.e_shentsize); 1671 } 1672 1673 if (v != NULL && i < nv - 1) { 1674 if (allocsz > datasz) { 1675 if (data != NULL) 1676 kmem_free(data, datasz); 1677 1678 datasz = allocsz; 1679 data = kmem_alloc(datasz, 1680 KM_SLEEP); 1681 } 1682 1683 if (!shstrtab_ndx(&shstrtab, 1684 shstrtab_data[STR_CTF], 1685 &v[i].sh_name)) { 1686 error = ENOMEM; 1687 goto done; 1688 } 1689 v[i].sh_addr = (Addr)(uintptr_t)saddr; 1690 v[i].sh_type = SHT_PROGBITS; 1691 v[i].sh_addralign = 4; 1692 *doffsetp = roundup(*doffsetp, 1693 v[i].sh_addralign); 1694 v[i].sh_offset = *doffsetp; 1695 v[i].sh_size = shdr->sh_size; 1696 if (symtab == NULL) { 1697 v[i].sh_link = 0; 1698 } else if (symtab->sh_type == 1699 SHT_SYMTAB && 1700 symtab_ndx != 0) { 1701 v[i].sh_link = 1702 symtab_ndx; 1703 } else { 1704 v[i].sh_link = i + 1; 1705 } 1706 1707 copy_scn(shdr, mvp, &v[i], vp, 1708 doffsetp, data, datasz, credp, 1709 rlimit); 1710 } 1711 1712 ctf_ndx = i++; 1713 1714 /* 1715 * We've already dumped the symtab. 1716 */ 1717 if (symtab != NULL && 1718 symtab->sh_type == SHT_SYMTAB && 1719 symtab_ndx != 0) 1720 continue; 1721 1722 } else if (strcmp(name, 1723 shstrtab_data[STR_SYMTAB]) == 0) { 1724 if ((content & CC_CONTENT_SYMTAB) == 0 || 1725 symtab != 0) 1726 continue; 1727 1728 symtab = shdr; 1729 } else if (strncmp(name, ".debug_", 1730 strlen(".debug_")) == 0) { 1731 /* 1732 * The design of the above check is intentional. 1733 * In particular, we want to capture any 1734 * sections that begin with '.debug_' for a few 1735 * reasons: 1736 * 1737 * 1) Various revisions to the DWARF spec end up 1738 * changing the set of section headers that 1739 * exist. This ensures that we don't need to 1740 * change the kernel to get a new version. 1741 * 1742 * 2) Other software uses .debug_ sections for 1743 * things which aren't DWARF. This allows them 1744 * to be captured as well. 1745 */ 1746 if ((content & CC_CONTENT_DEBUG) == 0) 1747 continue; 1748 1749 if (v != NULL && i < nv - 1) { 1750 if (allocsz > datasz) { 1751 if (data != NULL) 1752 kmem_free(data, datasz); 1753 1754 datasz = allocsz; 1755 data = kmem_alloc(datasz, 1756 KM_SLEEP); 1757 } 1758 1759 if (!shstrtab_ndx(&shstrtab, 1760 name, &v[i].sh_name)) { 1761 error = ENOMEM; 1762 goto done; 1763 } 1764 v[i].sh_addr = (Addr)(uintptr_t)saddr; 1765 v[i].sh_type = shdr->sh_type; 1766 v[i].sh_addralign = shdr->sh_addralign; 1767 *doffsetp = roundup(*doffsetp, 1768 v[i].sh_addralign); 1769 v[i].sh_offset = *doffsetp; 1770 v[i].sh_size = shdr->sh_size; 1771 v[i].sh_link = 0; 1772 v[i].sh_entsize = shdr->sh_entsize; 1773 v[i].sh_info = shdr->sh_info; 1774 1775 copy_scn(shdr, mvp, &v[i], vp, 1776 doffsetp, data, datasz, credp, 1777 rlimit); 1778 } 1779 1780 i++; 1781 continue; 1782 } 1783 1784 if (symtab != NULL) { 1785 if ((symtab->sh_type != SHT_DYNSYM && 1786 symtab->sh_type != SHT_SYMTAB) || 1787 symtab->sh_link == 0 || 1788 symtab->sh_link >= nshdrs) 1789 continue; 1790 1791 strtab = (Shdr *)(shbase + 1792 symtab->sh_link * ehdr.e_shentsize); 1793 1794 if (strtab->sh_type != SHT_STRTAB) 1795 continue; 1796 1797 if (v != NULL && i < nv - 2) { 1798 sz = MAX(symtab->sh_size, 1799 strtab->sh_size); 1800 allocsz = MIN(sz, elf_datasz_max); 1801 if (allocsz > datasz) { 1802 if (data != NULL) 1803 kmem_free(data, datasz); 1804 1805 datasz = allocsz; 1806 data = kmem_alloc(datasz, 1807 KM_SLEEP); 1808 } 1809 1810 if (symtab->sh_type == SHT_DYNSYM) { 1811 if (!shstrtab_ndx(&shstrtab, 1812 shstrtab_data[STR_DYNSYM], 1813 &v[i].sh_name)) { 1814 error = ENOMEM; 1815 goto done; 1816 } 1817 if (!shstrtab_ndx(&shstrtab, 1818 shstrtab_data[STR_DYNSTR], 1819 &v[i + 1].sh_name)) { 1820 error = ENOMEM; 1821 goto done; 1822 } 1823 } else { 1824 if (!shstrtab_ndx(&shstrtab, 1825 shstrtab_data[STR_SYMTAB], 1826 &v[i].sh_name)) { 1827 error = ENOMEM; 1828 goto done; 1829 } 1830 if (!shstrtab_ndx(&shstrtab, 1831 shstrtab_data[STR_STRTAB], 1832 &v[i + 1].sh_name)) { 1833 error = ENOMEM; 1834 goto done; 1835 } 1836 } 1837 1838 v[i].sh_type = symtab->sh_type; 1839 v[i].sh_addr = symtab->sh_addr; 1840 if (ehdr.e_type == ET_DYN || 1841 v[i].sh_addr == 0) 1842 v[i].sh_addr += 1843 (Addr)(uintptr_t)saddr; 1844 v[i].sh_addralign = 1845 symtab->sh_addralign; 1846 *doffsetp = roundup(*doffsetp, 1847 v[i].sh_addralign); 1848 v[i].sh_offset = *doffsetp; 1849 v[i].sh_size = symtab->sh_size; 1850 v[i].sh_link = i + 1; 1851 v[i].sh_entsize = symtab->sh_entsize; 1852 v[i].sh_info = symtab->sh_info; 1853 1854 copy_scn(symtab, mvp, &v[i], vp, 1855 doffsetp, data, datasz, credp, 1856 rlimit); 1857 1858 v[i + 1].sh_type = SHT_STRTAB; 1859 v[i + 1].sh_flags = SHF_STRINGS; 1860 v[i + 1].sh_addr = symtab->sh_addr; 1861 if (ehdr.e_type == ET_DYN || 1862 v[i + 1].sh_addr == 0) 1863 v[i + 1].sh_addr += 1864 (Addr)(uintptr_t)saddr; 1865 v[i + 1].sh_addralign = 1866 strtab->sh_addralign; 1867 *doffsetp = roundup(*doffsetp, 1868 v[i + 1].sh_addralign); 1869 v[i + 1].sh_offset = *doffsetp; 1870 v[i + 1].sh_size = strtab->sh_size; 1871 1872 copy_scn(strtab, mvp, &v[i + 1], vp, 1873 doffsetp, data, datasz, credp, 1874 rlimit); 1875 } 1876 1877 if (symtab->sh_type == SHT_SYMTAB) 1878 symtab_ndx = i; 1879 i += 2; 1880 } 1881 } 1882 1883 kmem_free(shstrbase, shstrsize); 1884 kmem_free(shbase, shsize); 1885 1886 lastvp = mvp; 1887 } 1888 1889 if (v == NULL) { 1890 if (i == 1) 1891 *nshdrsp = 0; 1892 else 1893 *nshdrsp = i + 1; 1894 goto done; 1895 } 1896 1897 if (i != nv - 1) { 1898 cmn_err(CE_WARN, "elfcore: core dump failed for " 1899 "process %d; address space is changing", p->p_pid); 1900 error = EIO; 1901 goto done; 1902 } 1903 1904 if (!shstrtab_ndx(&shstrtab, shstrtab_data[STR_SHSTRTAB], 1905 &v[i].sh_name)) { 1906 error = ENOMEM; 1907 goto done; 1908 } 1909 v[i].sh_size = shstrtab_size(&shstrtab); 1910 v[i].sh_addralign = 1; 1911 *doffsetp = roundup(*doffsetp, v[i].sh_addralign); 1912 v[i].sh_offset = *doffsetp; 1913 v[i].sh_flags = SHF_STRINGS; 1914 v[i].sh_type = SHT_STRTAB; 1915 1916 if (v[i].sh_size > datasz) { 1917 if (data != NULL) 1918 kmem_free(data, datasz); 1919 