1 /* $OpenBSD: exec_elf.c,v 1.9 1996/06/10 00:48:59 deraadt Exp $ */ 2 /* $NetBSD: exec_elf.c,v 1.6 1996/02/09 18:59:18 christos Exp $ */ 3 4 /* 5 * Copyright (c) 1994 Christos Zoulas 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The name of the author may not be used to endorse or promote products 17 * derived from this software without specific prior written permission 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 20 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 21 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 22 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 23 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 24 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 28 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29 * 30 */ 31 32 #include <sys/param.h> 33 #include <sys/systm.h> 34 #include <sys/kernel.h> 35 #include <sys/proc.h> 36 #include <sys/malloc.h> 37 #include <sys/namei.h> 38 #include <sys/vnode.h> 39 #include <sys/exec.h> 40 #include <sys/exec_elf.h> 41 #include <sys/syscall.h> 42 #include <sys/signalvar.h> 43 44 #if defined(COMPAT_LINUX) || defined(COMPAT_SVR4) /*XXX should be */ 45 #undef EXEC_ELF /*XXX defined in */ 46 #define EXEC_ELF /*XXX machine/exec.h */ 47 #endif /*XXX instead ? */ 48 49 #if defined(NATIVE_EXEC_ELF) || defined(EXEC_ELF) 50 51 #include <sys/mman.h> 52 #include <vm/vm.h> 53 #include <vm/vm_param.h> 54 #include <vm/vm_map.h> 55 56 #include <machine/cpu.h> 57 #include <machine/reg.h> 58 #include <machine/exec.h> 59 60 #ifdef COMPAT_LINUX 61 #include <compat/linux/linux_exec.h> 62 #endif 63 64 #ifdef COMPAT_SVR4 65 #include <compat/svr4/svr4_exec.h> 66 #endif 67 68 int (*elf_probe_funcs[]) __P((struct proc *, struct exec_package *, 69 char *, u_long *)) = { 70 #ifdef COMPAT_SVR4 71 svr4_elf_probe, 72 #endif 73 #ifdef COMPAT_LINUX 74 linux_elf_probe 75 #endif 76 }; 77 78 int elf_check_header __P((Elf32_Ehdr *, int)); 79 int elf_load_file __P((struct proc *, char *, struct exec_vmcmd_set *, 80 u_long *, struct elf_args *, u_long *)); 81 82 static int elf_read_from __P((struct proc *, struct vnode *, u_long, 83 caddr_t, int)); 84 static void elf_load_psection __P((struct exec_vmcmd_set *, 85 struct vnode *, Elf32_Phdr *, u_long *, u_long *, int *)); 86 87 #define ELF_ALIGN(a, b) ((a) & ~((b) - 1)) 88 89 /* 90 * This is the basic elf emul. elf_probe_funcs may change to other emuls. 91 */ 92 93 extern char sigcode[], esigcode[]; 94 #ifdef SYSCALL_DEBUG 95 extern char *syscallnames[]; 96 #endif 97 98 struct emul emul_elf = { 99 "nativelf", 100 NULL, 101 sendsig, 102 SYS_syscall, 103 SYS_MAXSYSCALL, 104 sysent, 105 #ifdef SYSCALL_DEBUG 106 syscallnames, 107 #else 108 NULL, 109 #endif 110 sizeof(AuxInfo) * ELF_AUX_ENTRIES, 111 elf_copyargs, 112 setregs, 113 sigcode, 114 esigcode, 115 }; 116 117 118 /* 119 * Copy arguments onto the stack in the normal way, but add some 120 * extra information in case of dynamic binding. 