binfmt_elf_fdpic.c 47.3 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1 2
/* binfmt_elf_fdpic.c: FDPIC ELF binary format
 *
3
 * Copyright (C) 2003, 2004, 2006 Red Hat, Inc. All Rights Reserved.
Linus Torvalds's avatar
Linus Torvalds committed
4 5 6 7 8 9 10 11 12 13 14 15 16 17
 * Written by David Howells (dhowells@redhat.com)
 * Derived from binfmt_elf.c
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version
 * 2 of the License, or (at your option) any later version.
 */

#include <linux/module.h>

#include <linux/fs.h>
#include <linux/stat.h>
#include <linux/sched.h>
18 19
#include <linux/sched/coredump.h>
#include <linux/sched/task_stack.h>
20
#include <linux/sched/cputime.h>
Linus Torvalds's avatar
Linus Torvalds committed
21 22 23 24 25 26 27 28 29
#include <linux/mm.h>
#include <linux/mman.h>
#include <linux/errno.h>
#include <linux/signal.h>
#include <linux/binfmts.h>
#include <linux/string.h>
#include <linux/file.h>
#include <linux/fcntl.h>
#include <linux/slab.h>
30
#include <linux/pagemap.h>
31
#include <linux/security.h>
Linus Torvalds's avatar
Linus Torvalds committed
32
#include <linux/highmem.h>
33
#include <linux/highuid.h>
Linus Torvalds's avatar
Linus Torvalds committed
34 35 36 37 38 39
#include <linux/personality.h>
#include <linux/ptrace.h>
#include <linux/init.h>
#include <linux/elf.h>
#include <linux/elf-fdpic.h>
#include <linux/elfcore.h>
40
#include <linux/coredump.h>
41
#include <linux/dax.h>
Linus Torvalds's avatar
Linus Torvalds committed
42

43
#include <linux/uaccess.h>
Linus Torvalds's avatar
Linus Torvalds committed
44 45 46 47 48 49 50 51 52 53 54
#include <asm/param.h>
#include <asm/pgalloc.h>

typedef char *elf_caddr_t;

#if 0
#define kdebug(fmt, ...) printk("FDPIC "fmt"\n" ,##__VA_ARGS__ )
#else
#define kdebug(fmt, ...) do {} while(0)
#endif

55 56 57 58 59 60
#if 0
#define kdcore(fmt, ...) printk("FDPIC "fmt"\n" ,##__VA_ARGS__ )
#else
#define kdcore(fmt, ...) do {} while(0)
#endif

Linus Torvalds's avatar
Linus Torvalds committed
61 62
MODULE_LICENSE("GPL");

63
static int load_elf_fdpic_binary(struct linux_binprm *);
64 65 66
static int elf_fdpic_fetch_phdrs(struct elf_fdpic_params *, struct file *);
static int elf_fdpic_map_file(struct elf_fdpic_params *, struct file *,
			      struct mm_struct *, const char *);
Linus Torvalds's avatar
Linus Torvalds committed
67

68 69 70
static int create_elf_fdpic_tables(struct linux_binprm *, struct mm_struct *,
				   struct elf_fdpic_params *,
				   struct elf_fdpic_params *);
Linus Torvalds's avatar
Linus Torvalds committed
71 72

#ifndef CONFIG_MMU
73 74 75
static int elf_fdpic_map_file_constdisp_on_uclinux(struct elf_fdpic_params *,
						   struct file *,
						   struct mm_struct *);
Linus Torvalds's avatar
Linus Torvalds committed
76 77
#endif

78 79
static int elf_fdpic_map_file_by_direct_mmap(struct elf_fdpic_params *,
					     struct file *, struct mm_struct *);
Linus Torvalds's avatar
Linus Torvalds committed
80

81
#ifdef CONFIG_ELF_CORE
82
static int elf_fdpic_core_dump(struct coredump_params *cprm);
83 84
#endif

Linus Torvalds's avatar
Linus Torvalds committed
85 86 87
static struct linux_binfmt elf_fdpic_format = {
	.module		= THIS_MODULE,
	.load_binary	= load_elf_fdpic_binary,
88
#ifdef CONFIG_ELF_CORE
89 90
	.core_dump	= elf_fdpic_core_dump,
#endif
Linus Torvalds's avatar
Linus Torvalds committed
91 92 93
	.min_coredump	= ELF_EXEC_PAGESIZE,
};

94 95
static int __init init_elf_fdpic_binfmt(void)
{
Al Viro's avatar
Al Viro committed
96 97
	register_binfmt(&elf_fdpic_format);
	return 0;
98
}
Linus Torvalds's avatar
Linus Torvalds committed
99

100 101 102 103 104
static void __exit exit_elf_fdpic_binfmt(void)
{
	unregister_binfmt(&elf_fdpic_format);
}

105
core_initcall(init_elf_fdpic_binfmt);
106
module_exit(exit_elf_fdpic_binfmt);
Linus Torvalds's avatar
Linus Torvalds committed
107

108
static int is_elf(struct elfhdr *hdr, struct file *file)
Linus Torvalds's avatar
Linus Torvalds committed
109 110 111 112 113
{
	if (memcmp(hdr->e_ident, ELFMAG, SELFMAG) != 0)
		return 0;
	if (hdr->e_type != ET_EXEC && hdr->e_type != ET_DYN)
		return 0;
114
	if (!elf_check_arch(hdr))
Linus Torvalds's avatar
Linus Torvalds committed
115
		return 0;
Al Viro's avatar
Al Viro committed
116
	if (!file->f_op->mmap)
Linus Torvalds's avatar
Linus Torvalds committed
117 118 119 120
		return 0;
	return 1;
}

121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137
#ifndef elf_check_fdpic
#define elf_check_fdpic(x) 0
#endif

#ifndef elf_check_const_displacement
#define elf_check_const_displacement(x) 0
#endif

static int is_constdisp(struct elfhdr *hdr)
{
	if (!elf_check_fdpic(hdr))
		return 1;
	if (elf_check_const_displacement(hdr))
		return 1;
	return 0;
}

Linus Torvalds's avatar
Linus Torvalds committed
138 139 140 141
/*****************************************************************************/
/*
 * read the program headers table into memory
 */
142 143
static int elf_fdpic_fetch_phdrs(struct elf_fdpic_params *params,
				 struct file *file)
Linus Torvalds's avatar
Linus Torvalds committed
144 145 146 147
{
	struct elf32_phdr *phdr;
	unsigned long size;
	int retval, loop;
148
	loff_t pos = params->hdr.e_phoff;
Linus Torvalds's avatar
Linus Torvalds committed
149 150 151 152 153 154 155 156 157 158 159

	if (params->hdr.e_phentsize != sizeof(struct elf_phdr))
		return -ENOMEM;
	if (params->hdr.e_phnum > 65536U / sizeof(struct elf_phdr))
		return -ENOMEM;

	size = params->hdr.e_phnum * sizeof(struct elf_phdr);
	params->phdrs = kmalloc(size, GFP_KERNEL);
	if (!params->phdrs)
		return -ENOMEM;

160
	retval = kernel_read(file, params->phdrs, size, &pos);
161 162
	if (unlikely(retval != size))
		return retval < 0 ? retval : -ENOEXEC;
Linus Torvalds's avatar
Linus Torvalds committed
163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179

	/* determine stack size for this binary */
	phdr = params->phdrs;
	for (loop = 0; loop < params->hdr.e_phnum; loop++, phdr++) {
		if (phdr->p_type != PT_GNU_STACK)
			continue;

		if (phdr->p_flags & PF_X)
			params->flags |= ELF_FDPIC_FLAG_EXEC_STACK;
		else
			params->flags |= ELF_FDPIC_FLAG_NOEXEC_STACK;

		params->stack_size = phdr->p_memsz;
		break;
	}

	return 0;
180
}
Linus Torvalds's avatar
Linus Torvalds committed
181 182 183 184 185

/*****************************************************************************/
/*
 * load an fdpic binary into various bits of memory
 */
186
static int load_elf_fdpic_binary(struct linux_binprm *bprm)
Linus Torvalds's avatar
Linus Torvalds committed
187 188
{
	struct elf_fdpic_params exec_params, interp_params;
189
	struct pt_regs *regs = current_pt_regs();
Linus Torvalds's avatar
Linus Torvalds committed
190
	struct elf_phdr *phdr;
191 192 193
	unsigned long stack_size, entryaddr;
#ifdef ELF_FDPIC_PLAT_INIT
	unsigned long dynaddr;
194 195 196
#endif
#ifndef CONFIG_MMU
	unsigned long stack_prot;
197
#endif
Linus Torvalds's avatar
Linus Torvalds committed
198 199 200 201
	struct file *interpreter = NULL; /* to shut gcc up */
	char *interpreter_name = NULL;
	int executable_stack;
	int retval, i;
202
	loff_t pos;
Linus Torvalds's avatar
Linus Torvalds committed
203