1920 datasz = v[i].sh_size; 1921 data = kmem_alloc(datasz, 1922 KM_SLEEP); 1923 } 1924 1925 shstrtab_dump(&shstrtab, data); 1926 1927 if ((error = core_write(vp, UIO_SYSSPACE, *doffsetp, 1928 data, v[i].sh_size, rlimit, credp)) != 0) 1929 goto done; 1930 1931 *doffsetp += v[i].sh_size; 1932 1933 done: 1934 if (data != NULL) 1935 kmem_free(data, datasz); 1936 1937 shstrtab_fini(&shstrtab); 1938 1939 return (error); 1940 } 1941 1942 int 1943 elfcore(vnode_t *vp, proc_t *p, cred_t *credp, rlim64_t rlimit, int sig, 1944 core_content_t content) 1945 { 1946 offset_t poffset, soffset; 1947 Off doffset; 1948 int error, i, nphdrs, nshdrs; 1949 int overflow = 0; 1950 struct seg *seg; 1951 struct as *as = p->p_as; 1952 union { 1953 Ehdr ehdr; 1954 Phdr phdr[1]; 1955 Shdr shdr[1]; 1956 } *bigwad; 1957 size_t bigsize; 1958 size_t phdrsz, shdrsz; 1959 Ehdr *ehdr; 1960 Phdr *v; 1961 void *zeropg = NULL; 1962 caddr_t brkbase; 1963 size_t brksize; 1964 caddr_t stkbase; 1965 size_t stksize; 1966 int ntries = 0; 1967 klwp_t *lwp = ttolwp(curthread); 1968 1969 top: 1970 /* 1971 * Make sure we have everything we need (registers, etc.). 1972 * All other lwps have already stopped and are in an orderly state. 1973 */ 1974 ASSERT(p == ttoproc(curthread)); 1975 prstop(0, 0); 1976 1977 AS_LOCK_ENTER(as, RW_WRITER); 1978 nphdrs = prnsegs(as, 0) + 2; /* two CORE note sections */ 1979 1980 /* 1981 * Count the number of section headers we're going to need. 1982 */ 1983 nshdrs = 0; 1984 if (content & (CC_CONTENT_CTF | CC_CONTENT_SYMTAB | CC_CONTENT_DEBUG)) { 1985 (void) process_scns(content, p, credp, NULL, NULL, 0, 0, 1986 NULL, &nshdrs); 1987 } 1988 AS_LOCK_EXIT(as); 1989 1990 ASSERT(nshdrs == 0 || nshdrs > 1); 1991 1992 /* 1993 * The core file contents may required zero section headers, but if 1994 * we overflow the 16 bits allotted to the program header count in 1995 * the ELF header, we'll need that program header at index zero. 1996 */ 1997 if (nshdrs == 0 && nphdrs >= PN_XNUM) 1998 nshdrs = 1; 1999 2000 phdrsz = nphdrs * sizeof (Phdr); 2001 shdrsz = nshdrs * sizeof (Shdr); 2002 2003 bigsize = MAX(sizeof (*bigwad), MAX(phdrsz, shdrsz)); 2004 bigwad = kmem_alloc(bigsize, KM_SLEEP); 2005 2006 ehdr = &bigwad->ehdr; 2007 bzero(ehdr, sizeof (*ehdr)); 2008 2009 ehdr->e_ident[EI_MAG0] = ELFMAG0; 2010 ehdr->e_ident[EI_MAG1] = ELFMAG1; 2011 ehdr->e_ident[EI_MAG2] = ELFMAG2; 2012 ehdr->e_ident[EI_MAG3] = ELFMAG3; 2013 ehdr->e_ident[EI_CLASS] = ELFCLASS; 2014 ehdr->e_type = ET_CORE; 2015 2016 #if !defined(_LP64) || defined(_ELF32_COMPAT) 2017 2018 #if defined(__sparc) 2019 ehdr->e_ident[EI_DATA] = ELFDATA2MSB; 2020 ehdr->e_machine = EM_SPARC; 2021 #elif defined(__i386_COMPAT) 2022 ehdr->e_ident[EI_DATA] = ELFDATA2LSB; 2023 ehdr->e_machine = EM_386; 2024 #else 2025 #error "no recognized machine type is defined" 2026 #endif 2027 2028 #else /* !defined(_LP64) || defined(_ELF32_COMPAT) */ 2029 2030 #if defined(__sparc) 2031 ehdr->e_ident[EI_DATA] = ELFDATA2MSB; 2032 ehdr->e_machine = EM_SPARCV9; 2033 #elif