1 | // SPDX-License-Identifier: GPL-2.0-or-later |
2 | /* binfmt_elf_fdpic.c: FDPIC ELF binary format |
3 | * |
4 | * Copyright (C) 2003, 2004, 2006 Red Hat, Inc. All Rights Reserved. |
5 | * Written by David Howells (dhowells@redhat.com) |
6 | * Derived from binfmt_elf.c |
7 | */ |
8 | |
9 | #include <linux/module.h> |
10 | |
11 | #include <linux/fs.h> |
12 | #include <linux/stat.h> |
13 | #include <linux/sched.h> |
14 | #include <linux/sched/coredump.h> |
15 | #include <linux/sched/task_stack.h> |
16 | #include <linux/sched/cputime.h> |
17 | #include <linux/mm.h> |
18 | #include <linux/mman.h> |
19 | #include <linux/errno.h> |
20 | #include <linux/signal.h> |
21 | #include <linux/binfmts.h> |
22 | #include <linux/string.h> |
23 | #include <linux/file.h> |
24 | #include <linux/fcntl.h> |
25 | #include <linux/slab.h> |
26 | #include <linux/pagemap.h> |
27 | #include <linux/security.h> |
28 | #include <linux/highmem.h> |
29 | #include <linux/highuid.h> |
30 | #include <linux/personality.h> |
31 | #include <linux/ptrace.h> |
32 | #include <linux/init.h> |
33 | #include <linux/elf.h> |
34 | #include <linux/elf-fdpic.h> |
35 | #include <linux/elfcore.h> |
36 | #include <linux/coredump.h> |
37 | #include <linux/dax.h> |
38 | #include <linux/regset.h> |
39 | |
40 | #include <linux/uaccess.h> |
41 | #include <asm/param.h> |
42 | |
43 | typedef char *elf_caddr_t; |
44 | |
45 | #if 0 |
46 | #define kdebug(fmt, ...) printk("FDPIC "fmt"\n" ,##__VA_ARGS__ ) |
47 | #else |
48 | #define kdebug(fmt, ...) do {} while(0) |
49 | #endif |
50 | |
51 | #if 0 |
52 | #define kdcore(fmt, ...) printk("FDPIC "fmt"\n" ,##__VA_ARGS__ ) |
53 | #else |
54 | #define kdcore(fmt, ...) do {} while(0) |
55 | #endif |
56 | |
57 | MODULE_LICENSE("GPL" ); |
58 | |
59 | static int load_elf_fdpic_binary(struct linux_binprm *); |
60 | static int elf_fdpic_fetch_phdrs(struct elf_fdpic_params *, struct file *); |
61 | static int elf_fdpic_map_file(struct elf_fdpic_params *, struct file *, |
62 | struct mm_struct *, const char *); |
63 | |
64 | static int create_elf_fdpic_tables(struct linux_binprm *, struct mm_struct *, |
65 | struct elf_fdpic_params *, |
66 | struct elf_fdpic_params *); |
67 | |
68 | #ifndef CONFIG_MMU |
69 | static int elf_fdpic_map_file_constdisp_on_uclinux(struct elf_fdpic_params *, |
70 | struct file *, |
71 | struct mm_struct *); |
72 | #endif |
73 | |
74 | static int elf_fdpic_map_file_by_direct_mmap(struct elf_fdpic_params *, |
75 | struct file *, struct mm_struct *); |
76 | |
77 | #ifdef CONFIG_ELF_CORE |
78 | static int elf_fdpic_core_dump(struct coredump_params *cprm); |
79 | #endif |
80 | |
81 | static struct linux_binfmt elf_fdpic_format = { |
82 | .module = THIS_MODULE, |
83 | .load_binary = load_elf_fdpic_binary, |
84 | #ifdef CONFIG_ELF_CORE |
85 | .core_dump = elf_fdpic_core_dump, |
86 | .min_coredump = ELF_EXEC_PAGESIZE, |
87 | #endif |
88 | }; |
89 | |
90 | static int __init init_elf_fdpic_binfmt(void) |
91 | { |
92 | register_binfmt(fmt: &elf_fdpic_format); |
93 | return 0; |
94 | } |
95 | |
96 | static void __exit exit_elf_fdpic_binfmt(void) |
97 | { |
98 | unregister_binfmt(&elf_fdpic_format); |
99 | } |
100 | |
101 | core_initcall(init_elf_fdpic_binfmt); |
102 | module_exit(exit_elf_fdpic_binfmt); |
103 | |
104 | static int is_elf(struct elfhdr *hdr, struct file *file) |
105 | { |
106 | if (memcmp(p: hdr->e_ident, ELFMAG, SELFMAG) != 0) |
107 | return 0; |
108 | if (hdr->e_type != ET_EXEC && hdr->e_type != ET_DYN) |
109 | return 0; |
110 | if (!elf_check_arch(hdr)) |
111 | return 0; |
112 | if (!file->f_op->mmap) |
113 | return 0; |
114 | return 1; |
115 | } |
116 | |
117 | #ifndef elf_check_fdpic |
118 | #define elf_check_fdpic(x) 0 |
119 | #endif |
120 | |
121 | #ifndef elf_check_const_displacement |
122 | #define elf_check_const_displacement(x) 0 |
123 | #endif |
124 | |
125 | static int is_constdisp(struct elfhdr *hdr) |
126 | { |
127 | if (!elf_check_fdpic(hdr)) |
128 | return 1; |
129 | if (elf_check_const_displacement(hdr)) |
130 | return 1; |
131 | return 0; |
132 | } |
133 | |
134 | /*****************************************************************************/ |
135 | /* |
136 | * read the program headers table into memory |
137 | */ |
138 | static int elf_fdpic_fetch_phdrs(struct elf_fdpic_params *params, |
139 | struct file *file) |
140 | { |
141 | struct elf_phdr *phdr; |
142 | unsigned long size; |
143 | int retval, loop; |
144 | loff_t pos = params->hdr.e_phoff; |
145 | |
146 | if (params->hdr.e_phentsize != sizeof(struct elf_phdr)) |
147 | return -ENOMEM; |
148 | if (params->hdr.e_phnum > 65536U / sizeof(struct elf_phdr)) |
149 | return -ENOMEM; |
150 | |
151 | size = params->hdr.e_phnum * sizeof(struct elf_phdr); |
152 | params->phdrs = kmalloc(size, GFP_KERNEL); |
153 | if (!params->phdrs) |
154 | return -ENOMEM; |
155 | |
156 | retval = kernel_read(file, params->phdrs, size, &pos); |
157 | if (unlikely(retval != size)) |
158 | return retval < 0 ? retval : -ENOEXEC; |
159 | |
160 | /* determine stack size for this binary */ |
161 | phdr = params->phdrs; |
162 | for (loop = 0; loop < params->hdr.e_phnum; loop++, phdr++) { |
163 | if (phdr->p_type != PT_GNU_STACK) |
164 | continue; |
165 | |
166 | if (phdr->p_flags & PF_X) |
167 | params->flags |= ELF_FDPIC_FLAG_EXEC_STACK; |
168 | else |
169 | params->flags |= ELF_FDPIC_FLAG_NOEXEC_STACK; |
170 | |
171 | params->stack_size = phdr->p_memsz; |
172 | break; |
173 | } |
174 | |
175 | return 0; |
176 | } |
177 | |
178 | /*****************************************************************************/ |
179 | /* |
180 | * load an fdpic binary into various bits of memory |
181 | */ |
182 | static int load_elf_fdpic_binary(struct linux_binprm *bprm) |
183 | { |
184 | struct elf_fdpic_params exec_params, interp_params; |
185 | struct pt_regs *regs = current_pt_regs(); |
186 | struct elf_phdr *phdr; |
187 | unsigned long stack_size, entryaddr; |
188 | #ifdef ELF_FDPIC_PLAT_INIT |
189 | unsigned long dynaddr; |
190 | #endif |
191 | #ifndef CONFIG_MMU |
192 | unsigned long stack_prot; |
193 | #endif |
194 | struct file *interpreter = NULL; /* to shut gcc up */ |
195 | char *interpreter_name = NULL; |
196 | int executable_stack; |
197 | int retval, i; |
198 | loff_t pos; |
199 | |
200 | kdebug("____ LOAD %d ____" , current->pid); |
201 | |
202 | memset(&exec_params, 0, sizeof(exec_params)); |
203 | memset(&interp_params, 0, sizeof(interp_params)); |
204 | |
205 | exec_params.hdr = *(struct elfhdr *) bprm->buf; |
206 | exec_params.flags = ELF_FDPIC_FLAG_PRESENT | ELF_FDPIC_FLAG_EXECUTABLE; |
207 | |
208 | /* check that this is a binary we know how to deal with */ |
209 | retval = -ENOEXEC; |
210 | if (!is_elf(hdr: &exec_params.hdr, file: bprm->file)) |
211 | goto error; |
212 | if (!elf_check_fdpic(&exec_params.hdr)) { |
213 | #ifdef CONFIG_MMU |
214 | /* binfmt_elf handles non-fdpic elf except on nommu */ |
215 | goto error; |
216 | #else |
217 | /* nommu can only load ET_DYN (PIE) ELF */ |
218 | if (exec_params.hdr.e_type != ET_DYN) |
219 | goto error; |