121 */ 122 void * 123 elf_copyargs(pack, arginfo, stack, argp) 124 struct exec_package *pack; 125 struct ps_strings *arginfo; 126 void *stack; 127 void *argp; 128 { 129 size_t len; 130 AuxInfo ai[ELF_AUX_ENTRIES], *a; 131 struct elf_args *ap; 132 133 stack = copyargs(pack, arginfo, stack, argp); 134 if (!stack) 135 return NULL; 136 137 /* 138 * Push extra arguments on the stack needed by dynamically 139 * linked binaries 140 */ 141 if ((ap = (struct elf_args *) pack->ep_emul_arg)) { 142 a = ai; 143 144 a->au_id = AUX_phdr; 145 a->au_v = ap->arg_phaddr; 146 a++; 147 148 a->au_id = AUX_phent; 149 a->au_v = ap->arg_phentsize; 150 a++; 151 152 a->au_id = AUX_phnum; 153 a->au_v = ap->arg_phnum; 154 a++; 155 156 a->au_id = AUX_pagesz; 157 a->au_v = NBPG; 158 a++; 159 160 a->au_id = AUX_base; 161 a->au_v = ap->arg_interp; 162 a++; 163 164 a->au_id = AUX_flags; 165 a->au_v = 0; 166 a++; 167 168 a->au_id = AUX_entry; 169 a->au_v = ap->arg_entry; 170 a++; 171 172 a->au_id = AUX_null; 173 a->au_v = 0; 174 a++; 175 176 free((char *) ap, M_TEMP); 177 len = ELF_AUX_ENTRIES * sizeof (AuxInfo); 178 if (copyout(ai, stack, len)) 179 return NULL; 180 stack += len; 181 } 182 return stack; 183 } 184 185 /* 186 * elf_check_header(): 187 * 188 * Check header for validity; return 0 of ok ENOEXEC if error 189 * 190 * XXX machine type needs to be moved to <machine/param.h> so 191 * just one comparison can be done. Unfortunately, there is both 192 * em_486 and em_386, so this would not work on the i386. 193 */ 194 int 195 elf_check_header(eh, type) 196 Elf32_Ehdr *eh; 197 int type; 198 { 199 200 if (!IS_ELF(eh[0])) 201 return ENOEXEC; 202 203 switch (eh->e_machine) { 204 /* XXX */ 205 #ifdef i386 206 case EM_386: 207 case EM_486: 208 #endif 209 #ifdef sparc 210 case EM_SPARC: 211 #endif 212 #ifdef mips 213 case EM_MIPS: 214 #endif 215 break; 216 217 default: 218 return ENOEXEC; 219 } 220 221 if (eh->e_type != type) 222 return ENOEXEC; 223 224 return 0; 225 } 226 227 /* 228 * elf_load_psection(): 229 * 230 * Load a psection at the appropriate address 231 */ 232 static void 233 elf_load_psection(vcset, vp, ph, addr, size, prot) 234 struct exec_vmcmd_set *vcset; 235 struct vnode *vp; 236 Elf32_Phdr *ph; 237 u_long *addr; 238 u_long *size; 239 int *prot; 240 { 241 u_long uaddr, msize, psize, rm, rf; 242 long diff, offset; 243 244 /* 245 * If the user specified an address, then we load there. 246 */ 247 if (*addr != ELF32_NO_ADDR) { 248 if (ph->p_align > 1) { 249 *addr = ELF_ALIGN(*addr + ph->p_align, ph->p_align); 250 uaddr = ELF_ALIGN(ph->p_vaddr, ph->p_align); 251 } else 252 uaddr = ph->p_vaddr; 253 diff = ph->p_vaddr - uaddr; 254 } else { 255 *addr = uaddr = ph->p_vaddr; 256 if (ph->p_align > 1) 257 *addr = ELF_ALIGN(uaddr, ph->p_align); 258 diff = uaddr - *addr; 259 } 260 261 *prot |= (ph->p_flags & PF_R) ? VM_PROT_READ : 0; 262 *prot |= (ph->p_flags & PF_W) ? VM_PROT_WRITE : 0; 263 *prot |= (ph->p_flags & PF_X) ? VM_PROT_EXECUTE : 0; 264 265 offset = ph->p_offset - diff; 266 *size = ph->p_filesz + diff; 267 msize = ph->p_memsz + diff; 268 psize = round_page(*size); 269 270 /* 271 * Because the pagedvn pager can't handle zero fill of the last 272 * data page if it's not page aligned we map the las page readvn. 