defined(__amd64) 2034 ehdr->e_ident[EI_DATA] = ELFDATA2LSB; 2035 ehdr->e_machine = EM_AMD64; 2036 #else 2037 #error "no recognized 64-bit machine type is defined" 2038 #endif 2039 2040 #endif /* !defined(_LP64) || defined(_ELF32_COMPAT) */ 2041 2042 /* 2043 * If the count of program headers or section headers or the index 2044 * of the section string table can't fit in the mere 16 bits 2045 * shortsightedly allotted to them in the ELF header, we use the 2046 * extended formats and put the real values in the section header 2047 * as index 0. 2048 */ 2049 ehdr->e_ident[EI_VERSION] = EV_CURRENT; 2050 ehdr->e_version = EV_CURRENT; 2051 ehdr->e_ehsize = sizeof (Ehdr); 2052 2053 if (nphdrs >= PN_XNUM) 2054 ehdr->e_phnum = PN_XNUM; 2055 else 2056 ehdr->e_phnum = (unsigned short)nphdrs; 2057 2058 ehdr->e_phoff = sizeof (Ehdr); 2059 ehdr->e_phentsize = sizeof (Phdr); 2060 2061 if (nshdrs > 0) { 2062 if (nshdrs >= SHN_LORESERVE) 2063 ehdr->e_shnum = 0; 2064 else 2065 ehdr->e_shnum = (unsigned short)nshdrs; 2066 2067 if (nshdrs - 1 >= SHN_LORESERVE) 2068 ehdr->e_shstrndx = SHN_XINDEX; 2069 else 2070 ehdr->e_shstrndx = (unsigned short)(nshdrs - 1); 2071 2072 ehdr->e_shoff = ehdr->e_phoff + ehdr->e_phentsize * nphdrs; 2073 ehdr->e_shentsize = sizeof (Shdr); 2074 } 2075 2076 if (error = core_write(vp, UIO_SYSSPACE, (offset_t)0, ehdr, 2077 sizeof (Ehdr), rlimit, credp)) 2078 goto done; 2079 2080 poffset = sizeof (Ehdr); 2081 soffset = sizeof (Ehdr) + phdrsz; 2082 doffset = sizeof (Ehdr) + phdrsz + shdrsz; 2083 2084 v = &bigwad->phdr[0]; 2085 bzero(v, phdrsz); 2086 2087 setup_old_note_header(&v[0], p); 2088 v[0].p_offset = doffset = roundup(doffset, sizeof (Word)); 2089 doffset += v[0].p_filesz; 2090 2091 setup_note_header(&v[1], p); 2092 v[1].p_offset = doffset = roundup(doffset, sizeof (Word)); 2093 doffset += v[1].p_filesz; 2094 2095 mutex_enter(&p->p_lock); 2096 2097 brkbase = p->p_brkbase; 2098 brksize = p->p_brksize; 2099 2100 stkbase = p->p_usrstack - p->p_stksize; 2101 stksize = p->p_stksize; 2102 2103 mutex_exit(&p->p_lock); 2104 2105 AS_LOCK_ENTER(as, RW_WRITER); 2106 i = 2; 2107 for (seg = AS_SEGFIRST(as); seg != NULL; seg = AS_SEGNEXT(as, seg)) { 2108 caddr_t eaddr = seg->s_base + pr_getsegsize(seg, 0); 2109 caddr_t saddr, naddr; 2110 void *tmp = NULL; 2111 extern struct seg_ops segspt_shmops; 2112 2113 if ((seg->s_flags & S_HOLE) != 0) { 2114 continue; 2115 } 2116 2117 for (saddr = seg->s_base; saddr < eaddr; saddr = naddr) { 2118 uint_t prot; 2119 size_t size; 2120 int type; 2121 vnode_t *mvp; 2122 2123 prot = pr_getprot(seg, 0, &tmp, &saddr, &naddr, eaddr); 2124 prot &= PROT_READ | PROT_WRITE | PROT_EXEC; 2125 if ((size = (size_t)(naddr - saddr)) == 0) 2126 continue; 2127 if (i == nphdrs) { 2128 overflow++; 2129 continue; 2130 } 2131 v[i].p_type = PT_LOAD; 2132 v[i].p_vaddr = (Addr)(uintptr_t)saddr; 2133 v[i].p_memsz = size; 2134 if (prot & PROT_READ) 2135 v[i].p_flags |= PF_R; 2136 if (prot & PROT_WRITE) 2137 v[i].p_flags |= PF_W; 2138 if (prot & PROT_EXEC) 2139 v[i].p_flags |= PF_X; 2140 2141 /* 2142 * Figure out which mappings to include in the core. 2143 */ 2144 type = SEGOP_GETTYPE(seg, saddr); 2145 2146 if (saddr == stkbase && size == stksize) { 2147 if (!