220 | #endif |
221 | } |
222 | |
223 | /* read the program header table */ |
224 | retval = elf_fdpic_fetch_phdrs(params: &exec_params, file: bprm->file); |
225 | if (retval < 0) |
226 | goto error; |
227 | |
228 | /* scan for a program header that specifies an interpreter */ |
229 | phdr = exec_params.phdrs; |
230 | |
231 | for (i = 0; i < exec_params.hdr.e_phnum; i++, phdr++) { |
232 | switch (phdr->p_type) { |
233 | case PT_INTERP: |
234 | retval = -ENOMEM; |
235 | if (phdr->p_filesz > PATH_MAX) |
236 | goto error; |
237 | retval = -ENOENT; |
238 | if (phdr->p_filesz < 2) |
239 | goto error; |
240 | |
241 | /* read the name of the interpreter into memory */ |
242 | interpreter_name = kmalloc(size: phdr->p_filesz, GFP_KERNEL); |
243 | if (!interpreter_name) |
244 | goto error; |
245 | |
246 | pos = phdr->p_offset; |
247 | retval = kernel_read(bprm->file, interpreter_name, |
248 | phdr->p_filesz, &pos); |
249 | if (unlikely(retval != phdr->p_filesz)) { |
250 | if (retval >= 0) |
251 | retval = -ENOEXEC; |
252 | goto error; |
253 | } |
254 | |
255 | retval = -ENOENT; |
256 | if (interpreter_name[phdr->p_filesz - 1] != '\0') |
257 | goto error; |
258 | |
259 | kdebug("Using ELF interpreter %s" , interpreter_name); |
260 | |
261 | /* replace the program with the interpreter */ |
262 | interpreter = open_exec(interpreter_name); |
263 | retval = PTR_ERR(ptr: interpreter); |
264 | if (IS_ERR(ptr: interpreter)) { |
265 | interpreter = NULL; |
266 | goto error; |
267 | } |
268 | |
269 | /* |
270 | * If the binary is not readable then enforce |
271 | * mm->dumpable = 0 regardless of the interpreter's |
272 | * permissions. |
273 | */ |
274 | would_dump(bprm, interpreter); |
275 | |
276 | pos = 0; |
277 | retval = kernel_read(interpreter, bprm->buf, |
278 | BINPRM_BUF_SIZE, &pos); |
279 | if (unlikely(retval != BINPRM_BUF_SIZE)) { |
280 | if (retval >= 0) |
281 | retval = -ENOEXEC; |
282 | goto error; |
283 | } |
284 | |
285 | interp_params.hdr = *((struct elfhdr *) bprm->buf); |
286 | break; |
287 | |
288 | case PT_LOAD: |
289 | #ifdef CONFIG_MMU |
290 | if (exec_params.load_addr == 0) |
291 | exec_params.load_addr = phdr->p_vaddr; |
292 | #endif |
293 | break; |
294 | } |
295 | |
296 | } |
297 | |
298 | if (is_constdisp(hdr: &exec_params.hdr)) |
299 | exec_params.flags |= ELF_FDPIC_FLAG_CONSTDISP; |
300 | |
301 | /* perform insanity checks on the interpreter */ |
302 | if (interpreter_name) { |
303 | retval = -ELIBBAD; |
304 | if (!is_elf(hdr: &interp_params.hdr, file: interpreter)) |
305 | goto error; |
306 | |
307 | interp_params.flags = ELF_FDPIC_FLAG_PRESENT; |
308 | |
309 | /* read the interpreter's program header table */ |
310 | retval = elf_fdpic_fetch_phdrs(params: &interp_params, file: interpreter); |
311 | if (retval < 0) |
312 | goto error; |
313 | } |
314 | |
315 | stack_size = exec_params.stack_size; |
316 | if (exec_params.flags & ELF_FDPIC_FLAG_EXEC_STACK) |
317 | executable_stack = EXSTACK_ENABLE_X; |
318 | else if (exec_params.flags & ELF_FDPIC_FLAG_NOEXEC_STACK) |
319 | executable_stack = EXSTACK_DISABLE_X; |
320 | else |
321 | executable_stack = EXSTACK_DEFAULT; |
322 | |
323 | if (stack_size == 0) { |
324 | stack_size = interp_params.stack_size; |
325 | if (interp_params.flags & ELF_FDPIC_FLAG_EXEC_STACK) |
326 | executable_stack = EXSTACK_ENABLE_X; |
327 | else if (interp_params.flags & ELF_FDPIC_FLAG_NOEXEC_STACK) |
328 | executable_stack = EXSTACK_DISABLE_X; |
329 | else |
330 | executable_stack = EXSTACK_DEFAULT; |
331 | } |
332 | |
333 | retval = -ENOEXEC; |
334 | if (stack_size == 0) |
335 | stack_size = 131072UL; /* same as exec.c's default commit */ |
336 | |
337 | if (is_constdisp(hdr: &interp_params.hdr)) |
338 | interp_params.flags |= ELF_FDPIC_FLAG_CONSTDISP; |
339 | |
340 | /* flush all traces of the currently running executable */ |
341 | retval = begin_new_exec(bprm); |
342 | if (retval) |
343 | goto error; |
344 | |
345 | /* there's now no turning back... the old userspace image is dead, |
346 | * defunct, deceased, etc. |
347 | */ |
348 | SET_PERSONALITY(exec_params.hdr); |
349 | if (elf_check_fdpic(&exec_params.hdr)) |
350 | current->personality |= PER_LINUX_FDPIC; |
351 | if (elf_read_implies_exec(&exec_params.hdr, executable_stack)) |
352 | current->personality |= READ_IMPLIES_EXEC; |
353 | |
354 | setup_new_exec(bprm); |
355 | |
356 | set_binfmt(&elf_fdpic_format); |
357 | |
358 | current->mm->start_code = 0; |
359 | current->mm->end_code = 0; |
360 | current->mm->start_stack = 0; |
361 | current->mm->start_data = 0; |
362 | current->mm->end_data = 0; |
363 | current->mm->context.exec_fdpic_loadmap = 0; |
364 | current->mm->context.interp_fdpic_loadmap = 0; |
365 | |
366 | #ifdef CONFIG_MMU |
367 | elf_fdpic_arch_lay_out_mm(exec_params: &exec_params, |
368 | interp_params: &interp_params, |
369 | start_stack: ¤t->mm->start_stack, |
370 | start_brk: ¤t->mm->start_brk); |
371 | |
372 | retval = setup_arg_pages(bprm, current->mm->start_stack, |
373 | executable_stack); |
374 | if (retval < 0) |
375 | goto error; |
376 | #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES |
377 | retval = arch_setup_additional_pages(bprm, uses_interp: !!interpreter_name); |
378 | if (retval < 0) |
379 | goto error; |
380 | #endif |
381 | #endif |
382 | |
383 | /* load the executable and interpreter into memory */ |
384 | retval = elf_fdpic_map_file(&exec_params, bprm->file, current->mm, |
385 | "executable" ); |
386 | if (retval < 0) |
387 | goto error; |
388 | |
389 | if (interpreter_name) { |
390 | retval = elf_fdpic_map_file(&interp_params, interpreter, |
391 | current->mm, "interpreter" ); |
392 | if (retval < 0) { |
393 | printk(KERN_ERR "Unable to load interpreter\n" ); |
394 | goto error; |
395 | } |
396 | |
397 | allow_write_access(file: interpreter); |
398 | fput(interpreter); |
399 | interpreter = NULL; |
400 | } |
401 | |
402 | #ifdef CONFIG_MMU |
403 | if (!current->mm->start_brk) |
404 | current->mm->start_brk = current->mm->end_data; |
405 | |
406 | current->mm->brk = current->mm->start_brk = |
407 | PAGE_ALIGN(current->mm->start_brk); |
408 | |
409 | #else |
410 | /* create a stack area and zero-size brk area */ |
411 | stack_size = (stack_size + PAGE_SIZE - 1) & PAGE_MASK; |
412 | if (stack_size < PAGE_SIZE * 2) |
413 | stack_size = PAGE_SIZE * 2; |
414 | |
415 | stack_prot = PROT_READ | PROT_WRITE; |
416 | if (executable_stack == EXSTACK_ENABLE_X || |
417 | (executable_stack == EXSTACK_DEFAULT && VM_STACK_FLAGS & VM_EXEC)) |
418 | stack_prot |= PROT_EXEC; |
419 | |
420 | current->mm->start_brk = vm_mmap(NULL, 0, stack_size, stack_prot, |
421 | MAP_PRIVATE | MAP_ANONYMOUS | |
422 | MAP_UNINITIALIZED | MAP_GROWSDOWN, |
423 | 0); |
424 | |
425 | if (IS_ERR_VALUE(current->mm->start_brk)) { |
426 | retval = current->mm->start_brk; |
427 | current->mm->start_brk = 0; |
428 | goto error; |
429 | } |
430 | |
431 | current->mm->brk = current->mm->start_brk; |
432 | current->mm->context.end_brk = current->mm->start_brk; |
433 | current->mm->start_stack = current->mm->start_brk + stack_size; |
