binfmt_elf_fdpic.c 47.2 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0-or-later
Linus Torvalds's avatar
Linus Torvalds committed
2 3
/* binfmt_elf_fdpic.c: FDPIC ELF binary format
 *
4
 * Copyright (C) 2003, 2004, 2006 Red Hat, Inc. All Rights Reserved.
Linus Torvalds's avatar
Linus Torvalds committed
5 6 7 8 9 10 11 12 13
 * Written by David Howells (dhowells@redhat.com)
 * Derived from binfmt_elf.c
 */

#include <linux/module.h>

#include <linux/fs.h>
#include <linux/stat.h>
#include <linux/sched.h>
14 15
#include <linux/sched/coredump.h>
#include <linux/sched/task_stack.h>
16
#include <linux/sched/cputime.h>
Linus Torvalds's avatar
Linus Torvalds committed
17 18 19 20 21 22 23 24 25
#include <linux/mm.h>
#include <linux/mman.h>
#include <linux/errno.h>
#include <linux/signal.h>
#include <linux/binfmts.h>
#include <linux/string.h>
#include <linux/file.h>
#include <linux/fcntl.h>
#include <linux/slab.h>
26
#include <linux/pagemap.h>
27
#include <linux/security.h>
Linus Torvalds's avatar
Linus Torvalds committed
28
#include <linux/highmem.h>
29
#include <linux/highuid.h>
Linus Torvalds's avatar
Linus Torvalds committed
30 31 32 33 34 35
#include <linux/personality.h>
#include <linux/ptrace.h>
#include <linux/init.h>
#include <linux/elf.h>
#include <linux/elf-fdpic.h>
#include <linux/elfcore.h>
36
#include <linux/coredump.h>
37
#include <linux/dax.h>
Linus Torvalds's avatar
Linus Torvalds committed
38

39
#include <linux/uaccess.h>
Linus Torvalds's avatar
Linus Torvalds committed
40 41 42 43 44 45 46 47 48 49 50
#include <asm/param.h>
#include <asm/pgalloc.h>

typedef char *elf_caddr_t;

#if 0
#define kdebug(fmt, ...) printk("FDPIC "fmt"\n" ,##__VA_ARGS__ )
#else
#define kdebug(fmt, ...) do {} while(0)
#endif

51 52 53 54 55 56
#if 0
#define kdcore(fmt, ...) printk("FDPIC "fmt"\n" ,##__VA_ARGS__ )
#else
#define kdcore(fmt, ...) do {} while(0)
#endif

Linus Torvalds's avatar
Linus Torvalds committed
57 58
MODULE_LICENSE("GPL");

59
static int load_elf_fdpic_binary(struct linux_binprm *);
60 61 62
static int elf_fdpic_fetch_phdrs(struct elf_fdpic_params *, struct file *);
static int elf_fdpic_map_file(struct elf_fdpic_params *, struct file *,
			      struct mm_struct *, const char *);
Linus Torvalds's avatar
Linus Torvalds committed
63

64 65 66
static int create_elf_fdpic_tables(struct linux_binprm *, struct mm_struct *,
				   struct elf_fdpic_params *,
				   struct elf_fdpic_params *);
Linus Torvalds's avatar
Linus Torvalds committed
67 68

#ifndef CONFIG_MMU
69 70 71
static int elf_fdpic_map_file_constdisp_on_uclinux(struct elf_fdpic_params *,
						   struct file *,
						   struct mm_struct *);
Linus Torvalds's avatar
Linus Torvalds committed
72 73
#endif

74 75
static int elf_fdpic_map_file_by_direct_mmap(struct elf_fdpic_params *,
					     struct file *, struct mm_struct *);
Linus Torvalds's avatar
Linus Torvalds committed
76

77
#ifdef CONFIG_ELF_CORE
78
static int elf_fdpic_core_dump(struct coredump_params *cprm);
79 80
#endif

Linus Torvalds's avatar
Linus Torvalds committed
81 82 83
static struct linux_binfmt elf_fdpic_format = {
	.module		= THIS_MODULE,
	.load_binary	= load_elf_fdpic_binary,
84
#ifdef CONFIG_ELF_CORE
85 86
	.core_dump	= elf_fdpic_core_dump,
#endif
Linus Torvalds's avatar
Linus Torvalds committed
87 88 89
	.min_coredump	= ELF_EXEC_PAGESIZE,
};

90 91
static int __init init_elf_fdpic_binfmt(void)
{
Al Viro's avatar
Al Viro committed
92 93
	register_binfmt(&elf_fdpic_format);
	return 0;
94
}
Linus Torvalds's avatar
Linus Torvalds committed
95

96 97 98 99 100
static void __exit exit_elf_fdpic_binfmt(void)
{
	unregister_binfmt(&elf_fdpic_format);
}

101
core_initcall(init_elf_fdpic_binfmt);
102
module_exit(exit_elf_fdpic_binfmt);
Linus Torvalds's avatar
Linus Torvalds committed
103

104
static int is_elf(struct elfhdr *hdr, struct file *file)
Linus Torvalds's avatar
Linus Torvalds committed
105 106 107 108 109
{
	if (memcmp(hdr->e_ident, ELFMAG, SELFMAG) != 0)
		return 0;
	if (hdr->e_type != ET_EXEC && hdr->e_type != ET_DYN)
		return 0;
110
	if (!elf_check_arch(hdr))
Linus Torvalds's avatar
Linus Torvalds committed
111
		return 0;
Al Viro's avatar
Al Viro committed
112
	if (!file->f_op->mmap)
Linus Torvalds's avatar
Linus Torvalds committed
113 114 115 116
		return 0;
	return 1;
}

117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133
#ifndef elf_check_fdpic
#define elf_check_fdpic(x) 0
#endif

#ifndef elf_check_const_displacement
#define elf_check_const_displacement(x) 0
#endif

static int is_constdisp(struct elfhdr *hdr)
{
	if (!elf_check_fdpic(hdr))
		return 1;
	if (elf_check_const_displacement(hdr))
		return 1;
	return 0;
}

Linus Torvalds's avatar
Linus Torvalds committed
134 135 136 137
/*****************************************************************************/
/*
 * read the program headers table into memory
 */
138 139
static int elf_fdpic_fetch_phdrs(struct elf_fdpic_params *params,
				 struct file *file)
Linus Torvalds's avatar
Linus Torvalds committed
140 141 142 143
{
	struct elf32_phdr *phdr;
	unsigned long size;
	int retval, loop;
144
	loff_t pos = params->hdr.e_phoff;
Linus Torvalds's avatar
Linus Torvalds committed
145 146 147 148 149 150 151 152 153 154 155

	if (params->hdr.e_phentsize != sizeof(struct elf_phdr))
		return -ENOMEM;
	if (params->hdr.e_phnum > 65536U / sizeof(struct elf_phdr))
		return -ENOMEM;

	size = params->hdr.e_phnum * sizeof(struct elf_phdr);
	params->phdrs = kmalloc(size, GFP_KERNEL);
	if (!params->phdrs)
		return -ENOMEM;

156
	retval = kernel_read(file, params->phdrs, size, &pos);
157 158
	if (unlikely(retval != size))
		return retval < 0 ? retval : -ENOEXEC;
Linus Torvalds's avatar
Linus Torvalds committed
159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175

	/* determine stack size for this binary */
	phdr = params->phdrs;
	for (loop = 0; loop < params->hdr.e_phnum; loop++, phdr++) {
		if (phdr->p_type != PT_GNU_STACK)
			continue;

		if (phdr->p_flags & PF_X)
			params->flags |= ELF_FDPIC_FLAG_EXEC_STACK;
		else
			params->flags |= ELF_FDPIC_FLAG_NOEXEC_STACK;

		params->stack_size = phdr->p_memsz;
		break;
	}

	return 0;
176
}
Linus Torvalds's avatar
Linus Torvalds committed
177 178 179 180 181