204 205
	kdebug("____ LOAD %d ____", current->pid);

Linus Torvalds's avatar
Linus Torvalds committed
206 207 208 209 210 211 212 213
	memset(&exec_params, 0, sizeof(exec_params));
	memset(&interp_params, 0, sizeof(interp_params));

	exec_params.hdr = *(struct elfhdr *) bprm->buf;
	exec_params.flags = ELF_FDPIC_FLAG_PRESENT | ELF_FDPIC_FLAG_EXECUTABLE;

	/* check that this is a binary we know how to deal with */
	retval = -ENOEXEC;
214
	if (!is_elf(&exec_params.hdr, bprm->file))
Linus Torvalds's avatar
Linus Torvalds committed
215
		goto error;
216 217 218 219 220 221 222 223 224 225
	if (!elf_check_fdpic(&exec_params.hdr)) {
#ifdef CONFIG_MMU
		/* binfmt_elf handles non-fdpic elf except on nommu */
		goto error;
#else
		/* nommu can only load ET_DYN (PIE) ELF */
		if (exec_params.hdr.e_type != ET_DYN)
			goto error;
#endif
	}
Linus Torvalds's avatar
Linus Torvalds committed
226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245

	/* read the program header table */
	retval = elf_fdpic_fetch_phdrs(&exec_params, bprm->file);
	if (retval < 0)
		goto error;

	/* scan for a program header that specifies an interpreter */
	phdr = exec_params.phdrs;

	for (i = 0; i < exec_params.hdr.e_phnum; i++, phdr++) {
		switch (phdr->p_type) {
		case PT_INTERP:
			retval = -ENOMEM;
			if (phdr->p_filesz > PATH_MAX)
				goto error;
			retval = -ENOENT;
			if (phdr->p_filesz < 2)
				goto error;

			/* read the name of the interpreter into memory */
246
			interpreter_name = kmalloc(phdr->p_filesz, GFP_KERNEL);
Linus Torvalds's avatar
Linus Torvalds committed
247 248 249
			if (!interpreter_name)
				goto error;

250 251 252
			pos = phdr->p_offset;
			retval = kernel_read(bprm->file, interpreter_name,
					     phdr->p_filesz, &pos);
253 254 255
			if (unlikely(retval != phdr->p_filesz)) {
				if (retval >= 0)
					retval = -ENOEXEC;
Linus Torvalds's avatar
Linus Torvalds committed
256
				goto error;
257
			}
Linus Torvalds's avatar
Linus Torvalds committed
258 259 260 261 262 263 264 265 266 267 268 269 270 271 272

			retval = -ENOENT;
			if (interpreter_name[phdr->p_filesz - 1] != '\0')
				goto error;

			kdebug("Using ELF interpreter %s", interpreter_name);

			/* replace the program with the interpreter */
			interpreter = open_exec(interpreter_name);
			retval = PTR_ERR(interpreter);
			if (IS_ERR(interpreter)) {
				interpreter = NULL;
				goto error;
			}

273 274 275 276 277
			/*
			 * If the binary is not readable then enforce
			 * mm->dumpable = 0 regardless of the interpreter's
			 * permissions.
			 */
278
			would_dump(bprm, interpreter);
279

280 281 282
			pos = 0;
			retval = kernel_read(interpreter, bprm->buf,
					BINPRM_BUF_SIZE, &pos);
283 284 285
			if (unlikely(retval != BINPRM_BUF_SIZE)) {
				if (retval >= 0)
					retval = -ENOEXEC;
Linus Torvalds's avatar
Linus Torvalds committed
286
				goto error;
287
			}
Linus Torvalds's avatar
Linus Torvalds committed
288 289 290 291 292 293 294 295 296 297 298 299 300 301

			interp_params.hdr = *((struct elfhdr *) bprm->buf);
			break;

		case PT_LOAD:
#ifdef CONFIG_MMU
			if (exec_params.load_addr == 0)
				exec_params.load_addr = phdr->p_vaddr;
#endif
			break;
		}

	}

302
	if (is_constdisp(&exec_params.hdr))
Linus Torvalds's avatar
Linus Torvalds committed
303 304 305 306 307
		exec_params.flags |= ELF_FDPIC_FLAG_CONSTDISP;

	/* perform insanity checks on the interpreter */
	if (interpreter_name) {
		retval = -ELIBBAD;
308
		if (!is_elf(&interp_params.hdr, interpreter))
Linus Torvalds's avatar
Linus Torvalds committed
309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326
			goto error;

		interp_params.flags = ELF_FDPIC_FLAG_PRESENT;

		/* read the interpreter's program header table */
		retval = elf_fdpic_fetch_phdrs(&interp_params, interpreter);
		if (retval < 0)
			goto error;
	}

	stack_size = exec_params.stack_size;
	if (exec_params.flags & ELF_FDPIC_FLAG_EXEC_STACK)
		executable_stack = EXSTACK_ENABLE_X;
	else if (exec_params.flags & ELF_FDPIC_FLAG_NOEXEC_STACK)
		executable_stack = EXSTACK_DISABLE_X;
	else
		executable_stack = EXSTACK_DEFAULT;

327 328 329 330 331 332 333 334 335 336
	if (stack_size == 0) {
		stack_size = interp_params.stack_size;
		if (interp_params.flags & ELF_FDPIC_FLAG_EXEC_STACK)
			executable_stack = EXSTACK_ENABLE_X;
		else if (interp_params.flags & ELF_FDPIC_FLAG_NOEXEC_STACK)
			executable_stack = EXSTACK_DISABLE_X;
		else
			executable_stack = EXSTACK_DEFAULT;
	}

Linus Torvalds's avatar
Linus Torvalds committed
337 338
	retval = -ENOEXEC;
	if (stack_size == 0)
339
		stack_size = 131072UL; /* same as exec.c's default commit */
Linus Torvalds's avatar
Linus Torvalds committed
340

341
	if (is_constdisp(&interp_params.hdr))
Linus Torvalds's avatar
Linus Torvalds committed
342 343 344 345 346 347 348 349
		interp_params.flags |= ELF_FDPIC_FLAG_CONSTDISP;

	/* flush all traces of the currently running executable */
	retval = flush_old_exec(bprm);
	if (retval)
		goto error;

	/* there's now no turning back... the old userspace image is dead,
350 351
	 * defunct, deceased, etc.
	 */
352 353 354 355
	if (elf_check_fdpic(&exec_params.hdr))
		set_personality(PER_LINUX_FDPIC);
	else
		set_personality(PER_LINUX);
356 357
	if (elf_read_implies_exec(&exec_params.hdr, executable_stack))
		current->personality |= READ_IMPLIES_EXEC;
358 359 360

	setup_new_exec(bprm);

Linus Torvalds's avatar
Linus Torvalds committed
361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376
	set_binfmt(&elf_fdpic_format);

	current->mm->start_code = 0;
	current->mm->end_code = 0;
	current->mm->start_stack = 0;
	current->mm->start_data = 0;
	current->mm->end_data = 0;
	current->mm->context.exec_fdpic_loadmap = 0;
	current->mm->context.interp_fdpic_loadmap = 0;

#ifdef CONFIG_MMU
	elf_fdpic_arch_lay_out_mm(&exec_params,
				  &interp_params,
				  &current->mm->start_stack,
				  &current->mm->start_brk);

377 378
	retval = setup_arg_pages(bprm, current->mm->start_stack,
				 executable_stack);
379 380
	if (retval < 0)
		goto error;
381 382 383 384 385
#ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
	retval = arch_setup_additional_pages(bprm, !!interpreter_name);
	if (retval < 0)
		goto error;
#endif
Linus Torvalds's avatar
Linus Torvalds committed
386 387 388
#endif

	/* load the executable and interpreter into memory */
389 390
	retval = elf_fdpic_map_file(&exec_params, bprm->file, current->mm,
				    "executable");
Linus Torvalds's avatar
Linus Torvalds committed
391
	if (retval < 0)
392
		goto error;
Linus Torvalds's avatar
Linus Torvalds committed
393 394 395 396 397 398

	if (interpreter_name) {
		retval = elf_fdpic_map_file(&interp_params, interpreter,
					    current->mm, "interpreter");
		if (retval < 0) {
			printk(KERN_ERR "Unable to load interpreter\n");
399
			goto error;
Linus Torvalds's avatar
Linus Torvalds committed
400 401 402 403 404 405 406 407 408 409 410
		}

		allow_write_access(interpreter);
		fput(interpreter);
		interpreter = NULL;
	}

#ifdef CONFIG_MMU
	if (!current->mm->start_brk)
		current->mm->start_brk = current->mm->end_data;

411 412
	current->mm->brk = current->mm->start_brk =
		PAGE_ALIGN(current->mm->start_brk);
Linus Torvalds's avatar
Linus Torvalds committed
413 414

