fs/binfmt_elf.c

   1 /*
   2  * linux/fs/binfmt_elf.c
   3  *
   4  * These are the functions used to load ELF format executables as used
   5  * on SVr4 machines.  Information on the format may be found in the book
   6  * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
   7  * Tools".
   8  *
   9  * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com).
  10  */
  11
  12 #include <linux/module.h>
  13 #include <linux/kernel.h>
  14 #include <linux/fs.h>
  15 #include <linux/stat.h>
  16 #include <linux/time.h>
  17 #include <linux/mm.h>
  18 #include <linux/mman.h>
  19 #include <linux/a.out.h>
  20 #include <linux/errno.h>
  21 #include <linux/signal.h>
  22 #include <linux/binfmts.h>
  23 #include <linux/string.h>
  24 #include <linux/file.h>
  25 #include <linux/fcntl.h>
  26 #include <linux/ptrace.h>
  27 #include <linux/slab.h>
  28 #include <linux/shm.h>
  29 #include <linux/personality.h>
  30 #include <linux/elfcore.h>
  31 #include <linux/init.h>
  32 #include <linux/highuid.h>
  33 #include <linux/smp.h>
  34 #include <linux/smp_lock.h>
  35 #include <linux/compiler.h>
  36 #include <linux/highmem.h>
  37 #include <linux/pagemap.h>
  38 #include <linux/security.h>
  39 #include <linux/syscalls.h>
  40 #include <linux/random.h>
  41
  42 #include <asm/uaccess.h>
  43 #include <asm/param.h>
  44 #include <asm/page.h>
  45
  46 #include <linux/elf.h>
  47
  48 static int load_elf_binary(struct linux_binprm * bprm, struct pt_regs * regs);
  49 static int load_elf_library(struct file*);
  50 static unsigned long elf_map (struct file *, unsigned long, struct elf_phdr *, int, int);
  51 extern int dump_fpu (struct pt_regs *, elf_fpregset_t *);
  52
  53 #ifndef elf_addr_t
  54 #define elf_addr_t unsigned long
  55 #endif
  56
  57 /*
  58  * If we don't support core dumping, then supply a NULL so we
  59  * don't even try.
  60  */
  61 #ifdef USE_ELF_CORE_DUMP
  62 static int elf_core_dump(long signr, struct pt_regs * regs, struct file * file);
  63 #else
  64 #define elf_core_dump   NULL
  65 #endif
  66
  67 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
  68 # define ELF_MIN_ALIGN  ELF_EXEC_PAGESIZE
  69 #else
  70 # define ELF_MIN_ALIGN  PAGE_SIZE
  71 #endif
  72
  73 #ifndef ELF_CORE_EFLAGS
  74 #define ELF_CORE_EFLAGS 0
  75 #endif
  76
  77 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
  78 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
  79 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
  80
  81 static struct linux_binfmt elf_format = {
  82                 .module         = THIS_MODULE,
  83                 .load_binary    = load_elf_binary,
  84                 .load_shlib     = load_elf_library,
  85                 .core_dump      = elf_core_dump,
  86                 .min_coredump   = ELF_EXEC_PAGESIZE
  87 };
  88
  89 #define BAD_ADDR(x)     ((unsigned long)(x) > TASK_SIZE)
  90
  91 static int set_brk(unsigned long start, unsigned long end)
  92 {
  93         start = ELF_PAGEALIGN(start);
  94         end = ELF_PAGEALIGN(end);
  95         if (end > start) {
  96                 unsigned long addr;
  97                 down_write(&current->mm->mmap_sem);
  98                 addr = do_brk(start, end - start);
  99                 up_write(&current->mm->mmap_sem);
 100                 if (BAD_ADDR(addr))
 101                         return addr;
 102         }
 103         current->mm->start_brk = current->mm->brk = end;
 104         return 0;
 105 }
 106
 107
 108 /* We need to explicitly zero any fractional pages
 109    after the data section (i.e. bss).  This would
 110    contain the junk from the file that should not
 111    be in memory */
 112
 113
 114 static int padzero(unsigned long elf_bss)
 115 {
 116         unsigned long nbyte;
 117
 118         nbyte = ELF_PAGEOFFSET(elf_bss);
 119         if (nbyte) {
 120                 nbyte = ELF_MIN_ALIGN - nbyte;