/*****************************************************************************/
/*
 * load an fdpic binary into various bits of memory
 */
182
static int load_elf_fdpic_binary(struct linux_binprm *bprm)
Linus Torvalds's avatar
Linus Torvalds committed
183 184
{
	struct elf_fdpic_params exec_params, interp_params;
185
	struct pt_regs *regs = current_pt_regs();
Linus Torvalds's avatar
Linus Torvalds committed
186
	struct elf_phdr *phdr;
187 188 189
	unsigned long stack_size, entryaddr;
#ifdef ELF_FDPIC_PLAT_INIT
	unsigned long dynaddr;
190 191 192
#endif
#ifndef CONFIG_MMU
	unsigned long stack_prot;
193
#endif
Linus Torvalds's avatar
Linus Torvalds committed
194 195 196 197
	struct file *interpreter = NULL; /* to shut gcc up */
	char *interpreter_name = NULL;
	int executable_stack;
	int retval, i;
198
	loff_t pos;
Linus Torvalds's avatar
Linus Torvalds committed
199

200 201
	kdebug("____ LOAD %d ____", current->pid);

Linus Torvalds's avatar
Linus Torvalds committed
202 203 204 205 206 207 208 209
	memset(&exec_params, 0, sizeof(exec_params));
	memset(&interp_params, 0, sizeof(interp_params));

	exec_params.hdr = *(struct elfhdr *) bprm->buf;
	exec_params.flags = ELF_FDPIC_FLAG_PRESENT | ELF_FDPIC_FLAG_EXECUTABLE;

	/* check that this is a binary we know how to deal with */
	retval = -ENOEXEC;
210
	if (!is_elf(&exec_params.hdr, bprm->file))
Linus Torvalds's avatar
Linus Torvalds committed
211
		goto error;
212 213 214 215 216 217 218 219 220 221
	if (!elf_check_fdpic(&exec_params.hdr)) {
#ifdef CONFIG_MMU
		/* binfmt_elf handles non-fdpic elf except on nommu */
		goto error;
#else
		/* nommu can only load ET_DYN (PIE) ELF */
		if (exec_params.hdr.e_type != ET_DYN)
			goto error;
#endif
	}
Linus Torvalds's avatar
Linus Torvalds committed
222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241

	/* read the program header table */
	retval = elf_fdpic_fetch_phdrs(&exec_params, bprm->file);
	if (retval < 0)
		goto error;

	/* scan for a program header that specifies an interpreter */
	phdr = exec_params.phdrs;

	for (i = 0; i < exec_params.hdr.e_phnum; i++, phdr++) {
		switch (phdr->p_type) {
		case PT_INTERP:
			retval = -ENOMEM;
			if (phdr->p_filesz > PATH_MAX)
				goto error;
			retval = -ENOENT;
			if (phdr->p_filesz < 2)
				goto error;

			/* read the name of the interpreter into memory */
242
			interpreter_name = kmalloc(phdr->p_filesz, GFP_KERNEL);
Linus Torvalds's avatar
Linus Torvalds committed
243 244 245
			if (!interpreter_name)
				goto error;

246 247 248
			pos = phdr->p_offset;
			retval = kernel_read(bprm->file, interpreter_name,
					     phdr->p_filesz, &pos);
249 250 251
			if (unlikely(retval != phdr->p_filesz)) {
				if (retval >= 0)
					retval = -ENOEXEC;
Linus Torvalds's avatar
Linus Torvalds committed
252
				goto error;
253
			}
Linus Torvalds's avatar
Linus Torvalds committed
254 255 256 257 258 259 260 261 262 263 264 265 266 267 268

			retval = -ENOENT;
			if (interpreter_name[phdr->p_filesz - 1] != '\0')
				goto error;

			kdebug("Using ELF interpreter %s", interpreter_name);

			/* replace the program with the interpreter */
			interpreter = open_exec(interpreter_name);
			retval = PTR_ERR(interpreter);
			if (IS_ERR(interpreter)) {
				interpreter = NULL;
				goto error;
			}

269 270 271 272 273
			/*
			 * If the binary is not readable then enforce
			 * mm->dumpable = 0 regardless of the interpreter's
			 * permissions.
			 */
274
			would_dump(bprm, interpreter);
275

276 277 278
			pos = 0;
			retval = kernel_read(interpreter, bprm->buf,
					BINPRM_BUF_SIZE, &pos);
279 280 281
			if (unlikely(retval != BINPRM_BUF_SIZE)) {
				if (retval >= 0)
					retval = -ENOEXEC;
Linus Torvalds's avatar
Linus Torvalds committed
282
				goto error;
283
			}
Linus Torvalds's avatar
Linus Torvalds committed
284 285 286 287 288 289 290 291 292 293 294 295 296 297

			interp_params.hdr = *((struct elfhdr *) bprm->buf);
			break;

		case PT_LOAD:
#ifdef CONFIG_MMU
			if (exec_params.load_addr == 0)
				exec_params.load_addr = phdr->p_vaddr;
#endif
			break;
		}

	}

298
	if (is_constdisp(&exec_params.hdr))
Linus Torvalds's avatar
Linus Torvalds committed
299 300 301 302 303
		exec_params.flags |= ELF_FDPIC_FLAG_CONSTDISP;

	/* perform insanity checks on the interpreter */
	if (interpreter_name) {
		retval = -ELIBBAD;
304
		if (!is_elf(&interp_params.hdr, interpreter))
Linus Torvalds's avatar
Linus Torvalds committed
305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322
			goto error;

		interp_params.flags = ELF_FDPIC_FLAG_PRESENT;

		/* read the interpreter's program header table */
		retval = elf_fdpic_fetch_phdrs(&interp_params, interpreter);
		if (retval < 0)
			goto error;
	}

	stack_size = exec_params.stack_size;
	if (exec_params.flags & ELF_FDPIC_FLAG_EXEC_STACK)
		executable_stack = EXSTACK_ENABLE_X;
	else if (exec_params.flags & ELF_FDPIC_FLAG_NOEXEC_STACK)
		executable_stack = EXSTACK_DISABLE_X;
	else
		executable_stack = EXSTACK_DEFAULT;

323 324 325 326 327 328 329 330 331 332
	if (stack_size == 0) {
		stack_size = interp_params.stack_size;
		if (interp_params.flags & ELF_FDPIC_FLAG_EXEC_STACK)
			executable_stack = EXSTACK_ENABLE_X;
		else if (interp_params.flags & ELF_FDPIC_FLAG_NOEXEC_STACK)
			executable_stack = EXSTACK_DISABLE_X;
		else
			executable_stack = EXSTACK_DEFAULT;
	}

Linus Torvalds's avatar
Linus Torvalds committed
333 334
	retval = -ENOEXEC;
	if (stack_size == 0)
335
		stack_size = 131072UL; /* same as exec.c's default commit */
Linus Torvalds's avatar
Linus Torvalds committed
336

337
	if (is_constdisp(&interp_params.hdr))
Linus Torvalds's avatar
Linus Torvalds committed
338 339 340 341 342 343 344 345
		interp_params.flags |= ELF_FDPIC_FLAG_CONSTDISP;

	/* flush all traces of the currently running executable */
	retval = flush_old_exec(bprm);
	if (retval)
		goto error;

	/* there's now no turning back... the old userspace image is dead,
346 347
	 * defunct, deceased, etc.
	 */
348 349 350 351
	if (elf_check_fdpic(&exec_params.hdr))
		set_personality(PER_LINUX_FDPIC);
	else
		set_personality(PER_LINUX);
352 353
	if (elf_read_implies_exec(&exec_params.hdr, executable_stack))
		current->personality |= READ_IMPLIES_EXEC;
354 355 356

	setup_new_exec(bprm);

Linus Torvalds's avatar
Linus Torvalds committed
357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372
	set_binfmt(&elf_fdpic_format);

	current->mm->start_code = 0;
	current->mm->end_code = 0;
	current->mm->start_stack = 0;
	current->mm->start_data = 0;
	current->mm->end_data = 0;
	current->mm->context.exec_fdpic_loadmap = 0;
	current->mm->context.interp_fdpic_loadmap = 0;

#ifdef CONFIG_MMU
	elf_fdpic_arch_lay_out_mm(&exec_params,
				  &interp_params,
				  &current->mm->start_stack,
				  &current->mm->start_brk);

373 374
	retval = setup_arg_pages(bprm, current->mm->start_stack,
				 executable_stack);
375 376
	if (retval < 0)
		goto error;
377 378 379 380 381
#ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
	retval = arch_setup_additional_pages(bprm, !!interpreter_name);
	if (retval < 0)
		goto error;
#endif
Linus Torvalds's avatar
Linus Torvalds committed
382 383 384
#endif