#else
415
	/* create a stack area and zero-size brk area */
Linus Torvalds's avatar
Linus Torvalds committed
416 417 418 419
	stack_size = (stack_size + PAGE_SIZE - 1) & PAGE_MASK;
	if (stack_size < PAGE_SIZE * 2)
		stack_size = PAGE_SIZE * 2;

420 421 422 423 424
	stack_prot = PROT_READ | PROT_WRITE;
	if (executable_stack == EXSTACK_ENABLE_X ||
	    (executable_stack == EXSTACK_DEFAULT && VM_STACK_FLAGS & VM_EXEC))
		stack_prot |= PROT_EXEC;

425
	current->mm->start_brk = vm_mmap(NULL, 0, stack_size, stack_prot,
426 427
					 MAP_PRIVATE | MAP_ANONYMOUS |
					 MAP_UNINITIALIZED | MAP_GROWSDOWN,
Linus Torvalds's avatar
Linus Torvalds committed
428 429
					 0);

430
	if (IS_ERR_VALUE(current->mm->start_brk)) {
Linus Torvalds's avatar
Linus Torvalds committed
431 432
		retval = current->mm->start_brk;
		current->mm->start_brk = 0;
433
		goto error;
Linus Torvalds's avatar
Linus Torvalds committed
434 435 436 437 438 439 440
	}

	current->mm->brk = current->mm->start_brk;
	current->mm->context.end_brk = current->mm->start_brk;
	current->mm->start_stack = current->mm->start_brk + stack_size;
#endif

441
	install_exec_creds(bprm);
442 443
	if (create_elf_fdpic_tables(bprm, current->mm,
				    &exec_params, &interp_params) < 0)
444
		goto error;
Linus Torvalds's avatar
Linus Torvalds committed
445

446 447 448 449 450 451 452
	kdebug("- start_code  %lx", current->mm->start_code);
	kdebug("- end_code    %lx", current->mm->end_code);
	kdebug("- start_data  %lx", current->mm->start_data);
	kdebug("- end_data    %lx", current->mm->end_data);
	kdebug("- start_brk   %lx", current->mm->start_brk);
	kdebug("- brk         %lx", current->mm->brk);
	kdebug("- start_stack %lx", current->mm->start_stack);
Linus Torvalds's avatar
Linus Torvalds committed
453 454 455 456 457 458 459 460

#ifdef ELF_FDPIC_PLAT_INIT
	/*
	 * The ABI may specify that certain registers be set up in special
	 * ways (on i386 %edx is the address of a DT_FINI function, for
	 * example.  This macro performs whatever initialization to
	 * the regs structure is required.
	 */
461 462 463
	dynaddr = interp_params.dynamic_addr ?: exec_params.dynamic_addr;
	ELF_FDPIC_PLAT_INIT(regs, exec_params.map_addr, interp_params.map_addr,
			    dynaddr);
Linus Torvalds's avatar
Linus Torvalds committed
464 465 466
#endif

	/* everything is now ready... get the userspace context ready to roll */
467 468
	entryaddr = interp_params.entry_addr ?: exec_params.entry_addr;
	start_thread(regs, entryaddr, current->mm->start_stack);
Linus Torvalds's avatar
Linus Torvalds committed
469 470 471 472 473 474 475 476

	retval = 0;

error:
	if (interpreter) {
		allow_write_access(interpreter);
		fput(interpreter);
	}
Jesper Juhl's avatar
Jesper Juhl committed
477 478 479 480 481
	kfree(interpreter_name);
	kfree(exec_params.phdrs);
	kfree(exec_params.loadmap);
	kfree(interp_params.phdrs);
	kfree(interp_params.loadmap);
Linus Torvalds's avatar
Linus Torvalds committed
482
	return retval;
483
}
Linus Torvalds's avatar
Linus Torvalds committed
484 485

/*****************************************************************************/
486 487 488 489 490 491 492 493 494 495

#ifndef ELF_BASE_PLATFORM
/*
 * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture.
 * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value
 * will be copied to the user stack in the same manner as AT_PLATFORM.
 */
#define ELF_BASE_PLATFORM NULL
#endif

Linus Torvalds's avatar
Linus Torvalds committed
496
/*
497 498
 * present useful information to the program by shovelling it onto the new
 * process's stack
Linus Torvalds's avatar
Linus Torvalds committed
499 500 501 502 503 504
 */
static int create_elf_fdpic_tables(struct linux_binprm *bprm,
				   struct mm_struct *mm,
				   struct elf_fdpic_params *exec_params,
				   struct elf_fdpic_params *interp_params)
{
505
	const struct cred *cred = current_cred();
Linus Torvalds's avatar
Linus Torvalds committed
506
	unsigned long sp, csp, nitems;
507
	elf_caddr_t __user *argv, *envp;
Linus Torvalds's avatar
Linus Torvalds committed
508
	size_t platform_len = 0, len;
509 510
	char *k_platform, *k_base_platform;
	char __user *u_platform, *u_base_platform, *p;
Linus Torvalds's avatar
Linus Torvalds committed
511
	int loop;
512
	int nr;	/* reset for each csp adjustment */
Linus Torvalds's avatar
Linus Torvalds committed
513 514

#ifdef CONFIG_MMU
515 516 517 518 519 520
	/* In some cases (e.g. Hyper-Threading), we want to avoid L1 evictions
	 * by the processes running on the same package. One thing we can do is
	 * to shuffle the initial stack for them, so we give the architecture
	 * an opportunity to do so here.
	 */
	sp = arch_align_stack(bprm->p);
Linus Torvalds's avatar
Linus Torvalds committed
521 522 523 524
#else
	sp = mm->start_stack;

	/* stack the program arguments and environment */
525
	if (transfer_args_to_stack(bprm, &sp) < 0)
Linus Torvalds's avatar
Linus Torvalds committed
526
		return -EFAULT;
527
	sp &= ~15;
Linus Torvalds's avatar
Linus Torvalds committed
528 529
#endif

530 531 532 533 534 535
	/*
	 * If this architecture has a platform capability string, copy it
	 * to userspace.  In some cases (Sparc), this info is impossible
	 * for userspace to get any other way, in others (i386) it is
	 * merely difficult.
	 */
Linus Torvalds's avatar
Linus Torvalds committed
536
	k_platform = ELF_PLATFORM;
537
	u_platform = NULL;
Linus Torvalds's avatar
Linus Torvalds committed
538 539 540 541

	if (k_platform) {
		platform_len = strlen(k_platform) + 1;
		sp -= platform_len;
542
		u_platform = (char __user *) sp;
Linus Torvalds's avatar
Linus Torvalds committed
543 544 545 546
		if (__copy_to_user(u_platform, k_platform, platform_len) != 0)
			return -EFAULT;
	}

547 548 549 550 551 552 553 554 555 556 557 558 559 560 561
	/*
	 * If this architecture has a "base" platform capability
	 * string, copy it to userspace.
	 */
	k_base_platform = ELF_BASE_PLATFORM;
	u_base_platform = NULL;

	if (k_base_platform) {
		platform_len = strlen(k_base_platform) + 1;
		sp -= platform_len;
		u_base_platform = (char __user *) sp;
		if (__copy_to_user(u_base_platform, k_base_platform, platform_len) != 0)
			return -EFAULT;
	}

Linus Torvalds's avatar
Linus Torvalds committed
562 563 564 565 566 567 568 569
	sp &= ~7UL;

	/* stack the load map(s) */
	len = sizeof(struct elf32_fdpic_loadmap);
	len += sizeof(struct elf32_fdpic_loadseg) * exec_params->loadmap->nsegs;
	sp = (sp - len) & ~7UL;
	exec_params->map_addr = sp;

570
	if (copy_to_user((void __user *) sp, exec_params->loadmap, len) != 0)
Linus Torvalds's avatar
Linus Torvalds committed
571 572 573 574 575 576
		return -EFAULT;

	current->mm->context.exec_fdpic_loadmap = (unsigned long) sp;

	if (interp_params->loadmap) {
		len = sizeof(struct elf32_fdpic_loadmap);
577 578
		len += sizeof(struct elf32_fdpic_loadseg) *
			interp_params->loadmap->nsegs;
Linus Torvalds's avatar
Linus Torvalds committed
579 580 581
		sp = (sp - len) & ~7UL;
		interp_params->map_addr = sp;

582 583
		if (copy_to_user((void __user *) sp, interp_params->loadmap,
				 len) != 0)
Linus Torvalds's avatar
Linus Torvalds committed
584 585 586 587 588 589
			return -EFAULT;

		current->mm->context.interp_fdpic_loadmap = (unsigned long) sp;
	}

	/* force 16 byte _final_ alignment here for generality */
590
#define DLINFO_ITEMS 15
Linus Torvalds's avatar
Linus Torvalds committed
591

