/* These are the functions used to load ELF style executables and shared
* libraries. There is no binary dependent code anywhere else.
*/
static int load_irix_binary(struct linux_binprm * bprm, struct pt_regs * regs)
{
struct elfhdr elf_ex, interp_elf_ex;
struct file *interpreter;
struct elf_phdr *elf_phdata, *elf_ihdr, *elf_ephdr;
unsigned int load_addr, elf_bss, elf_brk;
unsigned int elf_entry, interp_load_addr = 0;
unsigned int start_code, end_code, end_data, elf_stack;
int retval, has_interp, has_ephdr, size, i;
char *elf_interpreter;
mm_segment_t old_fs;
load_addr = 0;
has_interp = has_ephdr = 0;
elf_ihdr = elf_ephdr = NULL;
elf_ex = *((struct elfhdr *) bprm->buf);
retval = -ENOEXEC;
if (verify_binary(&elf_ex, bprm))
goto out;
/*
* Telling -o32 static binaries from Linux and Irix apart from each
* other is difficult. There are 2 differences to be noted for static
* binaries from the 2 operating systems:
*
* 1) Irix binaries have their .text section before their .init
* section. Linux binaries are just the opposite.
*
* 2) Irix binaries usually have <= 12 sections and Linux
* binaries have > 20.
*
* We will use Method #2 since Method #1 would require us to read in
* the section headers which is way too much overhead. This appears
* to work for everything we have ran into so far. If anyone has a
* better method to tell the binaries apart, I'm listening.
*/
if (elf_ex.e_shnum > 20)
goto out;
print_elfhdr(&elf_ex);
/* Now read in all of the header information */
size = elf_ex.e_phentsize * elf_ex.e_phnum;
if (size > 65536)
goto out;
elf_phdata = kmalloc(size, GFP_KERNEL);
if (elf_phdata == NULL) {
retval = -ENOMEM;
goto out;
}
retval = kernel_read(bprm->file, elf_ex.e_phoff, (char *)elf_phdata, size);
if (retval < 0)
goto out_free_ph;
dump_phdrs(elf_phdata, elf_ex.e_phnum);
/* Set some things for later. */
for (i = 0; i < elf_ex.e_phnum; i++) {
switch (elf_phdata[i].p_type) {
case PT_INTERP:
has_interp = 1;
elf_ihdr = &elf_phdata[i];
break;
case PT_PHDR:
has_ephdr = 1;
elf_ephdr = &elf_phdata[i];
break;
};
}
pr_debug("\n");
elf_bss = 0;
elf_brk = 0;
elf_stack = 0xffffffff;
elf_interpreter = NULL;
start_code = 0xffffffff;
end_code = 0;
end_data = 0;
/*
* If we get a return value, we change the value to be ENOEXEC
* so that we can exit gracefully and the main binary format
* search loop in 'fs/exec.c' will move onto the next handler
* which should be the normal ELF binary handler.
*/
retval = look_for_irix_interpreter(&elf_interpreter, &interpreter,
&interp_elf_ex, elf_phdata, bprm,
elf_ex.e_phnum);
if (retval) {
retval = -ENOEXEC;
goto out_free_file;
}
if (elf_interpreter) {
retval = verify_irix_interpreter(&interp_elf_ex);
if (retval)
goto out_free_interp;
}
/* OK, we are done with that, now set up the arg stuff,
* and then start this sucker up.
*/
retval = -E2BIG;
if (!bprm->sh_bang && !bprm->p)
goto out_free_interp;
/* Flush all traces of the currently running executable */
retval = flush_old_exec(bprm);
if (retval)
goto out_free_dentry;
/* OK, This is the point of no return */
current->mm->end_data = 0;
current->mm->end_code = 0;
current->mm->mmap = NULL;
current->flags &= ~PF_FORKNOEXEC;
elf_entry = (unsigned int) elf_ex.e_entry;
/* Do this so that we can load the interpreter, if need be. We will
* change some of these later.
*/
setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
current->mm->start_stack = bprm->p;
/* At this point, we assume that the image should be loaded at
* fixed address, not at a variable address.