	/* load the executable and interpreter into memory */
385 386
	retval = elf_fdpic_map_file(&exec_params, bprm->file, current->mm,
				    "executable");
Linus Torvalds's avatar
Linus Torvalds committed
387
	if (retval < 0)
388
		goto error;
Linus Torvalds's avatar
Linus Torvalds committed
389 390 391 392 393 394

	if (interpreter_name) {
		retval = elf_fdpic_map_file(&interp_params, interpreter,
					    current->mm, "interpreter");
		if (retval < 0) {
			printk(KERN_ERR "Unable to load interpreter\n");
395
			goto error;
Linus Torvalds's avatar
Linus Torvalds committed
396 397 398 399 400 401 402 403 404 405 406
		}

		allow_write_access(interpreter);
		fput(interpreter);
		interpreter = NULL;
	}

#ifdef CONFIG_MMU
	if (!current->mm->start_brk)
		current->mm->start_brk = current->mm->end_data;

407 408
	current->mm->brk = current->mm->start_brk =
		PAGE_ALIGN(current->mm->start_brk);
Linus Torvalds's avatar
Linus Torvalds committed
409 410

#else
411
	/* create a stack area and zero-size brk area */
Linus Torvalds's avatar
Linus Torvalds committed
412 413 414 415
	stack_size = (stack_size + PAGE_SIZE - 1) & PAGE_MASK;
	if (stack_size < PAGE_SIZE * 2)
		stack_size = PAGE_SIZE * 2;

416 417 418 419 420
	stack_prot = PROT_READ | PROT_WRITE;
	if (executable_stack == EXSTACK_ENABLE_X ||
	    (executable_stack == EXSTACK_DEFAULT && VM_STACK_FLAGS & VM_EXEC))
		stack_prot |= PROT_EXEC;

421
	current->mm->start_brk = vm_mmap(NULL, 0, stack_size, stack_prot,
422 423
					 MAP_PRIVATE | MAP_ANONYMOUS |
					 MAP_UNINITIALIZED | MAP_GROWSDOWN,
Linus Torvalds's avatar
Linus Torvalds committed
424 425
					 0);

426
	if (IS_ERR_VALUE(current->mm->start_brk)) {
Linus Torvalds's avatar
Linus Torvalds committed
427 428
		retval = current->mm->start_brk;
		current->mm->start_brk = 0;
429
		goto error;
Linus Torvalds's avatar
Linus Torvalds committed
430 431 432 433 434 435 436
	}

	current->mm->brk = current->mm->start_brk;
	current->mm->context.end_brk = current->mm->start_brk;
	current->mm->start_stack = current->mm->start_brk + stack_size;
#endif

437
	install_exec_creds(bprm);
438 439
	if (create_elf_fdpic_tables(bprm, current->mm,
				    &exec_params, &interp_params) < 0)
440
		goto error;
Linus Torvalds's avatar
Linus Torvalds committed
441

442 443 444 445 446 447 448
	kdebug("- start_code  %lx", current->mm->start_code);
	kdebug("- end_code    %lx", current->mm->end_code);
	kdebug("- start_data  %lx", current->mm->start_data);
	kdebug("- end_data    %lx", current->mm->end_data);
	kdebug("- start_brk   %lx", current->mm->start_brk);
	kdebug("- brk         %lx", current->mm->brk);
	kdebug("- start_stack %lx", current->mm->start_stack);
Linus Torvalds's avatar
Linus Torvalds committed
449 450 451 452 453 454 455 456

#ifdef ELF_FDPIC_PLAT_INIT
	/*
	 * The ABI may specify that certain registers be set up in special
	 * ways (on i386 %edx is the address of a DT_FINI function, for
	 * example.  This macro performs whatever initialization to
	 * the regs structure is required.
	 */
457 458 459
	dynaddr = interp_params.dynamic_addr ?: exec_params.dynamic_addr;
	ELF_FDPIC_PLAT_INIT(regs, exec_params.map_addr, interp_params.map_addr,
			    dynaddr);
Linus Torvalds's avatar
Linus Torvalds committed
460 461
#endif

462
	finalize_exec(bprm);
Linus Torvalds's avatar
Linus Torvalds committed
463
	/* everything is now ready... get the userspace context ready to roll */
464 465
	entryaddr = interp_params.entry_addr ?: exec_params.entry_addr;
	start_thread(regs, entryaddr, current->mm->start_stack);
Linus Torvalds's avatar
Linus Torvalds committed
466 467 468 469 470 471 472 473

	retval = 0;

error:
	if (interpreter) {
		allow_write_access(interpreter);
		fput(interpreter);
	}
Jesper Juhl's avatar
Jesper Juhl committed
474 475 476 477 478
	kfree(interpreter_name);
	kfree(exec_params.phdrs);
	kfree(exec_params.loadmap);
	kfree(interp_params.phdrs);
	kfree(interp_params.loadmap);
Linus Torvalds's avatar
Linus Torvalds committed
479
	return retval;
480
}
Linus Torvalds's avatar
Linus Torvalds committed
481 482

/*****************************************************************************/
483 484 485 486 487 488 489 490 491 492

#ifndef ELF_BASE_PLATFORM
/*
 * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture.
 * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value
 * will be copied to the user stack in the same manner as AT_PLATFORM.
 */
#define ELF_BASE_PLATFORM NULL
#endif

Linus Torvalds's avatar
Linus Torvalds committed
493
/*
494 495
 * present useful information to the program by shovelling it onto the new
 * process's stack
Linus Torvalds's avatar
Linus Torvalds committed
496 497 498 499 500 501
 */
static int create_elf_fdpic_tables(struct linux_binprm *bprm,
				   struct mm_struct *mm,
				   struct elf_fdpic_params *exec_params,
				   struct elf_fdpic_params *interp_params)
{
502
	const struct cred *cred = current_cred();
Linus Torvalds's avatar
Linus Torvalds committed
503
	unsigned long sp, csp, nitems;
504
	elf_caddr_t __user *argv, *envp;
Linus Torvalds's avatar
Linus Torvalds committed
505
	size_t platform_len = 0, len;
506 507
	char *k_platform, *k_base_platform;
	char __user *u_platform, *u_base_platform, *p;
Linus Torvalds's avatar
Linus Torvalds committed
508
	int loop;
509
	int nr;	/* reset for each csp adjustment */
Linus Torvalds's avatar
Linus Torvalds committed
510 511

#ifdef CONFIG_MMU
512 513 514 515 516 517
	/* In some cases (e.g. Hyper-Threading), we want to avoid L1 evictions
	 * by the processes running on the same package. One thing we can do is
	 * to shuffle the initial stack for them, so we give the architecture
	 * an opportunity to do so here.
	 */
	sp = arch_align_stack(bprm->p);
Linus Torvalds's avatar
Linus Torvalds committed
518 519 520 521
#else
	sp = mm->start_stack;

	/* stack the program arguments and environment */
522
	if (transfer_args_to_stack(bprm, &sp) < 0)
Linus Torvalds's avatar
Linus Torvalds committed
523
		return -EFAULT;
524
	sp &= ~15;
Linus Torvalds's avatar
Linus Torvalds committed
525 526
#endif

527 528 529 530 531 532
	/*
	 * If this architecture has a platform capability string, copy it
	 * to userspace.  In some cases (Sparc), this info is impossible
	 * for userspace to get any other way, in others (i386) it is
	 * merely difficult.
	 */
Linus Torvalds's avatar
Linus Torvalds committed
533
	k_platform = ELF_PLATFORM;
534
	u_platform = NULL;
Linus Torvalds's avatar
Linus Torvalds committed
535 536 537 538

	if (k_platform) {
		platform_len = strlen(k_platform) + 1;
		sp -= platform_len;
539
		u_platform = (char __user *) sp;
Linus Torvalds's avatar
Linus Torvalds committed
540 541 542 543
		if (__copy_to_user(u_platform, k_platform, platform_len) != 0)
			return -EFAULT;
	}

544 545 546 547 548 549 550 551 552 553 554 555 556 557 558
	/*
	 * If this architecture has a "base" platform capability
	 * string, copy it to userspace.
	 */
	k_base_platform = ELF_BASE_PLATFORM;
	u_base_platform = NULL;

	if (k_base_platform) {
		platform_len = strlen(k_base_platform) + 1;
		sp -= platform_len;
		u_base_platform = (char __user *) sp;
		if (__copy_to_user(u_base_platform, k_base_platform, platform_len) != 0)
			return -EFAULT;
	}

Linus Torvalds's avatar
Linus Torvalds committed
559 560 561 562 563 564 565 566
	sp &= ~7UL;