434 | #endif |
435 | |
436 | retval = create_elf_fdpic_tables(bprm, current->mm, &exec_params, |
437 | &interp_params); |
438 | if (retval < 0) |
439 | goto error; |
440 | |
441 | kdebug("- start_code %lx" , current->mm->start_code); |
442 | kdebug("- end_code %lx" , current->mm->end_code); |
443 | kdebug("- start_data %lx" , current->mm->start_data); |
444 | kdebug("- end_data %lx" , current->mm->end_data); |
445 | kdebug("- start_brk %lx" , current->mm->start_brk); |
446 | kdebug("- brk %lx" , current->mm->brk); |
447 | kdebug("- start_stack %lx" , current->mm->start_stack); |
448 | |
449 | #ifdef ELF_FDPIC_PLAT_INIT |
450 | /* |
451 | * The ABI may specify that certain registers be set up in special |
452 | * ways (on i386 %edx is the address of a DT_FINI function, for |
453 | * example. This macro performs whatever initialization to |
454 | * the regs structure is required. |
455 | */ |
456 | dynaddr = interp_params.dynamic_addr ?: exec_params.dynamic_addr; |
457 | ELF_FDPIC_PLAT_INIT(regs, exec_params.map_addr, interp_params.map_addr, |
458 | dynaddr); |
459 | #endif |
460 | |
461 | finalize_exec(bprm); |
462 | /* everything is now ready... get the userspace context ready to roll */ |
463 | entryaddr = interp_params.entry_addr ?: exec_params.entry_addr; |
464 | start_thread(regs, new_ip: entryaddr, current->mm->start_stack); |
465 | |
466 | retval = 0; |
467 | |
468 | error: |
469 | if (interpreter) { |
470 | allow_write_access(file: interpreter); |
471 | fput(interpreter); |
472 | } |
473 | kfree(objp: interpreter_name); |
474 | kfree(objp: exec_params.phdrs); |
475 | kfree(objp: exec_params.loadmap); |
476 | kfree(objp: interp_params.phdrs); |
477 | kfree(objp: interp_params.loadmap); |
478 | return retval; |
479 | } |
480 | |
481 | /*****************************************************************************/ |
482 | |
483 | #ifndef ELF_BASE_PLATFORM |
484 | /* |
485 | * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture. |
486 | * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value |
487 | * will be copied to the user stack in the same manner as AT_PLATFORM. |
488 | */ |
489 | #define ELF_BASE_PLATFORM NULL |
490 | #endif |
491 | |
492 | /* |
493 | * present useful information to the program by shovelling it onto the new |
494 | * process's stack |
495 | */ |
496 | static int create_elf_fdpic_tables(struct linux_binprm *bprm, |
497 | struct mm_struct *mm, |
498 | struct elf_fdpic_params *exec_params, |
499 | struct elf_fdpic_params *interp_params) |
500 | { |
501 | const struct cred *cred = current_cred(); |
502 | unsigned long sp, csp, nitems; |
503 | elf_caddr_t __user *argv, *envp; |
504 | size_t platform_len = 0, len; |
505 | char *k_platform, *k_base_platform; |
506 | char __user *u_platform, *u_base_platform, *p; |
507 | int loop; |
508 | int nr; /* reset for each csp adjustment */ |
509 | unsigned long flags = 0; |
510 | |
511 | #ifdef CONFIG_MMU |
512 | /* In some cases (e.g. Hyper-Threading), we want to avoid L1 evictions |
513 | * by the processes running on the same package. One thing we can do is |
514 | * to shuffle the initial stack for them, so we give the architecture |
515 | * an opportunity to do so here. |
516 | */ |
517 | sp = arch_align_stack(sp: bprm->p); |
518 | #else |
519 | sp = mm->start_stack; |
520 | |
521 | /* stack the program arguments and environment */ |
522 | if (transfer_args_to_stack(bprm, &sp) < 0) |
523 | return -EFAULT; |
524 | sp &= ~15; |
525 | #endif |
526 | |
527 | /* |
528 | * If this architecture has a platform capability string, copy it |
529 | * to userspace. In some cases (Sparc), this info is impossible |
530 | * for userspace to get any other way, in others (i386) it is |
531 | * merely difficult. |
532 | */ |
533 | k_platform = ELF_PLATFORM; |
534 | u_platform = NULL; |
535 | |
536 | if (k_platform) { |
537 | platform_len = strlen(k_platform) + 1; |
538 | sp -= platform_len; |
539 | u_platform = (char __user *) sp; |
540 | if (copy_to_user(to: u_platform, from: k_platform, n: platform_len) != 0) |
541 | return -EFAULT; |
542 | } |
543 | |
544 | /* |
545 | * If this architecture has a "base" platform capability |
546 | * string, copy it to userspace. |
547 | */ |
548 | k_base_platform = ELF_BASE_PLATFORM; |
549 | u_base_platform = NULL; |
550 | |
551 | if (k_base_platform) { |
552 | platform_len = strlen(k_base_platform) + 1; |
553 | sp -= platform_len; |
554 | u_base_platform = (char __user *) sp; |
555 | if (copy_to_user(to: u_base_platform, from: k_base_platform, n: platform_len) != 0) |
556 | return -EFAULT; |
557 | } |
558 | |
559 | sp &= ~7UL; |
560 | |
561 | /* stack the load map(s) */ |
562 | len = sizeof(struct elf_fdpic_loadmap); |
563 | len += sizeof(struct elf_fdpic_loadseg) * exec_params->loadmap->nsegs; |
564 | sp = (sp - len) & ~7UL; |
565 | exec_params->map_addr = sp; |
566 | |
567 | if (copy_to_user(to: (void __user *) sp, from: exec_params->loadmap, n: len) != 0) |
568 | return -EFAULT; |
569 | |
570 | current->mm->context.exec_fdpic_loadmap = (unsigned long) sp; |
571 | |
572 | if (interp_params->loadmap) { |
573 | len = sizeof(struct elf_fdpic_loadmap); |
574 | len += sizeof(struct elf_fdpic_loadseg) * |
575 | interp_params->loadmap->nsegs; |
576 | sp = (sp - len) & ~7UL; |
577 | interp_params->map_addr = sp; |
578 | |
579 | if (copy_to_user(to: (void __user *) sp, from: interp_params->loadmap, |
580 | n: len) != 0) |
581 | return -EFAULT; |
582 | |
583 | current->mm->context.interp_fdpic_loadmap = (unsigned long) sp; |
584 | } |
585 | |
586 | /* force 16 byte _final_ alignment here for generality */ |
587 | #define DLINFO_ITEMS 15 |
588 | |
589 | nitems = 1 + DLINFO_ITEMS + (k_platform ? 1 : 0) + |
590 | (k_base_platform ? 1 : 0) + AT_VECTOR_SIZE_ARCH; |
591 | |
592 | if (bprm->have_execfd) |
593 | nitems++; |
594 | |
595 | csp = sp; |
596 | sp -= nitems * 2 * sizeof(unsigned long); |
597 | sp -= (bprm->envc + 1) * sizeof(char *); /* envv[] */ |
598 | sp -= (bprm->argc + 1) * sizeof(char *); /* argv[] */ |
599 | sp -= 1 * sizeof(unsigned long); /* argc */ |
600 | |
601 | csp -= sp & 15UL; |
602 | sp -= sp & 15UL; |
603 | |
604 | /* put the ELF interpreter info on the stack */ |
605 | #define NEW_AUX_ENT(id, val) \ |
606 | do { \ |
607 | struct { unsigned long _id, _val; } __user *ent, v; \ |
608 | \ |
609 | ent = (void __user *) csp; \ |
610 | v._id = (id); \ |
611 | v._val = (val); \ |
612 | if (copy_to_user(ent + nr, &v, sizeof(v))) \ |
613 | return -EFAULT; \ |
614 | nr++; \ |
615 | } while (0) |
616 | |
617 | nr = 0; |
618 | csp -= 2 * sizeof(unsigned long); |
619 | NEW_AUX_ENT(AT_NULL, 0); |
620 | if (k_platform) { |
621 | nr = 0; |
622 | csp -= 2 * sizeof(unsigned long); |
623 | NEW_AUX_ENT(AT_PLATFORM, |
624 | (elf_addr_t) (unsigned long) u_platform); |
625 | } |
626 | |
627 | if (k_base_platform) { |
628 | nr = 0; |
629 | csp -= 2 * sizeof(unsigned long); |
630 | NEW_AUX_ENT(AT_BASE_PLATFORM, |
631 | (elf_addr_t) (unsigned long) u_base_platform); |
632 | } |
633 | |
634 | if (bprm->have_execfd) { |