*/
old_fs = get_fs();
set_fs(get_ds());
map_executable(bprm->file, elf_phdata, elf_ex.e_phnum, &elf_stack,
&load_addr, &start_code, &elf_bss, &end_code,
&end_data, &elf_brk);
if (elf_interpreter) {
retval = map_interpreter(elf_phdata, &interp_elf_ex,
interpreter, &interp_load_addr,
elf_ex.e_phnum, old_fs, &elf_entry);
kfree(elf_interpreter);
if (retval) {
set_fs(old_fs);
printk("Unable to load IRIX ELF interpreter\n");
send_sig(SIGSEGV, current, 0);
retval = 0;
goto out_free_file;
}
}
set_fs(old_fs);
kfree(elf_phdata);
set_personality(PER_IRIX32);
setup_new_exec(bprm);
set_binfmt(&irix_format);
compute_creds(bprm);
current->flags &= ~PF_FORKNOEXEC;
bprm->p = (unsigned long)
create_irix_tables((char *)bprm->p, bprm->argc, bprm->envc,
(elf_interpreter ? &elf_ex : NULL),
load_addr, interp_load_addr, regs, elf_ephdr);
current->mm->start_brk = current->mm->brk = elf_brk;
current->mm->end_code = end_code;
current->mm->start_code = start_code;
current->mm->end_data = end_data;
current->mm->start_stack = bprm->p;
/* Calling set_brk effectively mmaps the pages that we need for the
* bss and break sections.
*/
set_brk(elf_bss, elf_brk);
/*
* IRIX maps a page at 0x200000 which holds some system
* information. Programs depend on this.
*/
irix_map_prda_page();
padzero(elf_bss);
pr_debug("(start_brk) %lx\n" , (long) current->mm->start_brk);
pr_debug("(end_code) %lx\n" , (long) current->mm->end_code);
pr_debug("(start_code) %lx\n" , (long) current->mm->start_code);
pr_debug("(end_data) %lx\n" , (long) current->mm->end_data);
pr_debug("(start_stack) %lx\n" , (long) current->mm->start_stack);
pr_debug("(brk) %lx\n" , (long) current->mm->brk);
#if 0 /* XXX No f*****g way dude... */
/* Why this, you ask??? Well SVr4 maps page 0 as read-only,
* and some applications "depend" upon this behavior.
* Since we do not have the power to recompile these, we
* emulate the SVr4 behavior. Sigh.
*/
down_write(¤t->mm->mmap_sem);
(void) do_mmap(NULL, 0, 4096, PROT_READ | PROT_EXEC,
MAP_FIXED | MAP_PRIVATE, 0);
up_write(¤t->mm->mmap_sem);
#endif
start_thread(regs, elf_entry, bprm->p);
if (current->ptrace & PT_PTRACED)
send_sig(SIGTRAP, current, 0);
return 0;
out:
return retval;
out_free_dentry:
allow_write_access(interpreter);
fput(interpreter);
out_free_interp:
kfree(elf_interpreter);
out_free_file:
out_free_ph:
kfree(elf_phdata);
goto out;
}
static int
load_som_binary(struct linux_binprm * bprm, struct pt_regs * regs)
{
int retval;
unsigned int size;
unsigned long som_entry;
struct som_hdr *som_ex;
struct som_exec_auxhdr *hpuxhdr;
/* Get the exec-header */
som_ex = (struct som_hdr *) bprm->buf;
retval = check_som_header(som_ex);
if (retval != 0)
goto out;
/* Now read in the auxiliary header information */
retval = -ENOMEM;
size = som_ex->aux_header_size;
if (size > SOM_PAGESIZE)
goto out;
hpuxhdr = kmalloc(size, GFP_KERNEL);
if (!hpuxhdr)
goto out;
retval = kernel_read(bprm->file, som_ex->aux_header_location,
(char *) hpuxhdr, size);
if (retval != size) {
if (retval >= 0)
retval = -EIO;
goto out_free;
}
/* Flush all traces of the currently running executable */
retval = flush_old_exec(bprm);
if (retval)
goto out_free;
/* OK, This is the point of no return */
current->flags &= ~PF_FORKNOEXEC;
current->personality = PER_HPUX;
setup_new_exec(bprm);
/* Set the task size for HP-UX processes such that
* the gateway page is outside the address space.
* This can be fixed later, but for now, this is much
* easier.