(content & CC_CONTENT_STACK)) 2148 goto exclude; 2149 2150 } else if (saddr == brkbase && size == brksize) { 2151 if (!(content & CC_CONTENT_HEAP)) 2152 goto exclude; 2153 2154 } else if (seg->s_ops == &segspt_shmops) { 2155 if (type & MAP_NORESERVE) { 2156 if (!(content & CC_CONTENT_DISM)) 2157 goto exclude; 2158 } else { 2159 if (!(content & CC_CONTENT_ISM)) 2160 goto exclude; 2161 } 2162 2163 } else if (seg->s_ops != &segvn_ops) { 2164 goto exclude; 2165 2166 } else if (type & MAP_SHARED) { 2167 if (shmgetid(p, saddr) != SHMID_NONE) { 2168 if (!(content & CC_CONTENT_SHM)) 2169 goto exclude; 2170 2171 } else if (SEGOP_GETVP(seg, seg->s_base, 2172 &mvp) != 0 || mvp == NULL || 2173 mvp->v_type != VREG) { 2174 if (!(content & CC_CONTENT_SHANON)) 2175 goto exclude; 2176 2177 } else { 2178 if (!(content & CC_CONTENT_SHFILE)) 2179 goto exclude; 2180 } 2181 2182 } else if (SEGOP_GETVP(seg, seg->s_base, &mvp) != 0 || 2183 mvp == NULL || mvp->v_type != VREG) { 2184 if (!(content & CC_CONTENT_ANON)) 2185 goto exclude; 2186 2187 } else if (prot == (PROT_READ | PROT_EXEC)) { 2188 if (!(content & CC_CONTENT_TEXT)) 2189 goto exclude; 2190 2191 } else if (prot == PROT_READ) { 2192 if (!(content & CC_CONTENT_RODATA)) 2193 goto exclude; 2194 2195 } else { 2196 if (!(content & CC_CONTENT_DATA)) 2197 goto exclude; 2198 } 2199 2200 doffset = roundup(doffset, sizeof (Word)); 2201 v[i].p_offset = doffset; 2202 v[i].p_filesz = size; 2203 doffset += size; 2204 exclude: 2205 i++; 2206 } 2207 ASSERT(tmp == NULL); 2208 } 2209 AS_LOCK_EXIT(as); 2210 2211 if (overflow || i != nphdrs) { 2212 if (ntries++ == 0) { 2213 kmem_free(bigwad, bigsize); 2214 overflow = 0; 2215 goto top; 2216 } 2217 cmn_err(CE_WARN, "elfcore: core dump failed for " 2218 "process %d; address space is changing", p->p_pid); 2219 error = EIO; 2220 goto done; 2221 } 2222 2223 if ((error = core_write(vp, UIO_SYSSPACE, poffset, 2224 v, phdrsz, rlimit, credp)) != 0) 2225 goto done; 2226 2227 if ((error = write_old_elfnotes(p, sig, vp, v[0].p_offset, rlimit, 2228 credp)) != 0) 2229 goto done; 2230 2231 if ((error = write_elfnotes(p, sig, vp, v[1].p_offset, rlimit, 2232 credp, content)) != 0) 2233 goto done; 2234 2235 for (i = 2; i < nphdrs; i++) { 2236 prkillinfo_t killinfo; 2237 sigqueue_t *sq; 2238 int sig, j; 2239 2240 if (v[i].p_filesz == 0) 2241 continue; 2242 2243 /* 2244 * If we hit a region that was mapped PROT_NONE then we cannot 2245 * continue dumping this normally as the kernel would be unable 2246 * to read from the page and that would result in us failing to 2247 * dump the page. As such, any region mapped PROT_NONE, we dump 2248 * as a zero-filled page such that this is still represented in 2249 * the map. 2250 * 2251 * If dumping out this segment fails, rather than failing 2252 * the core dump entirely, we reset the size of the mapping 2253 * to zero to indicate that the data is absent from the core 2254 * file and or in the PF_SUNW_FAILURE flag to differentiate 2255 * this from mappings that were excluded due to the core file 2256 * content settings. 