635 | nr = 0; |
636 | csp -= 2 * sizeof(unsigned long); |
637 | NEW_AUX_ENT(AT_EXECFD, bprm->execfd); |
638 | } |
639 | |
640 | nr = 0; |
641 | csp -= DLINFO_ITEMS * 2 * sizeof(unsigned long); |
642 | NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP); |
643 | #ifdef ELF_HWCAP2 |
644 | NEW_AUX_ENT(AT_HWCAP2, ELF_HWCAP2); |
645 | #endif |
646 | NEW_AUX_ENT(AT_PAGESZ, PAGE_SIZE); |
647 | NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC); |
648 | NEW_AUX_ENT(AT_PHDR, exec_params->ph_addr); |
649 | NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr)); |
650 | NEW_AUX_ENT(AT_PHNUM, exec_params->hdr.e_phnum); |
651 | NEW_AUX_ENT(AT_BASE, interp_params->elfhdr_addr); |
652 | if (bprm->interp_flags & BINPRM_FLAGS_PRESERVE_ARGV0) |
653 | flags |= AT_FLAGS_PRESERVE_ARGV0; |
654 | NEW_AUX_ENT(AT_FLAGS, flags); |
655 | NEW_AUX_ENT(AT_ENTRY, exec_params->entry_addr); |
656 | NEW_AUX_ENT(AT_UID, (elf_addr_t) from_kuid_munged(cred->user_ns, cred->uid)); |
657 | NEW_AUX_ENT(AT_EUID, (elf_addr_t) from_kuid_munged(cred->user_ns, cred->euid)); |
658 | NEW_AUX_ENT(AT_GID, (elf_addr_t) from_kgid_munged(cred->user_ns, cred->gid)); |
659 | NEW_AUX_ENT(AT_EGID, (elf_addr_t) from_kgid_munged(cred->user_ns, cred->egid)); |
660 | NEW_AUX_ENT(AT_SECURE, bprm->secureexec); |
661 | NEW_AUX_ENT(AT_EXECFN, bprm->exec); |
662 | |
663 | #ifdef ARCH_DLINFO |
664 | nr = 0; |
665 | csp -= AT_VECTOR_SIZE_ARCH * 2 * sizeof(unsigned long); |
666 | |
667 | /* ARCH_DLINFO must come last so platform specific code can enforce |
668 | * special alignment requirements on the AUXV if necessary (eg. PPC). |
669 | */ |
670 | ARCH_DLINFO; |
671 | #endif |
672 | #undef NEW_AUX_ENT |
673 | |
674 | /* allocate room for argv[] and envv[] */ |
675 | csp -= (bprm->envc + 1) * sizeof(elf_caddr_t); |
676 | envp = (elf_caddr_t __user *) csp; |
677 | csp -= (bprm->argc + 1) * sizeof(elf_caddr_t); |
678 | argv = (elf_caddr_t __user *) csp; |
679 | |
680 | /* stack argc */ |
681 | csp -= sizeof(unsigned long); |
682 | if (put_user(bprm->argc, (unsigned long __user *) csp)) |
683 | return -EFAULT; |
684 | |
685 | BUG_ON(csp != sp); |
686 | |
687 | /* fill in the argv[] array */ |
688 | #ifdef CONFIG_MMU |
689 | current->mm->arg_start = bprm->p; |
690 | #else |
691 | current->mm->arg_start = current->mm->start_stack - |
692 | (MAX_ARG_PAGES * PAGE_SIZE - bprm->p); |
693 | #endif |
694 | |
695 | p = (char __user *) current->mm->arg_start; |
696 | for (loop = bprm->argc; loop > 0; loop--) { |
697 | if (put_user((elf_caddr_t) p, argv++)) |
698 | return -EFAULT; |
699 | len = strnlen_user(str: p, MAX_ARG_STRLEN); |
700 | if (!len || len > MAX_ARG_STRLEN) |
701 | return -EINVAL; |
702 | p += len; |
703 | } |
704 | if (put_user(NULL, argv)) |
705 | return -EFAULT; |
706 | current->mm->arg_end = (unsigned long) p; |
707 | |
708 | /* fill in the envv[] array */ |
709 | current->mm->env_start = (unsigned long) p; |
710 | for (loop = bprm->envc; loop > 0; loop--) { |
711 | if (put_user((elf_caddr_t)(unsigned long) p, envp++)) |
712 | return -EFAULT; |
713 | len = strnlen_user(str: p, MAX_ARG_STRLEN); |
714 | if (!len || len > MAX_ARG_STRLEN) |
715 | return -EINVAL; |
716 | p += len; |
717 | } |
718 | if (put_user(NULL, envp)) |
719 | return -EFAULT; |
720 | current->mm->env_end = (unsigned long) p; |
721 | |
722 | mm->start_stack = (unsigned long) sp; |
723 | return 0; |
724 | } |
725 | |
726 | /*****************************************************************************/ |
727 | /* |
728 | * load the appropriate binary image (executable or interpreter) into memory |
729 | * - we assume no MMU is available |
730 | * - if no other PIC bits are set in params->hdr->e_flags |
731 | * - we assume that the LOADable segments in the binary are independently relocatable |
732 | * - we assume R/O executable segments are shareable |
733 | * - else |
734 | * - we assume the loadable parts of the image to require fixed displacement |
735 | * - the image is not shareable |
736 | */ |
737 | static int elf_fdpic_map_file(struct elf_fdpic_params *params, |
738 | struct file *file, |
739 | struct mm_struct *mm, |
740 | const char *what) |
741 | { |
742 | struct elf_fdpic_loadmap *loadmap; |
743 | #ifdef CONFIG_MMU |
744 | struct elf_fdpic_loadseg *mseg; |
745 | unsigned long load_addr; |
746 | #endif |
747 | struct elf_fdpic_loadseg *seg; |
748 | struct elf_phdr *phdr; |
749 | unsigned nloads, tmp; |
750 | unsigned long stop; |
751 | int loop, ret; |
752 | |
753 | /* allocate a load map table */ |
754 | nloads = 0; |
755 | for (loop = 0; loop < params->hdr.e_phnum; loop++) |
756 | if (params->phdrs[loop].p_type == PT_LOAD) |
757 | nloads++; |
758 | |
759 | if (nloads == 0) |
760 | return -ELIBBAD; |
761 | |
762 | loadmap = kzalloc(struct_size(loadmap, segs, nloads), GFP_KERNEL); |
763 | if (!loadmap) |
764 | return -ENOMEM; |
765 | |
766 | params->loadmap = loadmap; |
767 | |
768 | loadmap->version = ELF_FDPIC_LOADMAP_VERSION; |
769 | loadmap->nsegs = nloads; |
770 | |
771 | /* map the requested LOADs into the memory space */ |
772 | switch (params->flags & ELF_FDPIC_FLAG_ARRANGEMENT) { |
773 | case ELF_FDPIC_FLAG_CONSTDISP: |
774 | case ELF_FDPIC_FLAG_CONTIGUOUS: |
775 | #ifndef CONFIG_MMU |
776 | ret = elf_fdpic_map_file_constdisp_on_uclinux(params, file, mm); |
777 | if (ret < 0) |
778 | return ret; |
779 | break; |
780 | #endif |
781 | default: |
782 | ret = elf_fdpic_map_file_by_direct_mmap(params, file, mm); |
783 | if (ret < 0) |
784 | return ret; |
785 | break; |
786 | } |
787 | |
788 | /* map the entry point */ |
789 | if (params->hdr.e_entry) { |
790 | seg = loadmap->segs; |
791 | for (loop = loadmap->nsegs; loop > 0; loop--, seg++) { |
792 | if (params->hdr.e_entry >= seg->p_vaddr && |
793 | params->hdr.e_entry < seg->p_vaddr + seg->p_memsz) { |
794 | params->entry_addr = |
795 | (params->hdr.e_entry - seg->p_vaddr) + |
796 | seg->addr; |
797 | break; |
798 | } |
799 | } |
800 | } |
801 | |
802 | /* determine where the program header table has wound up if mapped */ |
803 | stop = params->hdr.e_phoff; |
804 | stop += params->hdr.e_phnum * sizeof (struct elf_phdr); |
805 | phdr = params->phdrs; |
806 | |
807 | for (loop = 0; loop < params->hdr.e_phnum; loop++, phdr++) { |
808 | if (phdr->p_type != PT_LOAD) |
809 | continue; |
810 | |
811 | if (phdr->p_offset > params->hdr.e_phoff || |
812 | phdr->p_offset + phdr->p_filesz < stop) |
813 | continue; |
814 | |
815 | seg = loadmap->segs; |
816 | for (loop = loadmap->nsegs; loop > 0; loop--, seg++) { |
817 | if (phdr->p_vaddr >= seg->p_vaddr && |
818 | phdr->p_vaddr + phdr->p_filesz <= |
819 | seg->p_vaddr + seg->p_memsz) { |
820 | params->ph_addr = |
821 | (phdr->p_vaddr - seg->p_vaddr) + |
822 | seg->addr + |
823 | params->hdr.e_phoff - phdr->p_offset; |
824 | break; |
825 | } |
826 | } |
827 | break; |
828 | } |
829 | |
830 | /* determine where the dynamic section has wound up if there is one */ |
831 | phdr = params->phdrs; |
832 | for (loop = 0; loop < params->hdr.e_phnum; loop++, phdr++) { |
833 | if (phdr->p_type != PT_DYNAMIC) |