273 */ 274 if(ph->p_flags & PF_W) { 275 psize = trunc_page(*size); 276 NEW_VMCMD(vcset, vmcmd_map_pagedvn, psize, *addr, vp, offset, *prot); 277 if(psize != *size) { 278 NEW_VMCMD(vcset, vmcmd_map_readvn, *size - psize, *addr 279 + psize, vp, offset + psize, *prot); 280 } 281 } 282 else { 283 NEW_VMCMD(vcset, vmcmd_map_pagedvn, psize, *addr, vp, offset, *prot); 284 } 285 286 /* 287 * Check if we need to extend the size of the segment 288 */ 289 rm = round_page(*addr + msize); 290 rf = round_page(*addr + *size); 291 292 if (rm != rf) { 293 NEW_VMCMD(vcset, vmcmd_map_zero, rm - rf, rf, NULLVP, 0, *prot); 294 *size = msize; 295 } 296 } 297 298 /* 299 * elf_read_from(): 300 * 301 * Read from vnode into buffer at offset. 302 */ 303 static int 304 elf_read_from(p, vp, off, buf, size) 305 struct vnode *vp; 306 u_long off; 307 struct proc *p; 308 caddr_t buf; 309 int size; 310 { 311 int error; 312 int resid; 313 314 if ((error = vn_rdwr(UIO_READ, vp, buf, size, 315 off, UIO_SYSSPACE, IO_NODELOCKED, p->p_ucred, 316 &resid, p)) != 0) 317 return error; 318 /* 319 * See if we got all of it 320 */ 321 if (resid != 0) 322 return ENOEXEC; 323 return 0; 324 } 325 326 /* 327 * elf_load_file(): 328 * 329 * Load a file (interpreter/library) pointed to by path 330 * [stolen from coff_load_shlib()]. Made slightly generic 331 * so it might be used externally. 332 */ 333 int 334 elf_load_file(p, path, vcset, entry, ap, last) 335 struct proc *p; 336 char *path; 337 struct exec_vmcmd_set *vcset; 338 u_long *entry; 339 struct elf_args *ap; 340 u_long *last; 341 { 342 int error, i; 343 struct nameidata nd; 344 Elf32_Ehdr eh; 345 Elf32_Phdr *ph = NULL; 346 u_long phsize; 347 char *bp = NULL; 348 u_long addr = *last; 349 350 bp = path; 351 /* 352 * 1. open file 353 * 2. read filehdr 354 * 3. map text, data, and bss out of it using VM_* 355 */ 356 NDINIT(&nd, LOOKUP, FOLLOW, UIO_SYSSPACE, path, p); 357 if ((error = namei(&nd)) != 0) { 358 return error; 359 } 360 if ((error = elf_read_from(p, nd.ni_vp, 0, (caddr_t) &eh, 361 sizeof(eh))) != 0) 362 goto bad; 363 364 if ((error = elf_check_header(&eh, ET_DYN)) != 0) 365 goto bad; 366 367 phsize = eh.e_phnum * sizeof(Elf32_Phdr); 368 ph = (Elf32_Phdr *) malloc(phsize, M_TEMP, M_WAITOK); 369 370 if ((error = elf_read_from(p, nd.ni_vp, eh.e_phoff, 371 (caddr_t) ph, phsize)) != 0) 372 goto bad; 373 374 /* 375 * Load all the necessary sections 376 */ 377 for (i = 0; i < eh.e_phnum; i++) { 378 u_long size = 0; 379 int prot = 0; 380 