592 593
	nitems = 1 + DLINFO_ITEMS + (k_platform ? 1 : 0) +
		(k_base_platform ? 1 : 0) + AT_VECTOR_SIZE_ARCH;
Linus Torvalds's avatar
Linus Torvalds committed
594

595 596 597
	if (bprm->interp_flags & BINPRM_FLAGS_EXECFD)
		nitems++;

Linus Torvalds's avatar
Linus Torvalds committed
598 599 600 601 602 603 604 605 606 607
	csp = sp;
	sp -= nitems * 2 * sizeof(unsigned long);
	sp -= (bprm->envc + 1) * sizeof(char *);	/* envv[] */
	sp -= (bprm->argc + 1) * sizeof(char *);	/* argv[] */
	sp -= 1 * sizeof(unsigned long);		/* argc */

	csp -= sp & 15UL;
	sp -= sp & 15UL;

	/* put the ELF interpreter info on the stack */
608
#define NEW_AUX_ENT(id, val)						\
609 610 611 612 613 614
	do {								\
		struct { unsigned long _id, _val; } __user *ent;	\
									\
		ent = (void __user *) csp;				\
		__put_user((id), &ent[nr]._id);				\
		__put_user((val), &ent[nr]._val);			\
615
		nr++;							\
Linus Torvalds's avatar
Linus Torvalds committed
616 617
	} while (0)

618
	nr = 0;
Linus Torvalds's avatar
Linus Torvalds committed
619
	csp -= 2 * sizeof(unsigned long);
620
	NEW_AUX_ENT(AT_NULL, 0);
Linus Torvalds's avatar
Linus Torvalds committed
621
	if (k_platform) {
622
		nr = 0;
Linus Torvalds's avatar
Linus Torvalds committed
623
		csp -= 2 * sizeof(unsigned long);
624
		NEW_AUX_ENT(AT_PLATFORM,
625
			    (elf_addr_t) (unsigned long) u_platform);
Linus Torvalds's avatar
Linus Torvalds committed
626 627
	}

628 629 630 631 632 633 634
	if (k_base_platform) {
		nr = 0;
		csp -= 2 * sizeof(unsigned long);
		NEW_AUX_ENT(AT_BASE_PLATFORM,
			    (elf_addr_t) (unsigned long) u_base_platform);
	}

635 636 637 638 639 640
	if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) {
		nr = 0;
		csp -= 2 * sizeof(unsigned long);
		NEW_AUX_ENT(AT_EXECFD, bprm->interp_data);
	}

641
	nr = 0;
Linus Torvalds's avatar
Linus Torvalds committed
642
	csp -= DLINFO_ITEMS * 2 * sizeof(unsigned long);
643 644 645 646
	NEW_AUX_ENT(AT_HWCAP,	ELF_HWCAP);
#ifdef ELF_HWCAP2
	NEW_AUX_ENT(AT_HWCAP2,	ELF_HWCAP2);
#endif
647 648 649 650 651 652 653 654
	NEW_AUX_ENT(AT_PAGESZ,	PAGE_SIZE);
	NEW_AUX_ENT(AT_CLKTCK,	CLOCKS_PER_SEC);
	NEW_AUX_ENT(AT_PHDR,	exec_params->ph_addr);
	NEW_AUX_ENT(AT_PHENT,	sizeof(struct elf_phdr));
	NEW_AUX_ENT(AT_PHNUM,	exec_params->hdr.e_phnum);
	NEW_AUX_ENT(AT_BASE,	interp_params->elfhdr_addr);
	NEW_AUX_ENT(AT_FLAGS,	0);
	NEW_AUX_ENT(AT_ENTRY,	exec_params->entry_addr);
655 656 657 658
	NEW_AUX_ENT(AT_UID,	(elf_addr_t) from_kuid_munged(cred->user_ns, cred->uid));
	NEW_AUX_ENT(AT_EUID,	(elf_addr_t) from_kuid_munged(cred->user_ns, cred->euid));
	NEW_AUX_ENT(AT_GID,	(elf_addr_t) from_kgid_munged(cred->user_ns, cred->gid));
	NEW_AUX_ENT(AT_EGID,	(elf_addr_t) from_kgid_munged(cred->user_ns, cred->egid));
659
	NEW_AUX_ENT(AT_SECURE,	bprm->secureexec);
660
	NEW_AUX_ENT(AT_EXECFN,	bprm->exec);
Linus Torvalds's avatar
Linus Torvalds committed
661 662

#ifdef ARCH_DLINFO
663 664 665
	nr = 0;
	csp -= AT_VECTOR_SIZE_ARCH * 2 * sizeof(unsigned long);

Linus Torvalds's avatar
Linus Torvalds committed
666 667 668 669 670 671 672 673 674
	/* ARCH_DLINFO must come last so platform specific code can enforce
	 * special alignment requirements on the AUXV if necessary (eg. PPC).
	 */
	ARCH_DLINFO;
#endif
#undef NEW_AUX_ENT

	/* allocate room for argv[] and envv[] */
	csp -= (bprm->envc + 1) * sizeof(elf_caddr_t);
675
	envp = (elf_caddr_t __user *) csp;
Linus Torvalds's avatar
Linus Torvalds committed
676
	csp -= (bprm->argc + 1) * sizeof(elf_caddr_t);
677
	argv = (elf_caddr_t __user *) csp;
Linus Torvalds's avatar
Linus Torvalds committed
678 679 680

	/* stack argc */
	csp -= sizeof(unsigned long);
681
	__put_user(bprm->argc, (unsigned long __user *) csp);
Linus Torvalds's avatar
Linus Torvalds committed
682

683
	BUG_ON(csp != sp);
Linus Torvalds's avatar
Linus Torvalds committed
684 685 686 687 688

	/* fill in the argv[] array */
#ifdef CONFIG_MMU
	current->mm->arg_start = bprm->p;
#else
689 690
	current->mm->arg_start = current->mm->start_stack -
		(MAX_ARG_PAGES * PAGE_SIZE - bprm->p);
Linus Torvalds's avatar
Linus Torvalds committed
691 692
#endif

693
	p = (char __user *) current->mm->arg_start;
Linus Torvalds's avatar
Linus Torvalds committed
694 695
	for (loop = bprm->argc; loop > 0; loop--) {
		__put_user((elf_caddr_t) p, argv++);
696 697
		len = strnlen_user(p, MAX_ARG_STRLEN);
		if (!len || len > MAX_ARG_STRLEN)
Linus Torvalds's avatar
Linus Torvalds committed
698 699 700 701 702 703 704 705 706 707
			return -EINVAL;
		p += len;
	}
	__put_user(NULL, argv);
	current->mm->arg_end = (unsigned long) p;

	/* fill in the envv[] array */
	current->mm->env_start = (unsigned long) p;
	for (loop = bprm->envc; loop > 0; loop--) {
		__put_user((elf_caddr_t)(unsigned long) p, envp++);
708 709
		len = strnlen_user(p, MAX_ARG_STRLEN);
		if (!len || len > MAX_ARG_STRLEN)
Linus Torvalds's avatar
Linus Torvalds committed
710 711 712 713 714 715 716 717
			return -EINVAL;
		p += len;
	}
	__put_user(NULL, envp);
	current->mm->env_end = (unsigned long) p;

	mm->start_stack = (unsigned long) sp;
	return 0;
718
}
Linus Torvalds's avatar
Linus Torvalds committed
719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756

/*****************************************************************************/
/*
 * load the appropriate binary image (executable or interpreter) into memory
 * - we assume no MMU is available
 * - if no other PIC bits are set in params->hdr->e_flags
 *   - we assume that the LOADable segments in the binary are independently relocatable
 *   - we assume R/O executable segments are shareable
 * - else
 *   - we assume the loadable parts of the image to require fixed displacement
 *   - the image is not shareable
 */
static int elf_fdpic_map_file(struct elf_fdpic_params *params,
			      struct file *file,
			      struct mm_struct *mm,
			      const char *what)
{
	struct elf32_fdpic_loadmap *loadmap;
#ifdef CONFIG_MMU
	struct elf32_fdpic_loadseg *mseg;
#endif
	struct elf32_fdpic_loadseg *seg;
	struct elf32_phdr *phdr;
	unsigned long load_addr, stop;
	unsigned nloads, tmp;
	size_t size;
	int loop, ret;

	/* allocate a load map table */
	nloads = 0;
	for (loop = 0; loop < params->hdr.e_phnum; loop++)
		if (params->phdrs[loop].p_type == PT_LOAD)
			nloads++;

	if (nloads == 0)
		return -ELIBBAD;

	size = sizeof(*loadmap) + nloads * sizeof(*seg);
757
	loadmap = kzalloc(size, GFP_KERNEL);
Linus Torvalds's avatar
Linus Torvalds committed
758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790
	if (!loadmap)
		return -ENOMEM;

	params->loadmap = loadmap;

	loadmap->version = ELF32_FDPIC_LOADMAP_VERSION;
	loadmap->nsegs = nloads;

	load_addr = params->load_addr;
	seg = loadmap->segs;