	/* stack the load map(s) */
	len = sizeof(struct elf32_fdpic_loadmap);
	len += sizeof(struct elf32_fdpic_loadseg) * exec_params->loadmap->nsegs;
	sp = (sp - len) & ~7UL;
	exec_params->map_addr = sp;

567
	if (copy_to_user((void __user *) sp, exec_params->loadmap, len) != 0)
Linus Torvalds's avatar
Linus Torvalds committed
568 569 570 571 572 573
		return -EFAULT;

	current->mm->context.exec_fdpic_loadmap = (unsigned long) sp;

	if (interp_params->loadmap) {
		len = sizeof(struct elf32_fdpic_loadmap);
574 575
		len += sizeof(struct elf32_fdpic_loadseg) *
			interp_params->loadmap->nsegs;
Linus Torvalds's avatar
Linus Torvalds committed
576 577 578
		sp = (sp - len) & ~7UL;
		interp_params->map_addr = sp;

579 580
		if (copy_to_user((void __user *) sp, interp_params->loadmap,
				 len) != 0)
Linus Torvalds's avatar
Linus Torvalds committed
581 582 583 584 585 586
			return -EFAULT;

		current->mm->context.interp_fdpic_loadmap = (unsigned long) sp;
	}

	/* force 16 byte _final_ alignment here for generality */
587
#define DLINFO_ITEMS 15
Linus Torvalds's avatar
Linus Torvalds committed
588

589 590
	nitems = 1 + DLINFO_ITEMS + (k_platform ? 1 : 0) +
		(k_base_platform ? 1 : 0) + AT_VECTOR_SIZE_ARCH;
Linus Torvalds's avatar
Linus Torvalds committed
591

592 593 594
	if (bprm->interp_flags & BINPRM_FLAGS_EXECFD)
		nitems++;

Linus Torvalds's avatar
Linus Torvalds committed
595 596 597 598 599 600 601 602 603 604
	csp = sp;
	sp -= nitems * 2 * sizeof(unsigned long);
	sp -= (bprm->envc + 1) * sizeof(char *);	/* envv[] */
	sp -= (bprm->argc + 1) * sizeof(char *);	/* argv[] */
	sp -= 1 * sizeof(unsigned long);		/* argc */

	csp -= sp & 15UL;
	sp -= sp & 15UL;

	/* put the ELF interpreter info on the stack */
605
#define NEW_AUX_ENT(id, val)						\
606 607 608 609 610 611
	do {								\
		struct { unsigned long _id, _val; } __user *ent;	\
									\
		ent = (void __user *) csp;				\
		__put_user((id), &ent[nr]._id);				\
		__put_user((val), &ent[nr]._val);			\
612
		nr++;							\
Linus Torvalds's avatar
Linus Torvalds committed
613 614
	} while (0)

615
	nr = 0;
Linus Torvalds's avatar
Linus Torvalds committed
616
	csp -= 2 * sizeof(unsigned long);
617
	NEW_AUX_ENT(AT_NULL, 0);
Linus Torvalds's avatar
Linus Torvalds committed
618
	if (k_platform) {
619
		nr = 0;
Linus Torvalds's avatar
Linus Torvalds committed
620
		csp -= 2 * sizeof(unsigned long);
621
		NEW_AUX_ENT(AT_PLATFORM,
622
			    (elf_addr_t) (unsigned long) u_platform);
Linus Torvalds's avatar
Linus Torvalds committed
623 624
	}

625 626 627 628 629 630 631
	if (k_base_platform) {
		nr = 0;
		csp -= 2 * sizeof(unsigned long);
		NEW_AUX_ENT(AT_BASE_PLATFORM,
			    (elf_addr_t) (unsigned long) u_base_platform);
	}

632 633 634 635 636 637
	if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) {
		nr = 0;
		csp -= 2 * sizeof(unsigned long);
		NEW_AUX_ENT(AT_EXECFD, bprm->interp_data);
	}

638
	nr = 0;
Linus Torvalds's avatar
Linus Torvalds committed
639
	csp -= DLINFO_ITEMS * 2 * sizeof(unsigned long);
640 641 642 643
	NEW_AUX_ENT(AT_HWCAP,	ELF_HWCAP);
#ifdef ELF_HWCAP2
	NEW_AUX_ENT(AT_HWCAP2,	ELF_HWCAP2);
#endif
644 645 646 647 648 649 650 651
	NEW_AUX_ENT(AT_PAGESZ,	PAGE_SIZE);
	NEW_AUX_ENT(AT_CLKTCK,	CLOCKS_PER_SEC);
	NEW_AUX_ENT(AT_PHDR,	exec_params->ph_addr);
	NEW_AUX_ENT(AT_PHENT,	sizeof(struct elf_phdr));
	NEW_AUX_ENT(AT_PHNUM,	exec_params->hdr.e_phnum);
	NEW_AUX_ENT(AT_BASE,	interp_params->elfhdr_addr);
	NEW_AUX_ENT(AT_FLAGS,	0);
	NEW_AUX_ENT(AT_ENTRY,	exec_params->entry_addr);
652 653 654 655
	NEW_AUX_ENT(AT_UID,	(elf_addr_t) from_kuid_munged(cred->user_ns, cred->uid));
	NEW_AUX_ENT(AT_EUID,	(elf_addr_t) from_kuid_munged(cred->user_ns, cred->euid));
	NEW_AUX_ENT(AT_GID,	(elf_addr_t) from_kgid_munged(cred->user_ns, cred->gid));
	NEW_AUX_ENT(AT_EGID,	(elf_addr_t) from_kgid_munged(cred->user_ns, cred->egid));
656
	NEW_AUX_ENT(AT_SECURE,	bprm->secureexec);
657
	NEW_AUX_ENT(AT_EXECFN,	bprm->exec);
Linus Torvalds's avatar
Linus Torvalds committed
658 659

#ifdef ARCH_DLINFO
660 661 662
	nr = 0;
	csp -= AT_VECTOR_SIZE_ARCH * 2 * sizeof(unsigned long);

Linus Torvalds's avatar
Linus Torvalds committed
663 664 665 666 667 668 669 670 671
	/* ARCH_DLINFO must come last so platform specific code can enforce
	 * special alignment requirements on the AUXV if necessary (eg. PPC).
	 */
	ARCH_DLINFO;
#endif
#undef NEW_AUX_ENT

	/* allocate room for argv[] and envv[] */
	csp -= (bprm->envc + 1) * sizeof(elf_caddr_t);
672
	envp = (elf_caddr_t __user *) csp;
Linus Torvalds's avatar
Linus Torvalds committed
673
	csp -= (bprm->argc + 1) * sizeof(elf_caddr_t);
674
	argv = (elf_caddr_t __user *) csp;
Linus Torvalds's avatar
Linus Torvalds committed
675 676 677

	/* stack argc */
	csp -= sizeof(unsigned long);
678
	__put_user(bprm->argc, (unsigned long __user *) csp);
Linus Torvalds's avatar
Linus Torvalds committed
679

680
	BUG_ON(csp != sp);
Linus Torvalds's avatar
Linus Torvalds committed
681 682 683 684 685

	/* fill in the argv[] array */
#ifdef CONFIG_MMU
	current->mm->arg_start = bprm->p;
#else
686 687
	current->mm->arg_start = current->mm->start_stack -
		(MAX_ARG_PAGES * PAGE_SIZE - bprm->p);
Linus Torvalds's avatar
Linus Torvalds committed
688 689
#endif

690
	p = (char __user *) current->mm->arg_start;
Linus Torvalds's avatar
Linus Torvalds committed
691 692
	for (loop = bprm->argc; loop > 0; loop--) {
		__put_user((elf_caddr_t) p, argv++);
693 694
		len = strnlen_user(p, MAX_ARG_STRLEN);
		if (!len || len > MAX_ARG_STRLEN)
Linus Torvalds's avatar
Linus Torvalds committed
695 696 697 698 699 700 701 702 703 704
			return -EINVAL;
		p += len;
	}
	__put_user(NULL, argv);
	current->mm->arg_end = (unsigned long) p;