*/
current->thread.task_size = 0xc0000000;
/* Set map base to allow enough room for hp-ux heap growth */
current->thread.map_base = 0x80000000;
retval = map_som_binary(bprm->file, hpuxhdr);
if (retval < 0)
goto out_free;
som_entry = hpuxhdr->exec_entry;
kfree(hpuxhdr);
set_binfmt(&som_format);
install_exec_creds(bprm);
setup_arg_pages(bprm, STACK_TOP, EXSTACK_DEFAULT);
create_som_tables(bprm);
current->mm->start_stack = bprm->p;
#if 0
printk("(start_brk) %08lx\n" , (unsigned long) current->mm->start_brk);
printk("(end_code) %08lx\n" , (unsigned long) current->mm->end_code);
printk("(start_code) %08lx\n" , (unsigned long) current->mm->start_code);
printk("(end_data) %08lx\n" , (unsigned long) current->mm->end_data);
printk("(start_stack) %08lx\n" , (unsigned long) current->mm->start_stack);
printk("(brk) %08lx\n" , (unsigned long) current->mm->brk);
#endif
map_hpux_gateway_page(current,current->mm);
start_thread_som(regs, som_entry, bprm->p);
return 0;
/* error cleanup */
out_free:
kfree(hpuxhdr);
out:
return retval;
}
static int load_macho_binary(struct linux_binprm *bprm, struct pt_regs *regs)
{
unsigned long def_flags = 0;
void* entry_point = 0;
int retval = -ENOEXEC;
int file_size = 0;
int executable_stack = EXSTACK_DEFAULT;
size_t macho_header_sz = sizeof(macho_header);
macho_header* head = ((macho_header*)bprm->buf);
struct file *linker_file = NULL;
/* have we got enough space? */
if (!head) {
retval = -ENOMEM;
goto out_ret;
}
retval = ml_checkImage(bprm->file, head);
if (retval) {
printk(KERN_WARNING "load_macho_binary: image failed sanity checks, not loading \n");
goto out_ret;
}
/*
XXX: this should be retrieved by ml_checkImage()
*/
file_size = ml_getFileSize(bprm->file);
/*
The file seems to be alright, so set up an environment for the
new binary to run in. After this, the old image will no longer be
usable. If some of the load commands are broken, this process is doomed.
*/
retval = flush_old_exec(bprm);
if (retval) {
panic("load_macho_binary: flush_old_exec failed\n");
}
else {
current->flags &= ~PF_FORKNOEXEC;
current->mm->def_flags = def_flags;
setup_new_exec(bprm);
/* set personality */
unsigned int personality = current->personality & ~PER_MASK;
personality |= PER_LINUX;
/*
This flag has to be set for 32x architectures (I think).
*/
personality |= ADDR_LIMIT_32BIT;
set_personality(personality);
/* set stuff */
current->mm->free_area_cache = current->mm->mmap_base;
current->mm->cached_hole_size = 0;
//retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP), executable_stack);
if (retval < 0) {
//send_sig(SIGKILL, current, 0);
//goto out_ret;
}
/* stack */
current->mm->start_stack = bprm->p;
}
/*
Read the load commands from the file.
*/
size_t offset;
size_t oldoffset;
uint32_t ncmds;
uint8_t* addr;
offset = 0;
ncmds = head->ncmds;
addr = kmalloc(head->sizeofcmds, GFP_KERNEL); /***/
retval = -EINVAL;
int ret = 0;
/*
Top of the image data. This is needed to position the heap.
*/
int top_data = 0;
/*
First text segment where the mach header is.
*/
void* first_text = 0;
void* first_text_linker = 0;
/* read in load commands */
kernel_read(bprm->file, macho_header_sz, addr, head->sizeofcmds);
while (ncmds--) {
/* LC pointer */
struct load_command *lcp =
(struct load_command *)(addr + offset);
oldoffset = offset;
offset += lcp->cmdsize;
if (oldoffset > offset ||
lcp->cmdsize < sizeof(struct load_command) ||
offset > head->sizeofcmds + macho_header_sz)
{
printk(KERN_WARNING "load_macho_binary: malformed binary - lc overflow \n");
goto lc_ret;
}
/* Parse load commands.
We only need a bare minimum to get the image up an running. Dyld will
take care of all the other stuff.
*/
switch(lcp->cmd) {
case LC_SEGMENT:
ret = ml_loadSegment(bprm, file_size, (struct segment_command*)lcp, &top_data, &first_text, 0);
if (ret != LOAD_SUCCESS) {
printk(KERN_WARNING "load_macho_binary: segment loading failure \n");
goto lc_ret;
}
break;
case LC_LOAD_DYLINKER:
ret = ml_loadDylinker(bprm, file_size, (struct dylinker_command*)lcp, &linker_file);
if (ret != LOAD_SUCCESS) {
printk(KERN_WARNING "load_macho_binary: dylinker loading failure \n");
goto lc_ret;
}
else {
/* done */
}
break;
case LC_UNIXTHREAD:
ret = ml_loadUnixThread(bprm, file_size, (struct arm_thread_command*)lcp, &entry_point);
if (ret != LOAD_SUCCESS) {
printk(KERN_WARNING "load_macho_binary: unix thread loading failure \n");
goto lc_ret;
}
break;
default:
if (_verboseLog)
printk(KERN_WARNING "load_macho_binary: unsupported lc 0x%p \n", (void*)lcp->cmd);
break;
}
}
/*
Bootstrap the dynamic linker if needed.