2257 */ 2258 if ((v[i].p_flags & (PF_R | PF_W | PF_X)) == 0) { 2259 size_t towrite = v[i].p_filesz; 2260 size_t curoff = 0; 2261 2262 if (zeropg == NULL) { 2263 zeropg = kmem_zalloc(elf_zeropg_sz, KM_SLEEP); 2264 } 2265 2266 error = 0; 2267 while (towrite != 0) { 2268 size_t len = MIN(towrite, elf_zeropg_sz); 2269 2270 error = core_write(vp, UIO_SYSSPACE, 2271 v[i].p_offset + curoff, zeropg, len, rlimit, 2272 credp); 2273 if (error != 0) 2274 break; 2275 2276 towrite -= len; 2277 curoff += len; 2278 } 2279 2280 if (error == 0) 2281 continue; 2282 } else { 2283 error = core_seg(p, vp, v[i].p_offset, 2284 (caddr_t)(uintptr_t)v[i].p_vaddr, v[i].p_filesz, 2285 rlimit, credp); 2286 if (error == 0) 2287 continue; 2288 } 2289 2290 if ((sig = lwp->lwp_cursig) == 0) { 2291 /* 2292 * We failed due to something other than a signal. 2293 * Since the space reserved for the segment is now 2294 * unused, we stash the errno in the first four 2295 * bytes. This undocumented interface will let us 2296 * understand the nature of the failure. 2297 */ 2298 (void) core_write(vp, UIO_SYSSPACE, v[i].p_offset, 2299 &error, sizeof (error), rlimit, credp); 2300 2301 v[i].p_filesz = 0; 2302 v[i].p_flags |= PF_SUNW_FAILURE; 2303 if ((error = core_write(vp, UIO_SYSSPACE, 2304 poffset + sizeof (v[i]) * i, &v[i], sizeof (v[i]), 2305 rlimit, credp)) != 0) 2306 goto done; 2307 2308 continue; 2309 } 2310 2311 /* 2312 * We took a signal. We want to abort the dump entirely, but 2313 * we also want to indicate what failed and why. We therefore 2314 * use the space reserved for the first failing segment to 2315 * write our error (which, for purposes of compatability with 2316 * older core dump readers, we set to EINTR) followed by any 2317 * siginfo associated with the signal. 2318 */ 2319 bzero(&killinfo, sizeof (killinfo)); 2320 killinfo.prk_error = EINTR; 2321 2322 sq = sig == SIGKILL ? curproc->p_killsqp : lwp->lwp_curinfo; 2323 2324 if (sq != NULL) { 2325 bcopy(&sq->sq_info, &killinfo.prk_info, 2326 sizeof (sq->sq_info)); 2327 } else { 2328 killinfo.prk_info.si_signo = lwp->lwp_cursig; 2329 killinfo.prk_info.si_code = SI_NOINFO; 2330 } 2331 2332 #if (defined(_SYSCALL32_IMPL) || defined(_LP64)) 2333 /* 2334 * If this is a 32-bit process, we need to translate from the 2335 * native siginfo to the 32-bit variant. (Core readers must 2336 * always have the same data model as their target or must 2337 * be aware of -- and compensate for -- data model differences.) 2338 */ 2339 if (curproc->p_model == DATAMODEL_ILP32) { 2340 siginfo32_t si32; 2341 2342 siginfo_kto32((k_siginfo_t *)&killinfo.prk_info, &si32); 2343 bcopy(&si32, &killinfo.prk_info, sizeof (si32)); 2344 } 2345 #endif 2346 2347 (void) core_write(vp, UIO_SYSSPACE, v[i].p_offset, 2348 &killinfo, sizeof (killinfo), rlimit, credp); 2349 2350 /* 2351 * For the segment on which we took the signal, indicate that 2352 * its data now refers to a siginfo. 