	/* fill in the envv[] array */
	current->mm->env_start = (unsigned long) p;
	for (loop = bprm->envc; loop > 0; loop--) {
		__put_user((elf_caddr_t)(unsigned long) p, envp++);
705 706
		len = strnlen_user(p, MAX_ARG_STRLEN);
		if (!len || len > MAX_ARG_STRLEN)
Linus Torvalds's avatar
Linus Torvalds committed
707 708 709 710 711 712 713 714
			return -EINVAL;
		p += len;
	}
	__put_user(NULL, envp);
	current->mm->env_end = (unsigned long) p;

	mm->start_stack = (unsigned long) sp;
	return 0;
715
}
Linus Torvalds's avatar
Linus Torvalds committed
716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753

/*****************************************************************************/
/*
 * load the appropriate binary image (executable or interpreter) into memory
 * - we assume no MMU is available
 * - if no other PIC bits are set in params->hdr->e_flags
 *   - we assume that the LOADable segments in the binary are independently relocatable
 *   - we assume R/O executable segments are shareable
 * - else
 *   - we assume the loadable parts of the image to require fixed displacement
 *   - the image is not shareable
 */
static int elf_fdpic_map_file(struct elf_fdpic_params *params,
			      struct file *file,
			      struct mm_struct *mm,
			      const char *what)
{
	struct elf32_fdpic_loadmap *loadmap;
#ifdef CONFIG_MMU
	struct elf32_fdpic_loadseg *mseg;
#endif
	struct elf32_fdpic_loadseg *seg;
	struct elf32_phdr *phdr;
	unsigned long load_addr, stop;
	unsigned nloads, tmp;
	size_t size;
	int loop, ret;

	/* allocate a load map table */
	nloads = 0;
	for (loop = 0; loop < params->hdr.e_phnum; loop++)
		if (params->phdrs[loop].p_type == PT_LOAD)
			nloads++;

	if (nloads == 0)
		return -ELIBBAD;

	size = sizeof(*loadmap) + nloads * sizeof(*seg);
754
	loadmap = kzalloc(size, GFP_KERNEL);
Linus Torvalds's avatar
Linus Torvalds committed
755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787
	if (!loadmap)
		return -ENOMEM;

	params->loadmap = loadmap;

	loadmap->version = ELF32_FDPIC_LOADMAP_VERSION;
	loadmap->nsegs = nloads;

	load_addr = params->load_addr;
	seg = loadmap->segs;

	/* map the requested LOADs into the memory space */
	switch (params->flags & ELF_FDPIC_FLAG_ARRANGEMENT) {
	case ELF_FDPIC_FLAG_CONSTDISP:
	case ELF_FDPIC_FLAG_CONTIGUOUS:
#ifndef CONFIG_MMU
		ret = elf_fdpic_map_file_constdisp_on_uclinux(params, file, mm);
		if (ret < 0)
			return ret;
		break;
#endif
	default:
		ret = elf_fdpic_map_file_by_direct_mmap(params, file, mm);
		if (ret < 0)
			return ret;
		break;
	}

	/* map the entry point */
	if (params->hdr.e_entry) {
		seg = loadmap->segs;
		for (loop = loadmap->nsegs; loop > 0; loop--, seg++) {
			if (params->hdr.e_entry >= seg->p_vaddr &&
788
			    params->hdr.e_entry < seg->p_vaddr + seg->p_memsz) {
Linus Torvalds's avatar
Linus Torvalds committed
789
				params->entry_addr =
790 791
					(params->hdr.e_entry - seg->p_vaddr) +
					seg->addr;
Linus Torvalds's avatar
Linus Torvalds committed
792 793 794 795 796 797
				break;
			}
		}
	}

	/* determine where the program header table has wound up if mapped */
798 799
	stop = params->hdr.e_phoff;
	stop += params->hdr.e_phnum * sizeof (struct elf_phdr);
Linus Torvalds's avatar
Linus Torvalds committed
800 801 802 803 804 805 806 807 808 809 810 811 812
	phdr = params->phdrs;

	for (loop = 0; loop < params->hdr.e_phnum; loop++, phdr++) {
		if (phdr->p_type != PT_LOAD)
			continue;

		if (phdr->p_offset > params->hdr.e_phoff ||
		    phdr->p_offset + phdr->p_filesz < stop)
			continue;

		seg = loadmap->segs;
		for (loop = loadmap->nsegs; loop > 0; loop--, seg++) {
			if (phdr->p_vaddr >= seg->p_vaddr &&
813 814 815 816 817
			    phdr->p_vaddr + phdr->p_filesz <=
			    seg->p_vaddr + seg->p_memsz) {
				params->ph_addr =
					(phdr->p_vaddr - seg->p_vaddr) +
					seg->addr +
Linus Torvalds's avatar
Linus Torvalds committed
818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833
					params->hdr.e_phoff - phdr->p_offset;
				break;
			}
		}
		break;
	}

	/* determine where the dynamic section has wound up if there is one */
	phdr = params->phdrs;
	for (loop = 0; loop < params->hdr.e_phnum; loop++, phdr++) {
		if (phdr->p_type != PT_DYNAMIC)
			continue;

		seg = loadmap->segs;
		for (loop = loadmap->nsegs; loop > 0; loop--, seg++) {
			if (phdr->p_vaddr >= seg->p_vaddr &&
834 835
			    phdr->p_vaddr + phdr->p_memsz <=
			    seg->p_vaddr + seg->p_memsz) {
836 837 838
				Elf32_Dyn __user *dyn;
				Elf32_Sword d_tag;

839 840 841 842 843 844 845
				params->dynamic_addr =
					(phdr->p_vaddr - seg->p_vaddr) +
					seg->addr;

				/* check the dynamic section contains at least
				 * one item, and that the last item is a NULL
				 * entry */
Linus Torvalds's avatar
Linus Torvalds committed
846 847 848 849 850
				if (phdr->p_memsz == 0 ||
				    phdr->p_memsz % sizeof(Elf32_Dyn) != 0)
					goto dynamic_error;

				tmp = phdr->p_memsz / sizeof(Elf32_Dyn);
851 852 853
				dyn = (Elf32_Dyn __user *)params->dynamic_addr;
				__get_user(d_tag, &dyn[tmp - 1].d_tag);
				if (d_tag != 0)
Linus Torvalds's avatar
Linus Torvalds committed
854 855 856 857 858 859 860 861
					goto dynamic_error;
				break;
			}
		}
		break;
	}

	/* now elide adjacent segments in the load map on MMU linux
862 863
	 * - on uClinux the holes between may actually be filled with system
	 *   stuff or stuff from other processes
Linus Torvalds's avatar
Linus Torvalds committed
864 865 866 867 868 869 870 871 872 873
	 */
#ifdef CONFIG_MMU
	nloads = loadmap->nsegs;
	mseg = loadmap->segs;
	seg = mseg + 1;
	for (loop = 1; loop < nloads; loop++) {
		/* see if we have a candidate for merging */
		if (seg->p_vaddr - mseg->p_vaddr == seg->addr - mseg->addr) {
			load_addr = PAGE_ALIGN(mseg->addr + mseg->p_memsz);
			if (load_addr == (seg->addr & PAGE_MASK)) {
874 875 876
				mseg->p_memsz +=
					load_addr -
					(mseg->addr + mseg->p_memsz);
Linus Torvalds's avatar
Linus Torvalds committed
877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903
				mseg->p_memsz += seg->addr & ~PAGE_MASK;
				mseg->p_memsz += seg->p_memsz;
				loadmap->nsegs--;
				continue;
			}
		}

		mseg++;
		if (mseg != seg)
			*mseg = *seg;
	}
#endif

	kdebug("Mapped Object [%s]:", what);
	kdebug("- elfhdr   : %lx", params->elfhdr_addr);
	kdebug("- entry    : %lx", params->entry_addr);
	kdebug("- PHDR[]   : %lx", params->ph_addr);
	kdebug("- DYNAMIC[]: %lx", params->dynamic_addr);
	seg = loadmap->segs;
	for (loop = 0; loop < loadmap->nsegs; loop++, seg++)
		kdebug("- LOAD[%d] : %08x-%08x [va=%x ms=%x]",
		       loop,
		       seg->addr, seg->addr + seg->p_memsz - 1,
		       seg->p_vaddr, seg->p_memsz);

	return 0;

904
dynamic_error:
Linus Torvalds's avatar
Linus Torvalds committed
905
	printk("ELF FDPIC %s with invalid DYNAMIC section (inode=%lu)\n",
Al Viro's avatar
Al Viro committed
906
	       what, file_inode(file)->i_ino);
Linus Torvalds's avatar
Linus Torvalds committed
907
	return -ELIBBAD;
908
}
Linus Torvalds's avatar
Linus Torvalds committed
909 910 911 912 913 914