834 | continue; |
835 | |
836 | seg = loadmap->segs; |
837 | for (loop = loadmap->nsegs; loop > 0; loop--, seg++) { |
838 | if (phdr->p_vaddr >= seg->p_vaddr && |
839 | phdr->p_vaddr + phdr->p_memsz <= |
840 | seg->p_vaddr + seg->p_memsz) { |
841 | Elf_Dyn __user *dyn; |
842 | Elf_Sword d_tag; |
843 | |
844 | params->dynamic_addr = |
845 | (phdr->p_vaddr - seg->p_vaddr) + |
846 | seg->addr; |
847 | |
848 | /* check the dynamic section contains at least |
849 | * one item, and that the last item is a NULL |
850 | * entry */ |
851 | if (phdr->p_memsz == 0 || |
852 | phdr->p_memsz % sizeof(Elf_Dyn) != 0) |
853 | goto dynamic_error; |
854 | |
855 | tmp = phdr->p_memsz / sizeof(Elf_Dyn); |
856 | dyn = (Elf_Dyn __user *)params->dynamic_addr; |
857 | if (get_user(d_tag, &dyn[tmp - 1].d_tag) || |
858 | d_tag != 0) |
859 | goto dynamic_error; |
860 | break; |
861 | } |
862 | } |
863 | break; |
864 | } |
865 | |
866 | /* now elide adjacent segments in the load map on MMU linux |
867 | * - on uClinux the holes between may actually be filled with system |
868 | * stuff or stuff from other processes |
869 | */ |
870 | #ifdef CONFIG_MMU |
871 | nloads = loadmap->nsegs; |
872 | mseg = loadmap->segs; |
873 | seg = mseg + 1; |
874 | for (loop = 1; loop < nloads; loop++) { |
875 | /* see if we have a candidate for merging */ |
876 | if (seg->p_vaddr - mseg->p_vaddr == seg->addr - mseg->addr) { |
877 | load_addr = PAGE_ALIGN(mseg->addr + mseg->p_memsz); |
878 | if (load_addr == (seg->addr & PAGE_MASK)) { |
879 | mseg->p_memsz += |
880 | load_addr - |
881 | (mseg->addr + mseg->p_memsz); |
882 | mseg->p_memsz += seg->addr & ~PAGE_MASK; |
883 | mseg->p_memsz += seg->p_memsz; |
884 | loadmap->nsegs--; |
885 | continue; |
886 | } |
887 | } |
888 | |
889 | mseg++; |
890 | if (mseg != seg) |
891 | *mseg = *seg; |
892 | } |
893 | #endif |
894 | |
895 | kdebug("Mapped Object [%s]:" , what); |
896 | kdebug("- elfhdr : %lx" , params->elfhdr_addr); |
897 | kdebug("- entry : %lx" , params->entry_addr); |
898 | kdebug("- PHDR[] : %lx" , params->ph_addr); |
899 | kdebug("- DYNAMIC[]: %lx" , params->dynamic_addr); |
900 | seg = loadmap->segs; |
901 | for (loop = 0; loop < loadmap->nsegs; loop++, seg++) |
902 | kdebug("- LOAD[%d] : %08llx-%08llx [va=%llx ms=%llx]" , |
903 | loop, |
904 | (unsigned long long) seg->addr, |
905 | (unsigned long long) seg->addr + seg->p_memsz - 1, |
906 | (unsigned long long) seg->p_vaddr, |
907 | (unsigned long long) seg->p_memsz); |
908 | |
909 | return 0; |
910 | |
911 | dynamic_error: |
912 | printk("ELF FDPIC %s with invalid DYNAMIC section (inode=%lu)\n" , |
913 | what, file_inode(file)->i_ino); |
914 | return -ELIBBAD; |
915 | } |
916 | |
917 | /*****************************************************************************/ |
918 | /* |
919 | * map a file with constant displacement under uClinux |
920 | */ |
921 | #ifndef CONFIG_MMU |
922 | static int elf_fdpic_map_file_constdisp_on_uclinux( |
923 | struct elf_fdpic_params *params, |
924 | struct file *file, |
925 | struct mm_struct *mm) |
926 | { |
927 | struct elf_fdpic_loadseg *seg; |
928 | struct elf_phdr *phdr; |
929 | unsigned long load_addr, base = ULONG_MAX, top = 0, maddr = 0; |
930 | int loop, ret; |
931 | |
932 | load_addr = params->load_addr; |
933 | seg = params->loadmap->segs; |
934 | |
935 | /* determine the bounds of the contiguous overall allocation we must |
936 | * make */ |
937 | phdr = params->phdrs; |
938 | for (loop = 0; loop < params->hdr.e_phnum; loop++, phdr++) { |
939 | if (params->phdrs[loop].p_type != PT_LOAD) |
940 | continue; |
941 | |
942 | if (base > phdr->p_vaddr) |
943 | base = phdr->p_vaddr; |
944 | if (top < phdr->p_vaddr + phdr->p_memsz) |
945 | top = phdr->p_vaddr + phdr->p_memsz; |
946 | } |
947 | |
948 | /* allocate one big anon block for everything */ |
949 | maddr = vm_mmap(NULL, load_addr, top - base, |
950 | PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE, 0); |
951 | if (IS_ERR_VALUE(maddr)) |
952 | return (int) maddr; |
953 | |
954 | if (load_addr != 0) |
955 | load_addr += PAGE_ALIGN(top - base); |
956 | |
957 | /* and then load the file segments into it */ |
958 | phdr = params->phdrs; |
959 | for (loop = 0; loop < params->hdr.e_phnum; loop++, phdr++) { |
960 | if (params->phdrs[loop].p_type != PT_LOAD) |
961 | continue; |
962 | |
963 | seg->addr = maddr + (phdr->p_vaddr - base); |
964 | seg->p_vaddr = phdr->p_vaddr; |
965 | seg->p_memsz = phdr->p_memsz; |
966 | |
967 | ret = read_code(file, seg->addr, phdr->p_offset, |
968 | phdr->p_filesz); |
969 | if (ret < 0) |
970 | return ret; |
971 | |
972 | /* map the ELF header address if in this segment */ |
973 | if (phdr->p_offset == 0) |
974 | params->elfhdr_addr = seg->addr; |
975 | |
976 | /* clear any space allocated but not loaded */ |
977 | if (phdr->p_filesz < phdr->p_memsz) { |
978 | if (clear_user((void *) (seg->addr + phdr->p_filesz), |
979 | phdr->p_memsz - phdr->p_filesz)) |
980 | return -EFAULT; |
981 | } |
982 | |
983 | if (mm) { |
984 | if (phdr->p_flags & PF_X) { |
985 | if (!mm->start_code) { |
986 | mm->start_code = seg->addr; |
987 | mm->end_code = seg->addr + |
988 | phdr->p_memsz; |
989 | } |
990 | } else if (!mm->start_data) { |
991 | mm->start_data = seg->addr; |
992 | mm->end_data = seg->addr + phdr->p_memsz; |
993 | } |
994 | } |
995 | |
996 | seg++; |
997 | } |
998 | |
999 | return 0; |
1000 | } |
1001 | #endif |
1002 | |
1003 | /*****************************************************************************/ |
1004 | /* |
1005 | * map a binary by direct mmap() of the individual PT_LOAD segments |
1006 | */ |
1007 | static int elf_fdpic_map_file_by_direct_mmap(struct elf_fdpic_params *params, |
1008 | struct file *file, |
1009 | struct mm_struct *mm) |
1010 | { |
1011 | struct elf_fdpic_loadseg *seg; |
1012 | struct elf_phdr *phdr; |
1013 | unsigned long load_addr, delta_vaddr; |
1014 | int loop, dvset; |
1015 | |
1016 | load_addr = params->load_addr; |
1017 | delta_vaddr = 0; |
1018 | dvset = 0; |
1019 | |
1020 | seg = params->loadmap->segs; |
1021 | |
1022 | /* deal with each load segment separately */ |
1023 | phdr = params->phdrs; |
1024 | for (loop = 0; loop < params->hdr.e_phnum; loop++, phdr++) { |
1025 | unsigned long maddr, disp, excess, excess1; |
1026 | int prot = 0, flags; |
1027 | |
1028 | if (phdr->p_type != PT_LOAD) |
1029 | continue; |
1030 | |
1031 | kdebug("[LOAD] va=%lx of=%lx fs=%lx ms=%lx" , |
1032 | (unsigned long) phdr->p_vaddr, |
1033 | (unsigned long) phdr->p_offset, |
1034 | (unsigned long) phdr->p_filesz, |
1035 | (unsigned long) phdr->p_memsz); |
1036 | |
1037 | /* determine the mapping parameters */ |
1038 | if (phdr->p_flags & PF_R) prot |= PROT_READ; |
1039 | if (phdr->p_flags & PF_W) prot |= PROT_WRITE; |
1040 | if (phdr->p_flags & PF_X) prot |= PROT_EXEC; |
1041 | |
1042 | flags = MAP_PRIVATE; |
1043 | maddr = 0; |
1044 | |
1045 | switch (params->flags & ELF_FDPIC_FLAG_ARRANGEMENT) { |
1046 | case ELF_FDPIC_FLAG_INDEPENDENT: |
1047 | /* PT_LOADs are independently locatable */ |