381 switch (ph[i].p_type) { 382 case PT_LOAD: 383 elf_load_psection(vcset, nd.ni_vp, &ph[i], &addr, 384 &size, &prot); 385 /* If entry is within this section it must be text */ 386 if (eh.e_entry >= ph[i].p_vaddr && 387 eh.e_entry < (ph[i].p_vaddr + size)) { 388 *entry = addr + eh.e_entry - ph[i].p_vaddr; 389 ap->arg_interp = addr; 390 } 391 addr += size; 392 break; 393 394 case PT_DYNAMIC: 395 case PT_PHDR: 396 case PT_NOTE: 397 break; 398 399 default: 400 break; 401 } 402 } 403 404 bad: 405 if (ph != NULL) 406 free((char *) ph, M_TEMP); 407 408 *last = addr; 409 vrele(nd.ni_vp); 410 return error; 411 } 412 413 /* 414 * exec_elf_makecmds(): Prepare an Elf binary's exec package 415 * 416 * First, set of the various offsets/lengths in the exec package. 417 * 418 * Then, mark the text image busy (so it can be demand paged) or error 419 * out if this is not possible. Finally, set up vmcmds for the 420 * text, data, bss, and stack segments. 421 * 422 */ 423 int 424 exec_elf_makecmds(p, epp) 425 struct proc *p; 426 struct exec_package *epp; 427 { 428 Elf32_Ehdr *eh = epp->ep_hdr; 429 Elf32_Phdr *ph, *pp; 430 Elf32_Addr phdr = 0; 431 int error, i, n, nload; 432 char interp[MAXPATHLEN]; 433 u_long pos = 0, phsize; 434 435 if (epp->ep_hdrvalid < sizeof(Elf32_Ehdr)) 436 return ENOEXEC; 437 438 if (elf_check_header(eh, ET_EXEC)) 439 return ENOEXEC; 440 441 /* 442 * check if vnode is in open for writing, because we want to 443 * demand-page out of it. if it is, don't do it, for various 444 * reasons 445 */ 446 if (epp->ep_vp->v_writecount != 0) { 447 #ifdef DIAGNOSTIC 448 if (epp->ep_vp->v_flag & VTEXT) 449 panic("exec: a VTEXT vnode has writecount != 0\n"); 450 #endif 451 return ETXTBSY; 452 } 453 /* 454 * Allocate space to hold all the program headers, and read them 455 * from the file 456 */ 457 phsize = eh->e_phnum * sizeof(Elf32_Phdr); 458 ph = (Elf32_Phdr *) malloc(phsize, M_TEMP, M_WAITOK); 459 460 if ((error = elf_read_from(p, epp->ep_vp, eh->e_phoff, 461 (caddr_t) ph, phsize)) != 0) 462 goto bad; 463 464 epp->ep_tsize = ELF32_NO_ADDR; 465 epp->ep_dsize = ELF32_NO_ADDR; 466 467 interp[0] = '\0'; 468 469 for (i = 0; i < eh->e_phnum; i++) { 470 pp = &ph[i]; 471 if (pp->p_type == PT_INTERP) { 472 if (pp->p_filesz >= sizeof(interp)) 473 goto bad; 474 if ((error = elf_read_from(p, epp->ep_vp, pp->p_offset, 475 (caddr_t) interp, pp->p_filesz)) != 0) 476 goto bad; 477 break; 478 } 479 } 480 481 /* 482 * OK, we want a slightly different twist of the 483 * standard emulation package for "real" elf. 484 */ 485 epp->ep_emul = &emul_elf; 486 pos = ELF32_NO_ADDR; 487 488 /* 489 * On the same architecture, we may be emulating different systems. 490 * See which one will accept this executable. This currently only 491 * applies to Linux and SVR4 on the i386. 