/*****************************************************************************/
/*
 * map a file with constant displacement under uClinux
 */
#ifndef CONFIG_MMU
915 916 917 918
static int elf_fdpic_map_file_constdisp_on_uclinux(
	struct elf_fdpic_params *params,
	struct file *file,
	struct mm_struct *mm)
Linus Torvalds's avatar
Linus Torvalds committed
919 920 921 922 923 924 925 926 927
{
	struct elf32_fdpic_loadseg *seg;
	struct elf32_phdr *phdr;
	unsigned long load_addr, base = ULONG_MAX, top = 0, maddr = 0, mflags;
	int loop, ret;

	load_addr = params->load_addr;
	seg = params->loadmap->segs;

928 929
	/* determine the bounds of the contiguous overall allocation we must
	 * make */
Linus Torvalds's avatar
Linus Torvalds committed
930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945
	phdr = params->phdrs;
	for (loop = 0; loop < params->hdr.e_phnum; loop++, phdr++) {
		if (params->phdrs[loop].p_type != PT_LOAD)
			continue;

		if (base > phdr->p_vaddr)
			base = phdr->p_vaddr;
		if (top < phdr->p_vaddr + phdr->p_memsz)
			top = phdr->p_vaddr + phdr->p_memsz;
	}

	/* allocate one big anon block for everything */
	mflags = MAP_PRIVATE;
	if (params->flags & ELF_FDPIC_FLAG_EXECUTABLE)
		mflags |= MAP_EXECUTABLE;

946
	maddr = vm_mmap(NULL, load_addr, top - base,
Linus Torvalds's avatar
Linus Torvalds committed
947
			PROT_READ | PROT_WRITE | PROT_EXEC, mflags, 0);
948
	if (IS_ERR_VALUE(maddr))
Linus Torvalds's avatar
Linus Torvalds committed
949 950 951 952 953 954 955 956 957 958 959 960 961 962 963
		return (int) maddr;

	if (load_addr != 0)
		load_addr += PAGE_ALIGN(top - base);

	/* and then load the file segments into it */
	phdr = params->phdrs;
	for (loop = 0; loop < params->hdr.e_phnum; loop++, phdr++) {
		if (params->phdrs[loop].p_type != PT_LOAD)
			continue;

		seg->addr = maddr + (phdr->p_vaddr - base);
		seg->p_vaddr = phdr->p_vaddr;
		seg->p_memsz = phdr->p_memsz;

Al Viro's avatar
Al Viro committed
964 965
		ret = read_code(file, seg->addr, phdr->p_offset,
				       phdr->p_filesz);
Linus Torvalds's avatar
Linus Torvalds committed
966 967 968 969 970 971 972 973
		if (ret < 0)
			return ret;

		/* map the ELF header address if in this segment */
		if (phdr->p_offset == 0)
			params->elfhdr_addr = seg->addr;

		/* clear any space allocated but not loaded */
974
		if (phdr->p_filesz < phdr->p_memsz) {
975 976 977
			if (clear_user((void *) (seg->addr + phdr->p_filesz),
				       phdr->p_memsz - phdr->p_filesz))
				return -EFAULT;
978
		}
Linus Torvalds's avatar
Linus Torvalds committed
979 980 981

		if (mm) {
			if (phdr->p_flags & PF_X) {
982 983 984 985 986
				if (!mm->start_code) {
					mm->start_code = seg->addr;
					mm->end_code = seg->addr +
						phdr->p_memsz;
				}
987
			} else if (!mm->start_data) {
Linus Torvalds's avatar
Linus Torvalds committed
988 989 990 991 992 993 994 995 996
				mm->start_data = seg->addr;
				mm->end_data = seg->addr + phdr->p_memsz;
			}
		}

		seg++;
	}

	return 0;
997
}
Linus Torvalds's avatar
Linus Torvalds committed
998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010
#endif

/*****************************************************************************/
/*
 * map a binary by direct mmap() of the individual PT_LOAD segments
 */
static int elf_fdpic_map_file_by_direct_mmap(struct elf_fdpic_params *params,
					     struct file *file,
					     struct mm_struct *mm)
{
	struct elf32_fdpic_loadseg *seg;
	struct elf32_phdr *phdr;
	unsigned long load_addr, delta_vaddr;
1011
	int loop, dvset;
Linus Torvalds's avatar
Linus Torvalds committed
1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057

	load_addr = params->load_addr;
	delta_vaddr = 0;
	dvset = 0;

	seg = params->loadmap->segs;

	/* deal with each load segment separately */
	phdr = params->phdrs;
	for (loop = 0; loop < params->hdr.e_phnum; loop++, phdr++) {
		unsigned long maddr, disp, excess, excess1;
		int prot = 0, flags;

		if (phdr->p_type != PT_LOAD)
			continue;

		kdebug("[LOAD] va=%lx of=%lx fs=%lx ms=%lx",
		       (unsigned long) phdr->p_vaddr,
		       (unsigned long) phdr->p_offset,
		       (unsigned long) phdr->p_filesz,
		       (unsigned long) phdr->p_memsz);

		/* determine the mapping parameters */
		if (phdr->p_flags & PF_R) prot |= PROT_READ;
		if (phdr->p_flags & PF_W) prot |= PROT_WRITE;
		if (phdr->p_flags & PF_X) prot |= PROT_EXEC;

		flags = MAP_PRIVATE | MAP_DENYWRITE;
		if (params->flags & ELF_FDPIC_FLAG_EXECUTABLE)
			flags |= MAP_EXECUTABLE;

		maddr = 0;

		switch (params->flags & ELF_FDPIC_FLAG_ARRANGEMENT) {
		case ELF_FDPIC_FLAG_INDEPENDENT:
			/* PT_LOADs are independently locatable */
			break;

		case ELF_FDPIC_FLAG_HONOURVADDR:
			/* the specified virtual address must be honoured */
			maddr = phdr->p_vaddr;
			flags |= MAP_FIXED;
			break;

		case ELF_FDPIC_FLAG_CONSTDISP:
			/* constant displacement
1058 1059
			 * - can be mapped anywhere, but must be mapped as a
			 *   unit
Linus Torvalds's avatar
Linus Torvalds committed
1060 1061 1062 1063 1064
			 */
			if (!dvset) {
				maddr = load_addr;
				delta_vaddr = phdr->p_vaddr;
				dvset = 1;
1065
			} else {
Linus Torvalds's avatar
Linus Torvalds committed
1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082
				maddr = load_addr + phdr->p_vaddr - delta_vaddr;
				flags |= MAP_FIXED;
			}
			break;

		case ELF_FDPIC_FLAG_CONTIGUOUS:
			/* contiguity handled later */
			break;

		default:
			BUG();
		}

		maddr &= PAGE_MASK;

		/* create the mapping */
		disp = phdr->p_vaddr & ~PAGE_MASK;
1083
		maddr = vm_mmap(file, maddr, phdr->p_memsz + disp, prot, flags,
Linus Torvalds's avatar
Linus Torvalds committed
1084 1085 1086
				phdr->p_offset - disp);

		kdebug("mmap[%d] <file> sz=%lx pr=%x fl=%x of=%lx --> %08lx",
1087 1088
		       loop, phdr->p_memsz + disp, prot, flags,
		       phdr->p_offset - disp, maddr);
Linus Torvalds's avatar
Linus Torvalds committed
1089

1090
		if (IS_ERR_VALUE(maddr))
Linus Torvalds's avatar
Linus Torvalds committed
1091 1092
			return (int) maddr;

1093 1094
		if ((params->flags & ELF_FDPIC_FLAG_ARRANGEMENT) ==
		    ELF_FDPIC_FLAG_CONTIGUOUS)
Linus Torvalds's avatar
Linus Torvalds committed
1095 1096 1097 1098 1099 1100 1101 1102 1103 1104
			load_addr += PAGE_ALIGN(phdr->p_memsz + disp);

		seg->addr = maddr + disp;
		seg->p_vaddr = phdr->p_vaddr;
		seg->p_memsz = phdr->p_memsz;

		/* map the ELF header address if in this segment */
		if (phdr->p_offset == 0)
			params->elfhdr_addr = seg->addr;