1048 | break; |
1049 | |
1050 | case ELF_FDPIC_FLAG_HONOURVADDR: |
1051 | /* the specified virtual address must be honoured */ |
1052 | maddr = phdr->p_vaddr; |
1053 | flags |= MAP_FIXED; |
1054 | break; |
1055 | |
1056 | case ELF_FDPIC_FLAG_CONSTDISP: |
1057 | /* constant displacement |
1058 | * - can be mapped anywhere, but must be mapped as a |
1059 | * unit |
1060 | */ |
1061 | if (!dvset) { |
1062 | maddr = load_addr; |
1063 | delta_vaddr = phdr->p_vaddr; |
1064 | dvset = 1; |
1065 | } else { |
1066 | maddr = load_addr + phdr->p_vaddr - delta_vaddr; |
1067 | flags |= MAP_FIXED; |
1068 | } |
1069 | break; |
1070 | |
1071 | case ELF_FDPIC_FLAG_CONTIGUOUS: |
1072 | /* contiguity handled later */ |
1073 | break; |
1074 | |
1075 | default: |
1076 | BUG(); |
1077 | } |
1078 | |
1079 | maddr &= PAGE_MASK; |
1080 | |
1081 | /* create the mapping */ |
1082 | disp = phdr->p_vaddr & ~PAGE_MASK; |
1083 | maddr = vm_mmap(file, maddr, phdr->p_memsz + disp, prot, flags, |
1084 | phdr->p_offset - disp); |
1085 | |
1086 | kdebug("mmap[%d] <file> sz=%llx pr=%x fl=%x of=%llx --> %08lx" , |
1087 | loop, (unsigned long long) phdr->p_memsz + disp, |
1088 | prot, flags, (unsigned long long) phdr->p_offset - disp, |
1089 | maddr); |
1090 | |
1091 | if (IS_ERR_VALUE(maddr)) |
1092 | return (int) maddr; |
1093 | |
1094 | if ((params->flags & ELF_FDPIC_FLAG_ARRANGEMENT) == |
1095 | ELF_FDPIC_FLAG_CONTIGUOUS) |
1096 | load_addr += PAGE_ALIGN(phdr->p_memsz + disp); |
1097 | |
1098 | seg->addr = maddr + disp; |
1099 | seg->p_vaddr = phdr->p_vaddr; |
1100 | seg->p_memsz = phdr->p_memsz; |
1101 | |
1102 | /* map the ELF header address if in this segment */ |
1103 | if (phdr->p_offset == 0) |
1104 | params->elfhdr_addr = seg->addr; |
1105 | |
1106 | /* clear the bit between beginning of mapping and beginning of |
1107 | * PT_LOAD */ |
1108 | if (prot & PROT_WRITE && disp > 0) { |
1109 | kdebug("clear[%d] ad=%lx sz=%lx" , loop, maddr, disp); |
1110 | if (clear_user(to: (void __user *) maddr, n: disp)) |
1111 | return -EFAULT; |
1112 | maddr += disp; |
1113 | } |
1114 | |
1115 | /* clear any space allocated but not loaded |
1116 | * - on uClinux we can just clear the lot |
1117 | * - on MMU linux we'll get a SIGBUS beyond the last page |
1118 | * extant in the file |
1119 | */ |
1120 | excess = phdr->p_memsz - phdr->p_filesz; |
1121 | excess1 = PAGE_SIZE - ((maddr + phdr->p_filesz) & ~PAGE_MASK); |
1122 | |
1123 | #ifdef CONFIG_MMU |
1124 | if (excess > excess1) { |
1125 | unsigned long xaddr = maddr + phdr->p_filesz + excess1; |
1126 | unsigned long xmaddr; |
1127 | |
1128 | flags |= MAP_FIXED | MAP_ANONYMOUS; |
1129 | xmaddr = vm_mmap(NULL, xaddr, excess - excess1, |
1130 | prot, flags, 0); |
1131 | |
1132 | kdebug("mmap[%d] <anon>" |
1133 | " ad=%lx sz=%lx pr=%x fl=%x of=0 --> %08lx" , |
1134 | loop, xaddr, excess - excess1, prot, flags, |
1135 | xmaddr); |
1136 | |
1137 | if (xmaddr != xaddr) |
1138 | return -ENOMEM; |
1139 | } |
1140 | |
1141 | if (prot & PROT_WRITE && excess1 > 0) { |
1142 | kdebug("clear[%d] ad=%lx sz=%lx" , |
1143 | loop, maddr + phdr->p_filesz, excess1); |
1144 | if (clear_user(to: (void __user *) maddr + phdr->p_filesz, |
1145 | n: excess1)) |
1146 | return -EFAULT; |
1147 | } |
1148 | |
1149 | #else |
1150 | if (excess > 0) { |
1151 | kdebug("clear[%d] ad=%llx sz=%lx" , loop, |
1152 | (unsigned long long) maddr + phdr->p_filesz, |
1153 | excess); |
1154 | if (clear_user((void *) maddr + phdr->p_filesz, excess)) |
1155 | return -EFAULT; |
1156 | } |
1157 | #endif |
1158 | |
1159 | if (mm) { |
1160 | if (phdr->p_flags & PF_X) { |
1161 | if (!mm->start_code) { |
1162 | mm->start_code = maddr; |
1163 | mm->end_code = maddr + phdr->p_memsz; |
1164 | } |
1165 | } else if (!mm->start_data) { |
1166 | mm->start_data = maddr; |
1167 | mm->end_data = maddr + phdr->p_memsz; |
1168 | } |
1169 | } |
1170 | |
1171 | seg++; |
1172 | } |
1173 | |
1174 | return 0; |
1175 | } |
1176 | |
1177 | /*****************************************************************************/ |
1178 | /* |
1179 | * ELF-FDPIC core dumper |
1180 | * |
1181 | * Modelled on fs/exec.c:aout_core_dump() |
1182 | * Jeremy Fitzhardinge <jeremy@sw.oz.au> |
1183 | * |
1184 | * Modelled on fs/binfmt_elf.c core dumper |
1185 | */ |
1186 | #ifdef CONFIG_ELF_CORE |
1187 | |
1188 | struct elf_prstatus_fdpic |
1189 | { |
1190 | struct elf_prstatus_common common; |
1191 | elf_gregset_t pr_reg; /* GP registers */ |
1192 | /* When using FDPIC, the loadmap addresses need to be communicated |
1193 | * to GDB in order for GDB to do the necessary relocations. The |
1194 | * fields (below) used to communicate this information are placed |
1195 | * immediately after ``pr_reg'', so that the loadmap addresses may |
1196 | * be viewed as part of the register set if so desired. |
1197 | */ |
1198 | unsigned long pr_exec_fdpic_loadmap; |
1199 | unsigned long pr_interp_fdpic_loadmap; |
1200 | int pr_fpvalid; /* True if math co-processor being used. */ |
1201 | }; |
1202 | |
1203 | /* An ELF note in memory */ |
1204 | struct memelfnote |
1205 | { |
1206 | const char *name; |
1207 | int type; |
1208 | unsigned int datasz; |
1209 | void *data; |
1210 | }; |
1211 | |
1212 | static int notesize(struct memelfnote *en) |
1213 | { |
1214 | int sz; |
1215 | |
1216 | sz = sizeof(struct elf_note); |
1217 | sz += roundup(strlen(en->name) + 1, 4); |
1218 | sz += roundup(en->datasz, 4); |
1219 | |
1220 | return sz; |
1221 | } |
1222 | |
1223 | /* #define DEBUG */ |
1224 | |
1225 | static int writenote(struct memelfnote *men, struct coredump_params *cprm) |
1226 | { |
1227 | struct elf_note en; |
1228 | en.n_namesz = strlen(men->name) + 1; |
1229 | en.n_descsz = men->datasz; |
1230 | en.n_type = men->type; |
1231 | |
1232 | return dump_emit(cprm, addr: &en, nr: sizeof(en)) && |
1233 | dump_emit(cprm, addr: men->name, nr: en.n_namesz) && dump_align(cprm, align: 4) && |
1234 | dump_emit(cprm, addr: men->data, nr: men->datasz) && dump_align(cprm, align: 4); |
1235 | } |
1236 | |
1237 | static inline void (struct elfhdr *elf, int segs) |
1238 | { |
1239 | memcpy(elf->e_ident, ELFMAG, SELFMAG); |
1240 | elf->e_ident[EI_CLASS] = ELF_CLASS; |
1241 | elf->e_ident[EI_DATA] = ELF_DATA; |
1242 | elf->e_ident[EI_VERSION] = EV_CURRENT; |
1243 | elf->e_ident[EI_OSABI] = ELF_OSABI; |
1244 | memset(elf->e_ident+EI_PAD, 0, EI_NIDENT-EI_PAD); |
1245 | |
1246 | elf->e_type = ET_CORE; |
1247 | elf->e_machine = ELF_ARCH; |
1248 | elf->e_version = EV_CURRENT; |
1249 | elf->e_entry = 0; |
1250 | elf->e_phoff = sizeof(struct elfhdr); |
1251 | elf->e_shoff = 0; |
1252 | elf->e_flags = ELF_FDPIC_CORE_EFLAGS; |
1253 | elf->e_ehsize = sizeof(struct elfhdr); |
1254 | elf->e_phentsize = sizeof(struct elf_phdr); |
1255 | elf->e_phnum = segs; |
1256 | elf->e_shentsize = 0; |
1257 | elf->e_shnum = 0; |
1258 | elf->e_shstrndx = 0; |
1259 | return; |
1260 | } |
1261 | |
1262 | static inline void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset) |
1263 | { |
1264 | phdr->p_type = PT_NOTE; |
1265 | phdr->p_offset = offset; |