	/* map the requested LOADs into the memory space */
	switch (params->flags & ELF_FDPIC_FLAG_ARRANGEMENT) {
	case ELF_FDPIC_FLAG_CONSTDISP:
	case ELF_FDPIC_FLAG_CONTIGUOUS:
#ifndef CONFIG_MMU
		ret = elf_fdpic_map_file_constdisp_on_uclinux(params, file, mm);
		if (ret < 0)
			return ret;
		break;
#endif
	default:
		ret = elf_fdpic_map_file_by_direct_mmap(params, file, mm);
		if (ret < 0)
			return ret;
		break;
	}

	/* map the entry point */
	if (params->hdr.e_entry) {
		seg = loadmap->segs;
		for (loop = loadmap->nsegs; loop > 0; loop--, seg++) {
			if (params->hdr.e_entry >= seg->p_vaddr &&
791
			    params->hdr.e_entry < seg->p_vaddr + seg->p_memsz) {
Linus Torvalds's avatar
Linus Torvalds committed
792
				params->entry_addr =
793 794
					(params->hdr.e_entry - seg->p_vaddr) +
					seg->addr;
Linus Torvalds's avatar
Linus Torvalds committed
795 796 797 798 799 800
				break;
			}
		}
	}

	/* determine where the program header table has wound up if mapped */
801 802
	stop = params->hdr.e_phoff;
	stop += params->hdr.e_phnum * sizeof (struct elf_phdr);
Linus Torvalds's avatar
Linus Torvalds committed
803 804 805 806 807 808 809 810 811 812 813 814 815
	phdr = params->phdrs;

	for (loop = 0; loop < params->hdr.e_phnum; loop++, phdr++) {
		if (phdr->p_type != PT_LOAD)
			continue;

		if (phdr->p_offset > params->hdr.e_phoff ||
		    phdr->p_offset + phdr->p_filesz < stop)
			continue;

		seg = loadmap->segs;
		for (loop = loadmap->nsegs; loop > 0; loop--, seg++) {
			if (phdr->p_vaddr >= seg->p_vaddr &&
816 817 818 819 820
			    phdr->p_vaddr + phdr->p_filesz <=
			    seg->p_vaddr + seg->p_memsz) {
				params->ph_addr =
					(phdr->p_vaddr - seg->p_vaddr) +
					seg->addr +
Linus Torvalds's avatar
Linus Torvalds committed
821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836
					params->hdr.e_phoff - phdr->p_offset;
				break;
			}
		}
		break;
	}

	/* determine where the dynamic section has wound up if there is one */
	phdr = params->phdrs;
	for (loop = 0; loop < params->hdr.e_phnum; loop++, phdr++) {
		if (phdr->p_type != PT_DYNAMIC)
			continue;

		seg = loadmap->segs;
		for (loop = loadmap->nsegs; loop > 0; loop--, seg++) {
			if (phdr->p_vaddr >= seg->p_vaddr &&
837 838
			    phdr->p_vaddr + phdr->p_memsz <=
			    seg->p_vaddr + seg->p_memsz) {
839 840 841
				Elf32_Dyn __user *dyn;
				Elf32_Sword d_tag;

842 843 844 845 846 847 848
				params->dynamic_addr =
					(phdr->p_vaddr - seg->p_vaddr) +
					seg->addr;

				/* check the dynamic section contains at least
				 * one item, and that the last item is a NULL
				 * entry */
Linus Torvalds's avatar
Linus Torvalds committed
849 850 851 852 853
				if (phdr->p_memsz == 0 ||
				    phdr->p_memsz % sizeof(Elf32_Dyn) != 0)
					goto dynamic_error;

				tmp = phdr->p_memsz / sizeof(Elf32_Dyn);
854 855 856
				dyn = (Elf32_Dyn __user *)params->dynamic_addr;
				__get_user(d_tag, &dyn[tmp - 1].d_tag);
				if (d_tag != 0)
Linus Torvalds's avatar
Linus Torvalds committed
857 858 859 860 861 862 863 864
					goto dynamic_error;
				break;
			}
		}
		break;
	}

	/* now elide adjacent segments in the load map on MMU linux
865 866
	 * - on uClinux the holes between may actually be filled with system
	 *   stuff or stuff from other processes
Linus Torvalds's avatar
Linus Torvalds committed
867 868 869 870 871 872 873 874 875 876
	 */
#ifdef CONFIG_MMU
	nloads = loadmap->nsegs;
	mseg = loadmap->segs;
	seg = mseg + 1;
	for (loop = 1; loop < nloads; loop++) {
		/* see if we have a candidate for merging */
		if (seg->p_vaddr - mseg->p_vaddr == seg->addr - mseg->addr) {
			load_addr = PAGE_ALIGN(mseg->addr + mseg->p_memsz);
			if (load_addr == (seg->addr & PAGE_MASK)) {
877 878 879
				mseg->p_memsz +=
					load_addr -
					(mseg->addr + mseg->p_memsz);
Linus Torvalds's avatar
Linus Torvalds committed
880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906
				mseg->p_memsz += seg->addr & ~PAGE_MASK;
				mseg->p_memsz += seg->p_memsz;
				loadmap->nsegs--;
				continue;
			}
		}

		mseg++;
		if (mseg != seg)
			*mseg = *seg;
	}
#endif

	kdebug("Mapped Object [%s]:", what);
	kdebug("- elfhdr   : %lx", params->elfhdr_addr);
	kdebug("- entry    : %lx", params->entry_addr);
	kdebug("- PHDR[]   : %lx", params->ph_addr);
	kdebug("- DYNAMIC[]: %lx", params->dynamic_addr);
	seg = loadmap->segs;
	for (loop = 0; loop < loadmap->nsegs; loop++, seg++)
		kdebug("- LOAD[%d] : %08x-%08x [va=%x ms=%x]",
		       loop,
		       seg->addr, seg->addr + seg->p_memsz - 1,
		       seg->p_vaddr, seg->p_memsz);

	return 0;

907
dynamic_error:
Linus Torvalds's avatar
Linus Torvalds committed
908
	printk("ELF FDPIC %s with invalid DYNAMIC section (inode=%lu)\n",
Al Viro's avatar
Al Viro committed
909
	       what, file_inode(file)->i_ino);
Linus Torvalds's avatar
Linus Torvalds committed
910
	return -ELIBBAD;
911
}
Linus Torvalds's avatar
Linus Torvalds committed
912 913 914 915 916 917

/*****************************************************************************/
/*
 * map a file with constant displacement under uClinux
 */
#ifndef CONFIG_MMU
918 919 920 921
static int elf_fdpic_map_file_constdisp_on_uclinux(
	struct elf_fdpic_params *params,
	struct file *file,
	struct mm_struct *mm)
Linus Torvalds's avatar
Linus Torvalds committed
922 923 924 925 926 927 928 929 930
{
	struct elf32_fdpic_loadseg *seg;
	struct elf32_phdr *phdr;
	unsigned long load_addr, base = ULONG_MAX, top = 0, maddr = 0, mflags;
	int loop, ret;

	load_addr = params->load_addr;
	seg = params->loadmap->segs;

931 932
	/* determine the bounds of the contiguous overall allocation we must
	 * make */
Linus Torvalds's avatar
Linus Torvalds committed
933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948
	phdr = params->phdrs;
	for (loop = 0; loop < params->hdr.e_phnum; loop++, phdr++) {
		if (params->phdrs[loop].p_type != PT_LOAD)
			continue;

		if (base > phdr->p_vaddr)
			base = phdr->p_vaddr;
		if (top < phdr->p_vaddr + phdr->p_memsz)
			top = phdr->p_vaddr + phdr->p_memsz;
	}

	/* allocate one big anon block for everything */
	mflags = MAP_PRIVATE;
	if (params->flags & ELF_FDPIC_FLAG_EXECUTABLE)
		mflags |= MAP_EXECUTABLE;

949
	maddr = vm_mmap(NULL, load_addr, top - base,
Linus Torvalds's avatar
Linus Torvalds committed
950
			PROT_READ | PROT_WRITE | PROT_EXEC, mflags, 0);
951
	if (IS_ERR_VALUE(maddr))
Linus Torvalds's avatar
Linus Torvalds committed
952 953 954 955 956 957 958 959 960 961 962 963 964 965 966
		return (int) maddr;

	if (load_addr != 0)
		load_addr += PAGE_ALIGN(top - base);

	/* and then load the file segments into it */
	phdr = params->phdrs;
	for (loop = 0; loop < params->hdr.e_phnum; loop++, phdr++) {
		if (params->phdrs[loop].p_type != PT_LOAD)
			continue;

		seg->addr = maddr + (phdr->p_vaddr - base);
		seg->p_vaddr = phdr->p_vaddr;
		seg->p_memsz = phdr->p_memsz;