492 * 493 * Probe functions would normally see if the interpreter (if any) 494 * exists. Emulation packages may possibly replace the interpreter in 495 * interp[] with a changed path (/emul/xxx/<path>), and also 496 * set the ep_emul field in the exec package structure. 497 */ 498 if ((n = sizeof elf_probe_funcs / sizeof elf_probe_funcs[0])) { 499 error = ENOEXEC; 500 for (i = 0; i < n && error; i++) 501 error = elf_probe_funcs[i](p, epp, interp, &pos); 502 503 if (error) 504 goto bad; 505 } 506 507 /* 508 * Load all the necessary sections 509 */ 510 for (i = nload = 0; i < eh->e_phnum; i++) { 511 u_long addr = ELF32_NO_ADDR, size = 0; 512 int prot = 0; 513 514 pp = &ph[i]; 515 516 switch (ph[i].p_type) { 517 case PT_LOAD: 518 /* 519 * XXX 520 * Can handle only 2 sections: text and data 521 */ 522 if (nload++ == 2) 523 goto bad; 524 elf_load_psection(&epp->ep_vmcmds, epp->ep_vp, 525 &ph[i], &addr, &size, &prot); 526 /* 527 * Decide whether it's text or data by looking 528 * at the entry point. 529 */ 530 if (eh->e_entry >= addr && eh->e_entry < (addr + size)){ 531 epp->ep_taddr = addr; 532 epp->ep_tsize = size; 533 } else { 534 epp->ep_daddr = addr; 535 epp->ep_dsize = size; 536 } 537 break; 538 539 case PT_SHLIB: 540 error = ENOEXEC; 541 goto bad; 542 543 case PT_INTERP: 544 /* Already did this one */ 545 case PT_DYNAMIC: 546 case PT_NOTE: 547 break; 548 549 case PT_PHDR: 550 /* Note address of program headers (in text segment) */ 551 phdr = pp->p_vaddr; 552 break; 553 554 default: 555 /* 556 * Not fatal, we don't need to understand everything 557 * :-) 558 */ 559 break; 560 } 561 } 562 563 #if !defined(mips) 564 /* 565 * If no position to load the interpreter was set by a probe 566 * function, pick the same address that a non-fixed mmap(0, ..) 567 * would (i.e. something safely out of the way). 568 */ 569 if (pos == ELF32_NO_ADDR) 570 pos = round_page(epp->ep_daddr + MAXDSIZ); 571 #endif 572 573 /* 574 * Check if we found a dynamically linked binary and arrange to load 575 * it's interpreter 576 */ 577 if (interp[0]) { 578 struct elf_args *ap; 579 580 ap = (struct elf_args *) malloc(sizeof(struct elf_args), 581 M_TEMP, M_WAITOK); 582 if ((error = elf_load_file(p, interp, &epp->ep_vmcmds, 583 &epp->ep_entry, ap, &pos)) != 0) { 584 free((char *) ap, M_TEMP); 585 goto bad; 586 } 587 pos += phsize; 588 ap->arg_phaddr = phdr; 589 590 ap->arg_phentsize = eh->e_phentsize; 591 ap->arg_phnum = eh->e_phnum; 592 ap->arg_entry = eh->e_entry; 593 594 epp->ep_emul_arg = ap; 595 } else 596 epp->ep_entry = eh->e_entry; 597 598 #ifdef ELF_MAP_PAGE_ZERO 599 /* Dell SVR4 maps page zero, yeuch! */ 600 NEW_VMCMD(&epp->ep_vmcmds, vmcmd_map_readvn, NBPG, 0, epp->ep_vp, 0, 601 VM_PROT_READ); 602 #endif 603 604 free((char *) ph, M_TEMP); 605 epp->ep_vp->v_flag |= VTEXT; 606 return exec_aout_setup_stack(p, epp); 607 608 bad: 609 free((char *) ph, M_TEMP); 610 kill_vmcmds(&epp->ep_vmcmds); 611 return ENOEXEC; 612 } 613 #endif /* NATIVE_EXEC_ELF || EXEC_ELF */ 614