1266 | phdr->p_vaddr = 0; |
1267 | phdr->p_paddr = 0; |
1268 | phdr->p_filesz = sz; |
1269 | phdr->p_memsz = 0; |
1270 | phdr->p_flags = 0; |
1271 | phdr->p_align = 4; |
1272 | return; |
1273 | } |
1274 | |
1275 | static inline void fill_note(struct memelfnote *note, const char *name, int type, |
1276 | unsigned int sz, void *data) |
1277 | { |
1278 | note->name = name; |
1279 | note->type = type; |
1280 | note->datasz = sz; |
1281 | note->data = data; |
1282 | return; |
1283 | } |
1284 | |
1285 | /* |
1286 | * fill up all the fields in prstatus from the given task struct, except |
1287 | * registers which need to be filled up separately. |
1288 | */ |
1289 | static void fill_prstatus(struct elf_prstatus_common *prstatus, |
1290 | struct task_struct *p, long signr) |
1291 | { |
1292 | prstatus->pr_info.si_signo = prstatus->pr_cursig = signr; |
1293 | prstatus->pr_sigpend = p->pending.signal.sig[0]; |
1294 | prstatus->pr_sighold = p->blocked.sig[0]; |
1295 | rcu_read_lock(); |
1296 | prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent)); |
1297 | rcu_read_unlock(); |
1298 | prstatus->pr_pid = task_pid_vnr(tsk: p); |
1299 | prstatus->pr_pgrp = task_pgrp_vnr(tsk: p); |
1300 | prstatus->pr_sid = task_session_vnr(tsk: p); |
1301 | if (thread_group_leader(p)) { |
1302 | struct task_cputime cputime; |
1303 | |
1304 | /* |
1305 | * This is the record for the group leader. It shows the |
1306 | * group-wide total, not its individual thread total. |
1307 | */ |
1308 | thread_group_cputime(tsk: p, times: &cputime); |
1309 | prstatus->pr_utime = ns_to_kernel_old_timeval(nsec: cputime.utime); |
1310 | prstatus->pr_stime = ns_to_kernel_old_timeval(nsec: cputime.stime); |
1311 | } else { |
1312 | u64 utime, stime; |
1313 | |
1314 | task_cputime(t: p, utime: &utime, stime: &stime); |
1315 | prstatus->pr_utime = ns_to_kernel_old_timeval(nsec: utime); |
1316 | prstatus->pr_stime = ns_to_kernel_old_timeval(nsec: stime); |
1317 | } |
1318 | prstatus->pr_cutime = ns_to_kernel_old_timeval(nsec: p->signal->cutime); |
1319 | prstatus->pr_cstime = ns_to_kernel_old_timeval(nsec: p->signal->cstime); |
1320 | } |
1321 | |
1322 | static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p, |
1323 | struct mm_struct *mm) |
1324 | { |
1325 | const struct cred *cred; |
1326 | unsigned int i, len; |
1327 | unsigned int state; |
1328 | |
1329 | /* first copy the parameters from user space */ |
1330 | memset(psinfo, 0, sizeof(struct elf_prpsinfo)); |
1331 | |
1332 | len = mm->arg_end - mm->arg_start; |
1333 | if (len >= ELF_PRARGSZ) |
1334 | len = ELF_PRARGSZ - 1; |
1335 | if (copy_from_user(to: &psinfo->pr_psargs, |
1336 | from: (const char __user *) mm->arg_start, n: len)) |
1337 | return -EFAULT; |
1338 | for (i = 0; i < len; i++) |
1339 | if (psinfo->pr_psargs[i] == 0) |
1340 | psinfo->pr_psargs[i] = ' '; |
1341 | psinfo->pr_psargs[len] = 0; |
1342 | |
1343 | rcu_read_lock(); |
1344 | psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent)); |
1345 | rcu_read_unlock(); |
1346 | psinfo->pr_pid = task_pid_vnr(tsk: p); |
1347 | psinfo->pr_pgrp = task_pgrp_vnr(tsk: p); |
1348 | psinfo->pr_sid = task_session_vnr(tsk: p); |
1349 | |
1350 | state = READ_ONCE(p->__state); |
1351 | i = state ? ffz(~state) + 1 : 0; |
1352 | psinfo->pr_state = i; |
1353 | psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW" [i]; |
1354 | psinfo->pr_zomb = psinfo->pr_sname == 'Z'; |
1355 | psinfo->pr_nice = task_nice(p); |
1356 | psinfo->pr_flag = p->flags; |
1357 | rcu_read_lock(); |
1358 | cred = __task_cred(p); |
1359 | SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid)); |
1360 | SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid)); |
1361 | rcu_read_unlock(); |
1362 | strncpy(p: psinfo->pr_fname, q: p->comm, size: sizeof(psinfo->pr_fname)); |
1363 | |
1364 | return 0; |
1365 | } |
1366 | |
1367 | /* Here is the structure in which status of each thread is captured. */ |
1368 | struct elf_thread_status |
1369 | { |
1370 | struct elf_thread_status *next; |
1371 | struct elf_prstatus_fdpic prstatus; /* NT_PRSTATUS */ |
1372 | elf_fpregset_t fpu; /* NT_PRFPREG */ |
1373 | struct memelfnote notes[2]; |
1374 | int num_notes; |
1375 | }; |
1376 | |
1377 | /* |
1378 | * In order to add the specific thread information for the elf file format, |
1379 | * we need to keep a linked list of every thread's pr_status and then create |
1380 | * a single section for them in the final core file. |
1381 | */ |
1382 | static struct elf_thread_status *elf_dump_thread_status(long signr, struct task_struct *p, int *sz) |
1383 | { |
1384 | const struct user_regset_view *view = task_user_regset_view(tsk: p); |
1385 | struct elf_thread_status *t; |
1386 | int i, ret; |
1387 | |
1388 | t = kzalloc(size: sizeof(struct elf_thread_status), GFP_KERNEL); |
1389 | if (!t) |
1390 | return t; |
1391 | |
1392 | fill_prstatus(prstatus: &t->prstatus.common, p, signr); |
1393 | t->prstatus.pr_exec_fdpic_loadmap = p->mm->context.exec_fdpic_loadmap; |
1394 | t->prstatus.pr_interp_fdpic_loadmap = p->mm->context.interp_fdpic_loadmap; |
1395 | regset_get(target: p, regset: &view->regsets[0], |
1396 | size: sizeof(t->prstatus.pr_reg), data: &t->prstatus.pr_reg); |
1397 | |
1398 | fill_note(note: &t->notes[0], name: "CORE" , NT_PRSTATUS, sz: sizeof(t->prstatus), |
1399 | data: &t->prstatus); |
1400 | t->num_notes++; |
1401 | *sz += notesize(en: &t->notes[0]); |
1402 | |
1403 | for (i = 1; i < view->n; ++i) { |
1404 | const struct user_regset *regset = &view->regsets[i]; |
1405 | if (regset->core_note_type != NT_PRFPREG) |
1406 | continue; |
1407 | if (regset->active && regset->active(p, regset) <= 0) |
1408 | continue; |
1409 | ret = regset_get(target: p, regset, size: sizeof(t->fpu), data: &t->fpu); |
1410 | if (ret >= 0) |
1411 | t->prstatus.pr_fpvalid = 1; |
1412 | break; |
1413 | } |
1414 | |
1415 | if (t->prstatus.pr_fpvalid) { |
1416 | fill_note(note: &t->notes[1], name: "CORE" , NT_PRFPREG, sz: sizeof(t->fpu), |
1417 | data: &t->fpu); |
1418 | t->num_notes++; |
1419 | *sz += notesize(en: &t->notes[1]); |
1420 | } |
1421 | return t; |
1422 | } |
1423 | |
1424 | static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum, |
1425 | elf_addr_t e_shoff, int segs) |
1426 | { |
1427 | elf->e_shoff = e_shoff; |
1428 | elf->e_shentsize = sizeof(*shdr4extnum); |
1429 | elf->e_shnum = 1; |
1430 | elf->e_shstrndx = SHN_UNDEF; |
1431 | |
1432 | memset(shdr4extnum, 0, sizeof(*shdr4extnum)); |
1433 | |
1434 | shdr4extnum->sh_type = SHT_NULL; |
1435 | shdr4extnum->sh_size = elf->e_shnum; |
1436 | shdr4extnum->sh_link = elf->e_shstrndx; |
1437 | shdr4extnum->sh_info = segs; |
1438 | } |
1439 | |
1440 | /* |
1441 | * dump the segments for an MMU process |
1442 | */ |
1443 | static bool elf_fdpic_dump_segments(struct coredump_params *cprm, |
1444 | struct core_vma_metadata *vma_meta, |
1445 | int vma_count) |
1446 | { |
1447 | int i; |
1448 | |
1449 | for (i = 0; i < vma_count; i++) { |
1450 | struct core_vma_metadata *meta = vma_meta + i; |
1451 | |