Al Viro's avatar
Al Viro committed
967 968
		ret = read_code(file, seg->addr, phdr->p_offset,
				       phdr->p_filesz);
Linus Torvalds's avatar
Linus Torvalds committed
969 970 971 972 973 974 975 976
		if (ret < 0)
			return ret;

		/* map the ELF header address if in this segment */
		if (phdr->p_offset == 0)
			params->elfhdr_addr = seg->addr;

		/* clear any space allocated but not loaded */
977
		if (phdr->p_filesz < phdr->p_memsz) {
978 979 980
			if (clear_user((void *) (seg->addr + phdr->p_filesz),
				       phdr->p_memsz - phdr->p_filesz))
				return -EFAULT;
981
		}
Linus Torvalds's avatar
Linus Torvalds committed
982 983 984

		if (mm) {
			if (phdr->p_flags & PF_X) {
985 986 987 988 989
				if (!mm->start_code) {
					mm->start_code = seg->addr;
					mm->end_code = seg->addr +
						phdr->p_memsz;
				}
990
			} else if (!mm->start_data) {
Linus Torvalds's avatar
Linus Torvalds committed
991 992 993 994 995 996 997 998 999
				mm->start_data = seg->addr;
				mm->end_data = seg->addr + phdr->p_memsz;
			}
		}

		seg++;
	}

	return 0;
1000
}
Linus Torvalds's avatar
Linus Torvalds committed
1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013
#endif

/*****************************************************************************/
/*
 * map a binary by direct mmap() of the individual PT_LOAD segments
 */
static int elf_fdpic_map_file_by_direct_mmap(struct elf_fdpic_params *params,
					     struct file *file,
					     struct mm_struct *mm)
{
	struct elf32_fdpic_loadseg *seg;
	struct elf32_phdr *phdr;
	unsigned long load_addr, delta_vaddr;
1014
	int loop, dvset;
Linus Torvalds's avatar
Linus Torvalds committed
1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060

	load_addr = params->load_addr;
	delta_vaddr = 0;
	dvset = 0;

	seg = params->loadmap->segs;

	/* deal with each load segment separately */
	phdr = params->phdrs;
	for (loop = 0; loop < params->hdr.e_phnum; loop++, phdr++) {
		unsigned long maddr, disp, excess, excess1;
		int prot = 0, flags;

		if (phdr->p_type != PT_LOAD)
			continue;

		kdebug("[LOAD] va=%lx of=%lx fs=%lx ms=%lx",
		       (unsigned long) phdr->p_vaddr,
		       (unsigned long) phdr->p_offset,
		       (unsigned long) phdr->p_filesz,
		       (unsigned long) phdr->p_memsz);

		/* determine the mapping parameters */
		if (phdr->p_flags & PF_R) prot |= PROT_READ;
		if (phdr->p_flags & PF_W) prot |= PROT_WRITE;
		if (phdr->p_flags & PF_X) prot |= PROT_EXEC;

		flags = MAP_PRIVATE | MAP_DENYWRITE;
		if (params->flags & ELF_FDPIC_FLAG_EXECUTABLE)
			flags |= MAP_EXECUTABLE;

		maddr = 0;

		switch (params->flags & ELF_FDPIC_FLAG_ARRANGEMENT) {
		case ELF_FDPIC_FLAG_INDEPENDENT:
			/* PT_LOADs are independently locatable */
			break;

		case ELF_FDPIC_FLAG_HONOURVADDR:
			/* the specified virtual address must be honoured */
			maddr = phdr->p_vaddr;
			flags |= MAP_FIXED;
			break;

		case ELF_FDPIC_FLAG_CONSTDISP:
			/* constant displacement
1061 1062
			 * - can be mapped anywhere, but must be mapped as a
			 *   unit
Linus Torvalds's avatar
Linus Torvalds committed
1063 1064 1065 1066 1067
			 */
			if (!dvset) {
				maddr = load_addr;
				delta_vaddr = phdr->p_vaddr;
				dvset = 1;
1068
			} else {
Linus Torvalds's avatar
Linus Torvalds committed
1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085
				maddr = load_addr + phdr->p_vaddr - delta_vaddr;
				flags |= MAP_FIXED;
			}
			break;

		case ELF_FDPIC_FLAG_CONTIGUOUS:
			/* contiguity handled later */
			break;

		default:
			BUG();
		}

		maddr &= PAGE_MASK;

		/* create the mapping */
		disp = phdr->p_vaddr & ~PAGE_MASK;
1086
		maddr = vm_mmap(file, maddr, phdr->p_memsz + disp, prot, flags,
Linus Torvalds's avatar
Linus Torvalds committed
1087 1088 1089
				phdr->p_offset - disp);

		kdebug("mmap[%d] <file> sz=%lx pr=%x fl=%x of=%lx --> %08lx",
1090 1091
		       loop, phdr->p_memsz + disp, prot, flags,
		       phdr->p_offset - disp, maddr);
Linus Torvalds's avatar
Linus Torvalds committed
1092

1093
		if (IS_ERR_VALUE(maddr))
Linus Torvalds's avatar
Linus Torvalds committed
1094 1095
			return (int) maddr;

1096 1097
		if ((params->flags & ELF_FDPIC_FLAG_ARRANGEMENT) ==
		    ELF_FDPIC_FLAG_CONTIGUOUS)
Linus Torvalds's avatar
Linus Torvalds committed
1098 1099 1100 1101 1102 1103 1104 1105 1106 1107
			load_addr += PAGE_ALIGN(phdr->p_memsz + disp);

		seg->addr = maddr + disp;
		seg->p_vaddr = phdr->p_vaddr;
		seg->p_memsz = phdr->p_memsz;

		/* map the ELF header address if in this segment */
		if (phdr->p_offset == 0)
			params->elfhdr_addr = seg->addr;

1108 1109
		/* clear the bit between beginning of mapping and beginning of
		 * PT_LOAD */
Linus Torvalds's avatar
Linus Torvalds committed
1110 1111
		if (prot & PROT_WRITE && disp > 0) {
			kdebug("clear[%d] ad=%lx sz=%lx", loop, maddr, disp);
1112 1113
			if (clear_user((void __user *) maddr, disp))
				return -EFAULT;
Linus Torvalds's avatar
Linus Torvalds committed
1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130
			maddr += disp;
		}

		/* clear any space allocated but not loaded
		 * - on uClinux we can just clear the lot
		 * - on MMU linux we'll get a SIGBUS beyond the last page
		 *   extant in the file
		 */
		excess = phdr->p_memsz - phdr->p_filesz;
		excess1 = PAGE_SIZE - ((maddr + phdr->p_filesz) & ~PAGE_MASK);

#ifdef CONFIG_MMU
		if (excess > excess1) {
			unsigned long xaddr = maddr + phdr->p_filesz + excess1;
			unsigned long xmaddr;

			flags |= MAP_FIXED | MAP_ANONYMOUS;
1131
			xmaddr = vm_mmap(NULL, xaddr, excess - excess1,
1132
					 prot, flags, 0);
Linus Torvalds's avatar
Linus Torvalds committed
1133 1134 1135

			kdebug("mmap[%d] <anon>"
			       " ad=%lx sz=%lx pr=%x fl=%x of=0 --> %08lx",
1136 1137
			       loop, xaddr, excess - excess1, prot, flags,
			       xmaddr);
Linus Torvalds's avatar
Linus Torvalds committed
1138 1139 1140 1141 1142 1143 1144 1145

			if (xmaddr != xaddr)
				return -ENOMEM;
		}

		if (prot & PROT_WRITE && excess1 > 0) {
			kdebug("clear[%d] ad=%lx sz=%lx",
			       loop, maddr + phdr->p_filesz, excess1);
1146 1147 1148
			if (clear_user((void __user *) maddr + phdr->p_filesz,
				       excess1))
				return -EFAULT;
Linus Torvalds's avatar
Linus Torvalds committed
1149 1150 1151 1152 1153 1154
		}

#else
		if (excess > 0) {
			kdebug("clear[%d] ad=%lx sz=%lx",
			       loop, maddr + phdr->p_filesz, excess);
1155 1156
			if (clear_user((void *) maddr + phdr->p_filesz, excess))
				return -EFAULT;
Linus Torvalds's avatar
Linus Torvalds committed
1157 1158 1159 1160 1161
		}
#endif

		if (mm) {
			if (phdr->p_flags & PF_X) {
1162 1163 1164 1165
				if (!mm->start_code) {
					mm->start_code = maddr;
					mm->end_code = maddr + phdr->p_memsz;
				}
1166
			} else if (!mm->start_data) {
Linus Torvalds's avatar
Linus Torvalds committed
1167 1168 1169 1170 1171 1172 1173 1174 1175
				mm->start_data = maddr;
				mm->end_data = maddr + phdr->p_memsz;
			}
		}

		seg++;
	}

	return 0;
1176
}
1177 1178 1179 1180 1181 1182 1183 1184 1185 1186

/*****************************************************************************/
/*
 * ELF-FDPIC core dumper
 *
 * Modelled on fs/exec.c:aout_core_dump()
 * Jeremy Fitzhardinge <jeremy@sw.oz.au>
 *
 * Modelled on fs/binfmt_elf.c core dumper
 */
1187
#ifdef CONFIG_ELF_CORE
1188 1189 1190 1191 1192 1193 1194 1195