2353 */ 2354 v[i].p_filesz = 0; 2355 v[i].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED | 2356 PF_SUNW_SIGINFO; 2357 2358 /* 2359 * And for every other segment, indicate that its absence 2360 * is due to a signal. 2361 */ 2362 for (j = i + 1; j < nphdrs; j++) { 2363 v[j].p_filesz = 0; 2364 v[j].p_flags |= PF_SUNW_FAILURE | PF_SUNW_KILLED; 2365 } 2366 2367 /* 2368 * Finally, write out our modified program headers. 2369 */ 2370 if ((error = core_write(vp, UIO_SYSSPACE, 2371 poffset + sizeof (v[i]) * i, &v[i], 2372 sizeof (v[i]) * (nphdrs - i), rlimit, credp)) != 0) 2373 goto done; 2374 2375 break; 2376 } 2377 2378 if (nshdrs > 0) { 2379 bzero(&bigwad->shdr[0], shdrsz); 2380 2381 if (nshdrs >= SHN_LORESERVE) 2382 bigwad->shdr[0].sh_size = nshdrs; 2383 2384 if (nshdrs - 1 >= SHN_LORESERVE) 2385 bigwad->shdr[0].sh_link = nshdrs - 1; 2386 2387 if (nphdrs >= PN_XNUM) 2388 bigwad->shdr[0].sh_info = nphdrs; 2389 2390 if (nshdrs > 1) { 2391 AS_LOCK_ENTER(as, RW_WRITER); 2392 if ((error = process_scns(content, p, credp, vp, 2393 &bigwad->shdr[0], nshdrs, rlimit, &doffset, 2394 NULL)) != 0) { 2395 AS_LOCK_EXIT(as); 2396 goto done; 2397 } 2398 AS_LOCK_EXIT(as); 2399 } 2400 2401 if ((error = core_write(vp, UIO_SYSSPACE, soffset, 2402 &bigwad->shdr[0], shdrsz, rlimit, credp)) != 0) 2403 goto done; 2404 } 2405 2406 done: 2407 if (zeropg != NULL) { 2408 kmem_free(zeropg, elf_zeropg_sz); 2409 } 2410 kmem_free(bigwad, bigsize); 2411 return (error); 2412 } 2413 2414 #ifndef _ELF32_COMPAT 2415 2416 static struct execsw esw = { 2417 #ifdef _LP64 2418 elf64magicstr, 2419 #else /* _LP64 */ 2420 elf32magicstr, 2421 #endif /* _LP64 */ 2422 0, 2423 5, 2424 elfexec, 2425 elfcore 2426 }; 2427 2428 static struct modlexec modlexec = { 2429 &mod_execops, "exec module for elf", &esw 2430 }; 2431 2432 #ifdef _LP64 2433 extern int elf32exec(vnode_t *vp, execa_t *uap, uarg_t *args, 2434 intpdata_t *idatap, int level, long *execsz, 2435 int setid, caddr_t exec_file, cred_t *cred, 2436 int brand_action); 2437 extern int elf32core(vnode_t *vp, proc_t *p, cred_t *credp, 2438 rlim64_t rlimit, int sig, core_content_t content); 2439 2440 static struct execsw esw32 = { 2441 elf32magicstr, 2442 0, 2443 5, 2444 elf32exec, 2445 elf32core 2446 }; 2447 2448 static struct modlexec modlexec32 = { 2449 &mod_execops, "32-bit exec module for elf", &esw32 2450 }; 2451 #endif /* _LP64 */ 2452 2453 static struct modlinkage modlinkage = { 2454 MODREV_1, 2455 (void *)&modlexec, 2456 #ifdef _LP64 2457 (void *)&modlexec32, 2458 #endif /* _LP64 */ 2459 NULL 2460 }; 2461 2462 int 2463 _init(void) 2464 { 2465 return (mod_install(&modlinkage)); 2466 } 2467 2468 int 2469 _fini(void) 2470 { 2471 return (mod_remove(&modlinkage)); 2472 } 2473 2474 int 2475 _info(struct modinfo *modinfop) 2476 { 2477 return (mod_info(&modlinkage, modinfop)); 2478 } 2479 2480 #endif /* !_ELF32_COMPAT */ 2481