*/
if (linker_file) {
int dylinker_load_addr = top_data;
ml_bootstrapDylinker(linker_file,
&top_data,
&first_text_linker,
&entry_point);
/* slide the entry point */
entry_point = entry_point + dylinker_load_addr;
if (_verboseLog)
printk(KERN_WARNING "load_macho_binary: dylinker's first text segment @ %d, new pc @ %d \n",
first_text_linker,
(int)entry_point);
}
/*
Now, I don't know what these are used for, but I'm fairly sure
they're *very* important. So let's set them up.
See 'linux/mm_types.h':
unsigned long start_code, end_code, start_data, end_data;
unsigned long start_brk, brk, start_stack;
*/
current->mm->start_code = 0; /* IMP */
current->mm->end_code = top_data; /* IMP */
current->mm->start_data = 0;
current->mm->end_data = top_data;
if (_verboseLog)
printk(KERN_WARNING "load_macho_binary: setting up heap ...\n");
/* Set up an empty heap. This will be grown as more memory is allocated. */
int brkret = ml_setBrk(top_data, top_data);
if (_verboseLog)
printk(KERN_WARNING "load_macho_binary: setting up misc ...\n");
/* setup misc stuff */
set_binfmt(&macho_format);
install_exec_creds(bprm);
/*
Stack (grows down on ARM).
*/
uint32_t* stack = bprm->p;
uint32_t* argv_array;
uint32_t* argv;
uint32_t* envp_array;
uint32_t* envp;
uint32_t total_argv_size;
uint32_t total_env_size;
/* Construct envp array. */
envp = envp_array = stack = (uint32_t*)stack - ((bprm->envc+1));
/* Construct argv array. */
argv = argv_array = stack = (uint32_t*)stack - ((bprm->argc+1));
if (_verboseLog)
printk(KERN_WARNING "load_macho_binary: setting up stack @ %p ...\n", (uint32_t*)stack);
uint32_t argc = bprm->argc;
uint32_t envc = bprm->envc;
char* p = bprm->p;
/* Set up argv pointers */
current->mm->arg_start = (unsigned long)p;
while(argc--) {
char c;
put_user(p,argv++);
do {
get_user(c,p++);
} while (c);
}
put_user(NULL,argv);
/* Set up envp pointers */
current->mm->arg_end = current->mm->env_start = (unsigned long) p;
while(envc--) {
char c;
put_user(p,envp++);
do {
get_user(c,p++);
} while (c);
}
put_user(NULL,envp);
current->mm->env_end = (unsigned long) p;
/*
The actual stuff passed to the linker goes here.
*/
stack = (uint32_t*)stack - (4);
stack[0] = (uint32_t)first_text; /* mach_header */
stack[1] = bprm->argc; /* argc */
stack[2] = argv_array; /* argv */
stack[3] = (uint32_t)first_text_linker; /* linker's mach_header */
if (_verboseLog)
printk(KERN_WARNING "load_macho_binary: setting up main thread ...\n");
/*
Set up the main thread
*/
if (BAD_ADDR(entry_point)) {
/* entry point is not executable */
printk(KERN_WARNING "load_macho_binary: bad entry point \n");
force_sig(SIGSEGV, current);
retval = -EINVAL;
goto lc_ret;
}
if (_verboseLog)
printk(KERN_WARNING "load_macho_binary: setting up registers ...\n");
/*
See 'start_thread' in 'processor.h'
'start_thread' provides an ELF implementation of this function.
This is for the Darwin ABI implementation which is used by iPhoneOS binaries.
*/
unsigned long initial_pc = (unsigned long)entry_point;
/* exit supervisor and enter user */
set_fs(USER_DS);
memset(regs->uregs, 0, sizeof(regs->uregs));
regs->ARM_cpsr = USR_MODE;
/* not sure */
if (elf_hwcap & HWCAP_THUMB && initial_pc & 1)
regs->ARM_cpsr |= PSR_T_BIT;
/* set up control regs */
regs->ARM_cpsr |= PSR_ENDSTATE;
regs->ARM_pc = initial_pc & ~1; /* pc */
regs->ARM_sp = stack; /* sp */
/* This is actually ignored, but set it anyway */
regs->ARM_r2 = stack[2]; /* r2 (envp) */
regs->ARM_r1 = stack[1]; /* r1 (argv) */
regs->ARM_r0 = stack[0]; /* r0 (argc) */
/* this will work for mmu and nonmmu */
nommu_start_thread(regs);
wire_weird_pages();
/*
Binary is now loaded. Return 0 to signify success.
*/
retval = 0;
if (_verboseLog)
printk(KERN_WARNING "load_macho_binary: complete, heap starts at %d, brkret %d \n", top_data, brkret);
/*
Teardown
*/
lc_ret:
kfree(addr);
out_ret:
return retval;
}