/*
 * Decide whether a segment is worth dumping; default is yes to be
 * sure (missing info is worse than too much; etc).
 * Personally I'd include everything, and use the coredump limit...
 *
 * I think we should skip something. But I am not sure how. H.J.
 */
1196
static int maydump(struct vm_area_struct *vma, unsigned long mm_flags)
1197
{
1198 1199
	int dump_ok;

1200
	/* Do not dump I/O mapped devices or special mappings */
1201
	if (vma->vm_flags & VM_IO) {
1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213
		kdcore("%08lx: %08lx: no (IO)", vma->vm_start, vma->vm_flags);
		return 0;
	}

	/* If we may not read the contents, don't allow us to dump
	 * them either. "dump_write()" can't handle it anyway.
	 */
	if (!(vma->vm_flags & VM_READ)) {
		kdcore("%08lx: %08lx: no (!read)", vma->vm_start, vma->vm_flags);
		return 0;
	}

1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227
	/* support for DAX */
	if (vma_is_dax(vma)) {
		if (vma->vm_flags & VM_SHARED) {
			dump_ok = test_bit(MMF_DUMP_DAX_SHARED, &mm_flags);
			kdcore("%08lx: %08lx: %s (DAX shared)", vma->vm_start,
			       vma->vm_flags, dump_ok ? "yes" : "no");
		} else {
			dump_ok = test_bit(MMF_DUMP_DAX_PRIVATE, &mm_flags);
			kdcore("%08lx: %08lx: %s (DAX private)", vma->vm_start,
			       vma->vm_flags, dump_ok ? "yes" : "no");
		}
		return dump_ok;
	}

1228
	/* By default, dump shared memory if mapped from an anonymous file. */
1229
	if (vma->vm_flags & VM_SHARED) {
Al Viro's avatar
Al Viro committed
1230
		if (file_inode(vma->vm_file)->i_nlink == 0) {
1231 1232 1233 1234
			dump_ok = test_bit(MMF_DUMP_ANON_SHARED, &mm_flags);
			kdcore("%08lx: %08lx: %s (share)", vma->vm_start,
			       vma->vm_flags, dump_ok ? "yes" : "no");
			return dump_ok;
1235 1236
		}

1237 1238 1239 1240
		dump_ok = test_bit(MMF_DUMP_MAPPED_SHARED, &mm_flags);
		kdcore("%08lx: %08lx: %s (share)", vma->vm_start,
		       vma->vm_flags, dump_ok ? "yes" : "no");
		return dump_ok;
1241 1242 1243
	}

#ifdef CONFIG_MMU
1244
	/* By default, if it hasn't been written to, don't write it out */
1245
	if (!vma->anon_vma) {
1246 1247 1248 1249
		dump_ok = test_bit(MMF_DUMP_MAPPED_PRIVATE, &mm_flags);
		kdcore("%08lx: %08lx: %s (!anon)", vma->vm_start,
		       vma->vm_flags, dump_ok ? "yes" : "no");
		return dump_ok;
1250 1251 1252
	}
#endif

1253 1254 1255 1256
	dump_ok = test_bit(MMF_DUMP_ANON_PRIVATE, &mm_flags);
	kdcore("%08lx: %08lx: %s", vma->vm_start, vma->vm_flags,
	       dump_ok ? "yes" : "no");
	return dump_ok;
1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280
}

/* An ELF note in memory */
struct memelfnote
{
	const char *name;
	int type;
	unsigned int datasz;
	void *data;
};

static int notesize(struct memelfnote *en)
{
	int sz;

	sz = sizeof(struct elf_note);
	sz += roundup(strlen(en->name) + 1, 4);
	sz += roundup(en->datasz, 4);

	return sz;
}

/* #define DEBUG */

1281
static int writenote(struct memelfnote *men, struct coredump_params *cprm)
1282 1283
{
	struct elf_note en;
1284 1285 1286 1287
	en.n_namesz = strlen(men->name) + 1;
	en.n_descsz = men->datasz;
	en.n_type = men->type;

1288
	return dump_emit(cprm, &en, sizeof(en)) &&
Al Viro's avatar
Al Viro committed
1289 1290
		dump_emit(cprm, men->name, en.n_namesz) && dump_align(cprm, 4) &&
		dump_emit(cprm, men->data, men->datasz) && dump_align(cprm, 4);
1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342
}

static inline void fill_elf_fdpic_header(struct elfhdr *elf, int segs)
{
	memcpy(elf->e_ident, ELFMAG, SELFMAG);
	elf->e_ident[EI_CLASS] = ELF_CLASS;
	elf->e_ident[EI_DATA] = ELF_DATA;
	elf->e_ident[EI_VERSION] = EV_CURRENT;
	elf->e_ident[EI_OSABI] = ELF_OSABI;
	memset(elf->e_ident+EI_PAD, 0, EI_NIDENT-EI_PAD);

	elf->e_type = ET_CORE;
	elf->e_machine = ELF_ARCH;
	elf->e_version = EV_CURRENT;
	elf->e_entry = 0;
	elf->e_phoff = sizeof(struct elfhdr);
	elf->e_shoff = 0;
	elf->e_flags = ELF_FDPIC_CORE_EFLAGS;
	elf->e_ehsize = sizeof(struct elfhdr);
	elf->e_phentsize = sizeof(struct elf_phdr);
	elf->e_phnum = segs;
	elf->e_shentsize = 0;
	elf->e_shnum = 0;
	elf->e_shstrndx = 0;
	return;
}

static inline void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
{
	phdr->p_type = PT_NOTE;
	phdr->p_offset = offset;
	phdr->p_vaddr = 0;
	phdr->p_paddr = 0;
	phdr->p_filesz = sz;
	phdr->p_memsz = 0;
	phdr->p_flags = 0;
	phdr->p_align = 0;
	return;
}

static inline void fill_note(struct memelfnote *note, const char *name, int type,
		unsigned int sz, void *data)
{
	note->name = name;
	note->type = type;
	note->datasz = sz;
	note->data = data;
	return;
}

/*
 * fill up all the fields in prstatus from the given task struct, except
1343
 * registers which need to be filled up separately.
1344 1345 1346 1347 1348 1349 1350
 */
static void fill_prstatus(struct elf_prstatus *prstatus,
			  struct task_struct *p, long signr)
{
	prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
	prstatus->pr_sigpend = p->pending.signal.sig[0];
	prstatus->pr_sighold = p->blocked.sig[0];
1351 1352 1353
	rcu_read_lock();
	prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
	rcu_read_unlock();
1354 1355 1356
	prstatus->pr_pid = task_pid_vnr(p);
	prstatus->pr_pgrp = task_pgrp_vnr(p);
	prstatus->pr_sid = task_session_vnr(p);
1357
	if (thread_group_leader(p)) {
1358
		struct task_cputime cputime;
1359

1360
		/*
1361 1362
		 * This is the record for the group leader.  It shows the
		 * group-wide total, not its individual thread total.
1363
		 */
1364 1365 1366
		thread_group_cputime(p, &cputime);
		prstatus->pr_utime = ns_to_timeval(cputime.utime);
		prstatus->pr_stime = ns_to_timeval(cputime.stime);
1367
	} else {
1368
		u64 utime, stime;
1369

1370 1371 1372
		task_cputime(p, &utime, &stime);
		prstatus->pr_utime = ns_to_timeval(utime);
		prstatus->pr_stime = ns_to_timeval(stime);
1373
	}
1374 1375
	prstatus->pr_cutime = ns_to_timeval(p->signal->cutime);
	prstatus->pr_cstime = ns_to_timeval(p->signal->cstime);
1376 1377 1378 1379 1380 1381 1382 1383

	prstatus->pr_exec_fdpic_loadmap = p->mm->context.exec_fdpic_loadmap;
	prstatus->pr_interp_fdpic_loadmap = p->mm->context.interp_fdpic_loadmap;
}

static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
		       struct mm_struct *mm)
{
1384
	const struct cred *cred;
1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400
	unsigned int i, len;

	/* first copy the parameters from user space */
	memset(psinfo, 0, sizeof(struct elf_prpsinfo));

	len = mm->arg_end - mm->arg_start;
	if (len >= ELF_PRARGSZ)
		len = ELF_PRARGSZ - 1;
	if (copy_from_user(&psinfo->pr_psargs,
		           (const char __user *) mm->arg_start, len))
		return -EFAULT;
	for (i = 0; i < len; i++)
		if (psinfo->pr_psargs[i] == 0)
			psinfo->pr_psargs[i] = ' ';
	psinfo->pr_psargs[len] = 0;