1452 | if (!dump_user_range(cprm, start: meta->start, len: meta->dump_size)) |
1453 | return false; |
1454 | } |
1455 | return true; |
1456 | } |
1457 | |
1458 | /* |
1459 | * Actual dumper |
1460 | * |
1461 | * This is a two-pass process; first we find the offsets of the bits, |
1462 | * and then they are actually written out. If we run out of core limit |
1463 | * we just truncate. |
1464 | */ |
1465 | static int elf_fdpic_core_dump(struct coredump_params *cprm) |
1466 | { |
1467 | int has_dumped = 0; |
1468 | int segs; |
1469 | int i; |
1470 | struct elfhdr *elf = NULL; |
1471 | loff_t offset = 0, dataoff; |
1472 | struct memelfnote psinfo_note, auxv_note; |
1473 | struct elf_prpsinfo *psinfo = NULL; /* NT_PRPSINFO */ |
1474 | struct elf_thread_status *thread_list = NULL; |
1475 | int thread_status_size = 0; |
1476 | elf_addr_t *auxv; |
1477 | struct elf_phdr *phdr4note = NULL; |
1478 | struct elf_shdr *shdr4extnum = NULL; |
1479 | Elf_Half e_phnum; |
1480 | elf_addr_t e_shoff; |
1481 | struct core_thread *ct; |
1482 | struct elf_thread_status *tmp; |
1483 | |
1484 | /* alloc memory for large data structures: too large to be on stack */ |
1485 | elf = kmalloc(size: sizeof(*elf), GFP_KERNEL); |
1486 | if (!elf) |
1487 | goto end_coredump; |
1488 | psinfo = kmalloc(size: sizeof(*psinfo), GFP_KERNEL); |
1489 | if (!psinfo) |
1490 | goto end_coredump; |
1491 | |
1492 | for (ct = current->signal->core_state->dumper.next; |
1493 | ct; ct = ct->next) { |
1494 | tmp = elf_dump_thread_status(signr: cprm->siginfo->si_signo, |
1495 | p: ct->task, sz: &thread_status_size); |
1496 | if (!tmp) |
1497 | goto end_coredump; |
1498 | |
1499 | tmp->next = thread_list; |
1500 | thread_list = tmp; |
1501 | } |
1502 | |
1503 | /* now collect the dump for the current */ |
1504 | tmp = elf_dump_thread_status(signr: cprm->siginfo->si_signo, |
1505 | current, sz: &thread_status_size); |
1506 | if (!tmp) |
1507 | goto end_coredump; |
1508 | tmp->next = thread_list; |
1509 | thread_list = tmp; |
1510 | |
1511 | segs = cprm->vma_count + elf_core_extra_phdrs(cprm); |
1512 | |
1513 | /* for notes section */ |
1514 | segs++; |
1515 | |
1516 | /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid |
1517 | * this, kernel supports extended numbering. Have a look at |
1518 | * include/linux/elf.h for further information. */ |
1519 | e_phnum = segs > PN_XNUM ? PN_XNUM : segs; |
1520 | |
1521 | /* Set up header */ |
1522 | fill_elf_fdpic_header(elf, segs: e_phnum); |
1523 | |
1524 | has_dumped = 1; |
1525 | /* |
1526 | * Set up the notes in similar form to SVR4 core dumps made |
1527 | * with info from their /proc. |
1528 | */ |
1529 | |
1530 | fill_psinfo(psinfo, current->group_leader, current->mm); |
1531 | fill_note(note: &psinfo_note, name: "CORE" , NT_PRPSINFO, sz: sizeof(*psinfo), data: psinfo); |
1532 | thread_status_size += notesize(en: &psinfo_note); |
1533 | |
1534 | auxv = (elf_addr_t *) current->mm->saved_auxv; |
1535 | i = 0; |
1536 | do |
1537 | i += 2; |
1538 | while (auxv[i - 2] != AT_NULL); |
1539 | fill_note(note: &auxv_note, name: "CORE" , NT_AUXV, sz: i * sizeof(elf_addr_t), data: auxv); |
1540 | thread_status_size += notesize(en: &auxv_note); |
1541 | |
1542 | offset = sizeof(*elf); /* ELF header */ |
1543 | offset += segs * sizeof(struct elf_phdr); /* Program headers */ |
1544 | |
1545 | /* Write notes phdr entry */ |
1546 | phdr4note = kmalloc(size: sizeof(*phdr4note), GFP_KERNEL); |
1547 | if (!phdr4note) |
1548 | goto end_coredump; |
1549 | |
1550 | fill_elf_note_phdr(phdr: phdr4note, sz: thread_status_size, offset); |
1551 | offset += thread_status_size; |
1552 | |
1553 | /* Page-align dumped data */ |
1554 | dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE); |
1555 | |
1556 | offset += cprm->vma_data_size; |
1557 | offset += elf_core_extra_data_size(cprm); |
1558 | e_shoff = offset; |
1559 | |
1560 | if (e_phnum == PN_XNUM) { |
1561 | shdr4extnum = kmalloc(size: sizeof(*shdr4extnum), GFP_KERNEL); |
1562 | if (!shdr4extnum) |
1563 | goto end_coredump; |
1564 | fill_extnum_info(elf, shdr4extnum, e_shoff, segs); |
1565 | } |
1566 | |
1567 | offset = dataoff; |
1568 | |
1569 | if (!dump_emit(cprm, addr: elf, nr: sizeof(*elf))) |
1570 | goto end_coredump; |
1571 | |
1572 | if (!dump_emit(cprm, addr: phdr4note, nr: sizeof(*phdr4note))) |
1573 | goto end_coredump; |
1574 | |
1575 | /* write program headers for segments dump */ |
1576 | for (i = 0; i < cprm->vma_count; i++) { |
1577 | struct core_vma_metadata *meta = cprm->vma_meta + i; |
1578 | struct elf_phdr phdr; |
1579 | size_t sz; |
1580 | |
1581 | sz = meta->end - meta->start; |
1582 | |
1583 | phdr.p_type = PT_LOAD; |
1584 | phdr.p_offset = offset; |
1585 | phdr.p_vaddr = meta->start; |
1586 | phdr.p_paddr = 0; |
1587 | phdr.p_filesz = meta->dump_size; |
1588 | phdr.p_memsz = sz; |
1589 | offset += phdr.p_filesz; |
1590 | phdr.p_flags = 0; |
1591 | if (meta->flags & VM_READ) |
1592 | phdr.p_flags |= PF_R; |
1593 | if (meta->flags & VM_WRITE) |
1594 | phdr.p_flags |= PF_W; |
1595 | if (meta->flags & VM_EXEC) |
1596 | phdr.p_flags |= PF_X; |
1597 | phdr.p_align = ELF_EXEC_PAGESIZE; |
1598 | |
1599 | if (!dump_emit(cprm, addr: &phdr, nr: sizeof(phdr))) |
1600 | goto end_coredump; |
1601 | } |
1602 | |
1603 | if (!elf_core_write_extra_phdrs(cprm, offset)) |
1604 | goto end_coredump; |
1605 | |
1606 | /* write out the notes section */ |
1607 | if (!writenote(men: thread_list->notes, cprm)) |
1608 | goto end_coredump; |
1609 | if (!writenote(men: &psinfo_note, cprm)) |
1610 | goto end_coredump; |
1611 | if (!writenote(men: &auxv_note, cprm)) |
1612 | goto end_coredump; |
1613 | for (i = 1; i < thread_list->num_notes; i++) |
1614 | if (!writenote(men: thread_list->notes + i, cprm)) |
1615 | goto end_coredump; |
1616 | |
1617 | /* write out the thread status notes section */ |
1618 | for (tmp = thread_list->next; tmp; tmp = tmp->next) { |
1619 | for (i = 0; i < tmp->num_notes; i++) |
1620 | if (!writenote(men: &tmp->notes[i], cprm)) |
1621 | goto end_coredump; |
1622 | } |
1623 | |
1624 | dump_skip_to(cprm, to: dataoff); |
1625 | |
1626 | if (!elf_fdpic_dump_segments(cprm, vma_meta: cprm->vma_meta, vma_count: cprm->vma_count)) |
1627 | goto end_coredump; |
1628 | |
1629 | if (!elf_core_write_extra_data(cprm)) |
1630 | goto end_coredump; |
1631 | |
1632 | if (e_phnum == PN_XNUM) { |
1633 | if (!dump_emit(cprm, addr: shdr4extnum, nr: sizeof(*shdr4extnum))) |
1634 | goto end_coredump; |
1635 | } |
1636 | |
1637 | if (cprm->file->f_pos != offset) { |
1638 | /* Sanity check */ |
1639 | printk(KERN_WARNING |
1640 | "elf_core_dump: file->f_pos (%lld) != offset (%lld)\n" , |
1641 | cprm->file->f_pos, offset); |
1642 | } |
1643 | |
1644 | end_coredump: |
1645 | while (thread_list) { |
1646 | tmp = thread_list; |
1647 | thread_list = thread_list->next; |
1648 | kfree(objp: tmp); |
1649 | } |
1650 | kfree(objp: phdr4note); |
1651 | kfree(objp: elf); |
1652 | kfree(objp: psinfo); |
1653 | kfree(objp: shdr4extnum); |
1654 | return has_dumped; |
1655 | } |
1656 | |
1657 | #endif /* CONFIG_ELF_CORE */ |
1658 | |