1105 1106
		/* clear the bit between beginning of mapping and beginning of
		 * PT_LOAD */
Linus Torvalds's avatar
Linus Torvalds committed
1107 1108
		if (prot & PROT_WRITE && disp > 0) {
			kdebug("clear[%d] ad=%lx sz=%lx", loop, maddr, disp);
1109 1110
			if (clear_user((void __user *) maddr, disp))
				return -EFAULT;
Linus Torvalds's avatar
Linus Torvalds committed
1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127
			maddr += disp;
		}

		/* clear any space allocated but not loaded
		 * - on uClinux we can just clear the lot
		 * - on MMU linux we'll get a SIGBUS beyond the last page
		 *   extant in the file
		 */
		excess = phdr->p_memsz - phdr->p_filesz;
		excess1 = PAGE_SIZE - ((maddr + phdr->p_filesz) & ~PAGE_MASK);

#ifdef CONFIG_MMU
		if (excess > excess1) {
			unsigned long xaddr = maddr + phdr->p_filesz + excess1;
			unsigned long xmaddr;

			flags |= MAP_FIXED | MAP_ANONYMOUS;
1128
			xmaddr = vm_mmap(NULL, xaddr, excess - excess1,
1129
					 prot, flags, 0);
Linus Torvalds's avatar
Linus Torvalds committed
1130 1131 1132

			kdebug("mmap[%d] <anon>"
			       " ad=%lx sz=%lx pr=%x fl=%x of=0 --> %08lx",
1133 1134
			       loop, xaddr, excess - excess1, prot, flags,
			       xmaddr);
Linus Torvalds's avatar
Linus Torvalds committed
1135 1136 1137 1138 1139 1140 1141 1142

			if (xmaddr != xaddr)
				return -ENOMEM;
		}

		if (prot & PROT_WRITE && excess1 > 0) {
			kdebug("clear[%d] ad=%lx sz=%lx",
			       loop, maddr + phdr->p_filesz, excess1);
1143 1144 1145
			if (clear_user((void __user *) maddr + phdr->p_filesz,
				       excess1))
				return -EFAULT;
Linus Torvalds's avatar
Linus Torvalds committed
1146 1147 1148 1149 1150 1151
		}

#else
		if (excess > 0) {
			kdebug("clear[%d] ad=%lx sz=%lx",
			       loop, maddr + phdr->p_filesz, excess);
1152 1153
			if (clear_user((void *) maddr + phdr->p_filesz, excess))
				return -EFAULT;
Linus Torvalds's avatar
Linus Torvalds committed
1154 1155 1156 1157 1158
		}
#endif

		if (mm) {
			if (phdr->p_flags & PF_X) {
1159 1160 1161 1162
				if (!mm->start_code) {
					mm->start_code = maddr;
					mm->end_code = maddr + phdr->p_memsz;
				}
1163
			} else if (!mm->start_data) {
Linus Torvalds's avatar
Linus Torvalds committed
1164 1165 1166 1167 1168 1169 1170 1171 1172
				mm->start_data = maddr;
				mm->end_data = maddr + phdr->p_memsz;
			}
		}

		seg++;
	}

	return 0;
1173
}
1174 1175 1176 1177 1178 1179 1180 1181 1182 1183

/*****************************************************************************/
/*
 * ELF-FDPIC core dumper
 *
 * Modelled on fs/exec.c:aout_core_dump()
 * Jeremy Fitzhardinge <jeremy@sw.oz.au>
 *
 * Modelled on fs/binfmt_elf.c core dumper
 */
1184
#ifdef CONFIG_ELF_CORE
1185 1186 1187 1188 1189 1190 1191 1192

/*
 * Decide whether a segment is worth dumping; default is yes to be
 * sure (missing info is worse than too much; etc).
 * Personally I'd include everything, and use the coredump limit...
 *
 * I think we should skip something. But I am not sure how. H.J.
 */
1193
static int maydump(struct vm_area_struct *vma, unsigned long mm_flags)
1194
{
1195 1196
	int dump_ok;

1197
	/* Do not dump I/O mapped devices or special mappings */
1198
	if (vma->vm_flags & VM_IO) {
1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210
		kdcore("%08lx: %08lx: no (IO)", vma->vm_start, vma->vm_flags);
		return 0;
	}

	/* If we may not read the contents, don't allow us to dump
	 * them either. "dump_write()" can't handle it anyway.
	 */
	if (!(vma->vm_flags & VM_READ)) {
		kdcore("%08lx: %08lx: no (!read)", vma->vm_start, vma->vm_flags);
		return 0;
	}

1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224
	/* support for DAX */
	if (vma_is_dax(vma)) {
		if (vma->vm_flags & VM_SHARED) {
			dump_ok = test_bit(MMF_DUMP_DAX_SHARED, &mm_flags);
			kdcore("%08lx: %08lx: %s (DAX shared)", vma->vm_start,
			       vma->vm_flags, dump_ok ? "yes" : "no");
		} else {
			dump_ok = test_bit(MMF_DUMP_DAX_PRIVATE, &mm_flags);
			kdcore("%08lx: %08lx: %s (DAX private)", vma->vm_start,
			       vma->vm_flags, dump_ok ? "yes" : "no");
		}
		return dump_ok;
	}

1225
	/* By default, dump shared memory if mapped from an anonymous file. */
1226
	if (vma->vm_flags & VM_SHARED) {
Al Viro's avatar
Al Viro committed
1227
		if (file_inode(vma->vm_file)->i_nlink == 0) {
1228 1229 1230 1231
			dump_ok = test_bit(MMF_DUMP_ANON_SHARED, &mm_flags);
			kdcore("%08lx: %08lx: %s (share)", vma->vm_start,
			       vma->vm_flags, dump_ok ? "yes" : "no");
			return dump_ok;
1232 1233
		}

1234 1235 1236 1237
		dump_ok = test_bit(MMF_DUMP_MAPPED_SHARED, &mm_flags);
		kdcore("%08lx: %08lx: %s (share)", vma->vm_start,
		       vma->vm_flags, dump_ok ? "yes" : "no");
		return dump_ok;
1238 1239 1240
	}

#ifdef CONFIG_MMU
1241
	/* By default, if it hasn't been written to, don't write it out */
1242
	if (!vma->anon_vma) {
1243 1244 1245 1246
		dump_ok = test_bit(MMF_DUMP_MAPPED_PRIVATE, &mm_flags);
		kdcore("%08lx: %08lx: %s (!anon)", vma->vm_start,
		       vma->vm_flags, dump_ok ? "yes" : "no");
		return dump_ok;
1247 1248 1249
	}
#endif

1250 1251 1252 1253
	dump_ok = test_bit(MMF_DUMP_ANON_PRIVATE, &mm_flags);
	kdcore("%08lx: %08lx: %s", vma->vm_start, vma->vm_flags,
	       dump_ok ? "yes" : "no");
	return dump_ok;
1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277
}

/* An ELF note in memory */
struct memelfnote
{
	const char *name;
	int type;
	unsigned int datasz;
	void *data;
};

static int notesize(struct memelfnote *en)
{
	int sz;

	sz = sizeof(struct elf_note);
	sz += roundup(strlen(en->name) + 1, 4);
	sz += roundup(en->datasz, 4);

	return sz;
}

/* #define DEBUG */

1278
static int writenote(struct memelfnote *men, struct coredump_params *cprm)
1279 1280
{
	struct elf_note en;
1281 1282 1283 1284
	en.n_namesz = strlen(men->name) + 1;
	en.n_descsz = men->datasz;
	en.n_type = men->type;