1401 1402 1403
	rcu_read_lock();
	psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
	rcu_read_unlock();
1404 1405 1406
	psinfo->pr_pid = task_pid_vnr(p);
	psinfo->pr_pgrp = task_pgrp_vnr(p);
	psinfo->pr_sid = task_session_vnr(p);
1407 1408 1409 1410 1411 1412 1413

	i = p->state ? ffz(~p->state) + 1 : 0;
	psinfo->pr_state = i;
	psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
	psinfo->pr_zomb = psinfo->pr_sname == 'Z';
	psinfo->pr_nice = task_nice(p);
	psinfo->pr_flag = p->flags;
1414 1415
	rcu_read_lock();
	cred = __task_cred(p);
1416 1417
	SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid));
	SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid));
1418
	rcu_read_unlock();
1419 1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431
	strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));

	return 0;
}

/* Here is the structure in which status of each thread is captured. */
struct elf_thread_status
{
	struct list_head list;
	struct elf_prstatus prstatus;	/* NT_PRSTATUS */
	elf_fpregset_t fpu;		/* NT_PRFPREG */
	struct task_struct *thread;
#ifdef ELF_CORE_COPY_XFPREGS
1432
	elf_fpxregset_t xfpu;		/* ELF_CORE_XFPREG_TYPE */
1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467
#endif
	struct memelfnote notes[3];
	int num_notes;
};

/*
 * In order to add the specific thread information for the elf file format,
 * we need to keep a linked list of every thread's pr_status and then create
 * a single section for them in the final core file.
 */
static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
{
	struct task_struct *p = t->thread;
	int sz = 0;

	t->num_notes = 0;

	fill_prstatus(&t->prstatus, p, signr);
	elf_core_copy_task_regs(p, &t->prstatus.pr_reg);

	fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus),
		  &t->prstatus);
	t->num_notes++;
	sz += notesize(&t->notes[0]);

	t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL, &t->fpu);
	if (t->prstatus.pr_fpvalid) {
		fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu),
			  &t->fpu);
		t->num_notes++;
		sz += notesize(&t->notes[1]);
	}

#ifdef ELF_CORE_COPY_XFPREGS
	if (elf_core_copy_task_xfpregs(p, &t->xfpu)) {
1468 1469
		fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE,
			  sizeof(t->xfpu), &t->xfpu);
1470 1471 1472 1473 1474 1475 1476
		t->num_notes++;
		sz += notesize(&t->notes[2]);
	}
#endif
	return sz;
}

1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492
static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
			     elf_addr_t e_shoff, int segs)
{
	elf->e_shoff = e_shoff;
	elf->e_shentsize = sizeof(*shdr4extnum);
	elf->e_shnum = 1;
	elf->e_shstrndx = SHN_UNDEF;

	memset(shdr4extnum, 0, sizeof(*shdr4extnum));

	shdr4extnum->sh_type = SHT_NULL;
	shdr4extnum->sh_size = elf->e_shnum;
	shdr4extnum->sh_link = elf->e_shstrndx;
	shdr4extnum->sh_info = segs;
}

1493 1494 1495
/*
 * dump the segments for an MMU process
 */
1496
static bool elf_fdpic_dump_segments(struct coredump_params *cprm)
1497 1498 1499 1500
{
	struct vm_area_struct *vma;

	for (vma = current->mm->mmap; vma; vma = vma->vm_next) {
1501
#ifdef CONFIG_MMU
1502
		unsigned long addr;
1503
#endif
1504

1505
		if (!maydump(vma, cprm->mm_flags))
1506 1507
			continue;

1508
#ifdef CONFIG_MMU
Hugh Dickins's avatar
Hugh Dickins committed
1509 1510
		for (addr = vma->vm_start; addr < vma->vm_end;
							addr += PAGE_SIZE) {
1511
			bool res;
Hugh Dickins's avatar
Hugh Dickins committed
1512 1513 1514
			struct page *page = get_dump_page(addr);
			if (page) {
				void *kaddr = kmap(page);
1515
				res = dump_emit(cprm, kaddr, PAGE_SIZE);
1516
				kunmap(page);
1517
				put_page(page);
1518
			} else {
1519
				res = dump_skip(cprm, PAGE_SIZE);
1520 1521 1522
			}
			if (!res)
				return false;
1523
		}
1524 1525
#else
		if (!dump_emit(cprm, (void *) vma->vm_start,
1526
				vma->vm_end - vma->vm_start))
1527 1528
			return false;
#endif
1529
	}
1530
	return true;
1531 1532
}

1533 1534 1535 1536 1537
static size_t elf_core_vma_data_size(unsigned long mm_flags)
{
	struct vm_area_struct *vma;
	size_t size = 0;

1538
	for (vma = current->mm->mmap; vma; vma = vma->vm_next)
1539 1540 1541 1542 1543
		if (maydump(vma, mm_flags))
			size += vma->vm_end - vma->vm_start;
	return size;
}

1544 1545 1546 1547 1548 1549 1550
/*
 * Actual dumper
 *
 * This is a two-pass process; first we find the offsets of the bits,
 * and then they are actually written out.  If we run out of core limit
 * we just truncate.
 */
1551
static int elf_fdpic_core_dump(struct coredump_params *cprm)
1552 1553 1554 1555 1556 1557 1558 1559
{
#define	NUM_NOTES	6
	int has_dumped = 0;
	mm_segment_t fs;
	int segs;
	int i;
	struct vm_area_struct *vma;
	struct elfhdr *elf = NULL;
1560
	loff_t offset = 0, dataoff;
1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572
	int numnote;
	struct memelfnote *notes = NULL;
	struct elf_prstatus *prstatus = NULL;	/* NT_PRSTATUS */
	struct elf_prpsinfo *psinfo = NULL;	/* NT_PRPSINFO */
 	LIST_HEAD(thread_list);
 	struct list_head *t;
	elf_fpregset_t *fpu = NULL;
#ifdef ELF_CORE_COPY_XFPREGS
	elf_fpxregset_t *xfpu = NULL;
#endif
	int thread_status_size = 0;
	elf_addr_t *auxv;
1573
	struct elf_phdr *phdr4note = NULL;
1574 1575 1576
	struct elf_shdr *shdr4extnum = NULL;
	Elf_Half e_phnum;
	elf_addr_t e_shoff;
1577 1578
	struct core_thread *ct;
	struct elf_thread_status *tmp;
1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613

	/*
	 * We no longer stop all VM operations.
	 *
	 * This is because those proceses that could possibly change map_count
	 * or the mmap / vma pages are now blocked in do_exit on current
	 * finishing this core dump.
	 *
	 * Only ptrace can touch these memory addresses, but it doesn't change
	 * the map_count or the pages allocated. So no possibility of crashing
	 * exists while dumping the mm->vm_next areas to the core file.
	 */

	/* alloc memory for large data structures: too large to be on stack */
	elf = kmalloc(sizeof(*elf), GFP_KERNEL);
	if (!elf)
		goto cleanup;
	prstatus = kzalloc(sizeof(*prstatus), GFP_KERNEL);
	if (!prstatus)
		goto cleanup;
	psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
	if (!psinfo)
		goto cleanup;
	notes = kmalloc(NUM_NOTES * sizeof(struct memelfnote), GFP_KERNEL);
	if (!notes)
		goto cleanup;
	fpu = kmalloc(sizeof(*fpu), GFP_KERNEL);
	if (!fpu)
		goto cleanup;
#ifdef ELF_CORE_COPY_XFPREGS
	xfpu = kmalloc(sizeof(*xfpu), GFP_KERNEL);
	if (!xfpu)
		goto cleanup;
#endif

1614 1615 1616 1617 1618
	for (ct = current->mm->core_state->dumper.next;
					ct; ct = ct->next) {
		tmp = kzalloc(sizeof(*tmp), GFP_KERNEL);
		if (!tmp)
			goto cleanup;
1619

1620 1621 1622
		tmp->thread = ct->task;
		list_add(&tmp->list, &thread_list);
	}
1623

1624 1625 1626
	list_for_each(t, &thread_list) {
		struct elf_thread_status *tmp;
		int sz;
1627

1628 1629 1630
		tmp = list_entry(t, struct elf_thread_status, list);
		sz = elf_dump_thread_status(cprm->siginfo->si_signo, tmp);
		thread_status_size += sz;
1631 1632 1633
	}

	/* now collect the dump for the current */
1634
	fill_prstatus(prstatus, current, cprm->siginfo->si_signo);
1635
	elf_core_copy_regs(&prstatus->pr_reg, cprm->regs);
1636 1637

	segs = current->mm->map_count;
1638
	segs += elf_core_extra_phdrs();