1285
	return dump_emit(cprm, &en, sizeof(en)) &&
Al Viro's avatar
Al Viro committed
1286 1287
		dump_emit(cprm, men->name, en.n_namesz) && dump_align(cprm, 4) &&
		dump_emit(cprm, men->data, men->datasz) && dump_align(cprm, 4);
1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339
}

static inline void fill_elf_fdpic_header(struct elfhdr *elf, int segs)
{
	memcpy(elf->e_ident, ELFMAG, SELFMAG);
	elf->e_ident[EI_CLASS] = ELF_CLASS;
	elf->e_ident[EI_DATA] = ELF_DATA;
	elf->e_ident[EI_VERSION] = EV_CURRENT;
	elf->e_ident[EI_OSABI] = ELF_OSABI;
	memset(elf->e_ident+EI_PAD, 0, EI_NIDENT-EI_PAD);

	elf->e_type = ET_CORE;
	elf->e_machine = ELF_ARCH;
	elf->e_version = EV_CURRENT;
	elf->e_entry = 0;
	elf->e_phoff = sizeof(struct elfhdr);
	elf->e_shoff = 0;
	elf->e_flags = ELF_FDPIC_CORE_EFLAGS;
	elf->e_ehsize = sizeof(struct elfhdr);
	elf->e_phentsize = sizeof(struct elf_phdr);
	elf->e_phnum = segs;
	elf->e_shentsize = 0;
	elf->e_shnum = 0;
	elf->e_shstrndx = 0;
	return;
}

static inline void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
{
	phdr->p_type = PT_NOTE;
	phdr->p_offset = offset;
	phdr->p_vaddr = 0;
	phdr->p_paddr = 0;
	phdr->p_filesz = sz;
	phdr->p_memsz = 0;
	phdr->p_flags = 0;
	phdr->p_align = 0;
	return;
}

static inline void fill_note(struct memelfnote *note, const char *name, int type,
		unsigned int sz, void *data)
{
	note->name = name;
	note->type = type;
	note->datasz = sz;
	note->data = data;
	return;
}

/*
 * fill up all the fields in prstatus from the given task struct, except
1340
 * registers which need to be filled up separately.
1341 1342 1343 1344 1345 1346 1347
 */
static void fill_prstatus(struct elf_prstatus *prstatus,
			  struct task_struct *p, long signr)
{
	prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
	prstatus->pr_sigpend = p->pending.signal.sig[0];
	prstatus->pr_sighold = p->blocked.sig[0];
1348 1349 1350
	rcu_read_lock();
	prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
	rcu_read_unlock();
1351 1352 1353
	prstatus->pr_pid = task_pid_vnr(p);
	prstatus->pr_pgrp = task_pgrp_vnr(p);
	prstatus->pr_sid = task_session_vnr(p);
1354
	if (thread_group_leader(p)) {
1355
		struct task_cputime cputime;
1356

1357
		/*
1358 1359
		 * This is the record for the group leader.  It shows the
		 * group-wide total, not its individual thread total.
1360
		 */
1361
		thread_group_cputime(p, &cputime);
1362 1363
		prstatus->pr_utime = ns_to_kernel_old_timeval(cputime.utime);
		prstatus->pr_stime = ns_to_kernel_old_timeval(cputime.stime);
1364
	} else {
1365
		u64 utime, stime;
1366

1367
		task_cputime(p, &utime, &stime);
1368 1369
		prstatus->pr_utime = ns_to_kernel_old_timeval(utime);
		prstatus->pr_stime = ns_to_kernel_old_timeval(stime);
1370
	}
1371 1372
	prstatus->pr_cutime = ns_to_kernel_old_timeval(p->signal->cutime);
	prstatus->pr_cstime = ns_to_kernel_old_timeval(p->signal->cstime);
1373 1374 1375 1376 1377 1378 1379 1380

	prstatus->pr_exec_fdpic_loadmap = p->mm->context.exec_fdpic_loadmap;
	prstatus->pr_interp_fdpic_loadmap = p->mm->context.interp_fdpic_loadmap;
}

static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
		       struct mm_struct *mm)
{
1381
	const struct cred *cred;
1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397
	unsigned int i, len;

	/* first copy the parameters from user space */
	memset(psinfo, 0, sizeof(struct elf_prpsinfo));

	len = mm->arg_end - mm->arg_start;
	if (len >= ELF_PRARGSZ)
		len = ELF_PRARGSZ - 1;
	if (copy_from_user(&psinfo->pr_psargs,
		           (const char __user *) mm->arg_start, len))
		return -EFAULT;
	for (i = 0; i < len; i++)
		if (psinfo->pr_psargs[i] == 0)
			psinfo->pr_psargs[i] = ' ';
	psinfo->pr_psargs[len] = 0;

1398 1399 1400
	rcu_read_lock();
	psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
	rcu_read_unlock();
1401 1402 1403
	psinfo->pr_pid = task_pid_vnr(p);
	psinfo->pr_pgrp = task_pgrp_vnr(p);
	psinfo->pr_sid = task_session_vnr(p);
1404 1405 1406 1407 1408 1409 1410

	i = p->state ? ffz(~p->state) + 1 : 0;
	psinfo->pr_state = i;
	psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
	psinfo->pr_zomb = psinfo->pr_sname == 'Z';
	psinfo->pr_nice = task_nice(p);
	psinfo->pr_flag = p->flags;
1411 1412
	rcu_read_lock();
	cred = __task_cred(p);
1413 1414
	SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid));
	SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid));
1415
	rcu_read_unlock();
1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428
	strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));

	return 0;
}

/* Here is the structure in which status of each thread is captured. */
struct elf_thread_status
{
	struct list_head list;
	struct elf_prstatus prstatus;	/* NT_PRSTATUS */
	elf_fpregset_t fpu;		/* NT_PRFPREG */
	struct task_struct *thread;
#ifdef ELF_CORE_COPY_XFPREGS
1429
	elf_fpxregset_t xfpu;		/* ELF_CORE_XFPREG_TYPE */
1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464
#endif
	struct memelfnote notes[3];
	int num_notes;
};

/*
 * In order to add the specific thread information for the elf file format,
 * we need to keep a linked list of every thread's pr_status and then create
 * a single section for them in the final core file.
 */
static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
{
	struct task_struct *p = t->thread;
	int sz = 0;

	t->num_notes = 0;

	fill_prstatus(&t->prstatus, p, signr);
	elf_core_copy_task_regs(p, &t->prstatus.pr_reg);

	fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus),
		  &t->prstatus);
	t->num_notes++;
	sz += notesize(&t->notes[0]);

	t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL, &t->fpu);
	if (t->prstatus.pr_fpvalid) {
		fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu),
			  &t->fpu);
		t->num_notes++;
		sz += notesize(&t->notes[1]);
	}

#ifdef ELF_CORE_COPY_XFPREGS
	if (elf_core_copy_task_xfpregs(p, &t->xfpu)) {
1465 1466
		fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE,
			  sizeof(t->xfpu), &t->xfpu);
1467 1468 1469 1470 1471 1472 1473
		t->num_notes++;
		sz += notesize(&t->notes[2]);
	}
#endif
	return sz;
}

1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489
static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
			     elf_addr_t e_shoff, int segs)
{
	elf->e_shoff = e_shoff;
	elf->e_shentsize = sizeof(*shdr4extnum);
	elf->e_shnum = 1;
	elf->e_shstrndx = SHN_UNDEF;

	memset(shdr4extnum, 0, sizeof(*shdr4extnum));

	shdr4extnum->sh_type = SHT_NULL;
	shdr4extnum->sh_size = elf->e_shnum;
	shdr4extnum->sh_link = elf->e_shstrndx;
	shdr4extnum->sh_info = segs;
}

1490 1491 1492
/*
 * dump the segments for an MMU process
 */
1493
static bool elf_fdpic_dump_segments(struct coredump_params *cprm)
1494 1495 1496 1497
{
	struct vm_area_struct *vma;

	for (vma = current->mm->mmap; vma; vma = vma->vm_next) {
1498
#ifdef CONFIG_MMU
1499
		unsigned long addr;
1500
#endif
1501

1502
		if (!maydump(vma, cprm->mm_flags))
1503 1504
			continue;

1505
#ifdef CONFIG_MMU
Hugh Dickins's avatar
Hugh Dickins committed
1506 1507
		for (addr = vma->vm_start; addr < vma->vm_end;
							addr += PAGE_SIZE) {
1508
			bool res;
Hugh Dickins's avatar
Hugh Dickins committed
1509 1510 1511
			struct page *page = get_dump_page(addr);
			if (page) {
				void *kaddr = kmap(page);
1512
				res = dump_emit(cprm, kaddr, PAGE_SIZE);
1513
				kunmap(page);
1514
				put_page(page);
1515
			} else {
1516
				res = dump_skip(cprm, PAGE_SIZE);
1517 1518 1519
			}
			if (!res)
				return false;
1520
		}
1521 1522
#else
		if (!dump_emit(cprm, (void *) vma->vm_start,
1523
				vma->vm_end - vma->vm_start))
1524 1525
			return false;
#endif
1526
	}
1527
	return true;
1528 1529
}

1530 1531 1532 1533 1534
static size_t elf_core_vma_data_size(unsigned long mm_flags)
{
	struct vm_area_struct *vma;
	size_t size = 0;