 121                 if (clear_user((void __user *) elf_bss, nbyte))
 122                         return -EFAULT;
 123         }
 124         return 0;
 125 }
 126
 127 /* Let's use some macros to make this stack manipulation a litle clearer */
 128 #ifdef CONFIG_STACK_GROWSUP
 129 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
 130 #define STACK_ROUND(sp, items) \
 131         ((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
 132 #define STACK_ALLOC(sp, len) ({ elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; old_sp; })
 133 #else
 134 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
 135 #define STACK_ROUND(sp, items) \
 136         (((unsigned long) (sp - items)) &~ 15UL)
 137 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
 138 #endif
 139
 140 static int
 141 create_elf_tables(struct linux_binprm *bprm, struct elfhdr * exec,
 142                 int interp_aout, unsigned long load_addr,
 143                 unsigned long interp_load_addr)
 144 {
 145         unsigned long p = bprm->p;
 146         int argc = bprm->argc;
 147         int envc = bprm->envc;
 148         elf_addr_t __user *argv;
 149         elf_addr_t __user *envp;
 150         elf_addr_t __user *sp;
 151         elf_addr_t __user *u_platform;
 152         const char *k_platform = ELF_PLATFORM;
 153         int items;
 154         elf_addr_t *elf_info;
 155         int ei_index = 0;
 156         struct task_struct *tsk = current;
 157
 158         /*
 159          * If this architecture has a platform capability string, copy it
 160          * to userspace.  In some cases (Sparc), this info is impossible
 161          * for userspace to get any other way, in others (i386) it is
 162          * merely difficult.
 163          */
 164
 165         u_platform = NULL;
 166         if (k_platform) {
 167                 size_t len = strlen(k_platform) + 1;
 168
 169                 /*
 170                  * In some cases (e.g. Hyper-Threading), we want to avoid L1
 171                  * evictions by the processes running on the same package. One
 172                  * thing we can do is to shuffle the initial stack for them.
 173                  */
 174
 175                 p = arch_align_stack(p);
 176
 177                 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
 178                 if (__copy_to_user(u_platform, k_platform, len))
 179                         return -EFAULT;
 180         }
 181
 182         /* Create the ELF interpreter info */
 183         elf_info = (elf_addr_t *) current->mm->saved_auxv;
 184 #define NEW_AUX_ENT(id, val) \
 185         do { elf_info[ei_index++] = id; elf_info[ei_index++] = val; } while (0)
 186
 187 #ifdef ARCH_DLINFO
 188         /*
 189          * ARCH_DLINFO must come first so PPC can do its special alignment of
 190          * AUXV.
 191          */
 192         ARCH_DLINFO;
 193 #endif
 194         NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
 195         NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
 196         NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
 197         NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
 198         NEW_AUX_ENT(AT_PHENT, sizeof (struct elf_phdr));
 199         NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
 200         NEW_AUX_ENT(AT_BASE, interp_load_addr);
 201         NEW_AUX_ENT(AT_FLAGS, 0);
 202         NEW_AUX_ENT(AT_ENTRY, exec->e_entry);
 203         NEW_AUX_ENT(AT_UID, (elf_addr_t) tsk->uid);
 204         NEW_AUX_ENT(AT_EUID, (elf_addr_t) tsk->euid);
 205         NEW_AUX_ENT(AT_GID, (elf_addr_t) tsk->gid);
 206         NEW_AUX_ENT(AT_EGID, (elf_addr_t) tsk->egid);
 207         NEW_AUX_ENT(AT_SECURE, (elf_addr_t) security_bprm_secureexec(bprm));
 208         if (k_platform) {
 209                 NEW_AUX_ENT(AT_PLATFORM, (elf_addr_t)(unsigned long)u_platform);
 210         }
 211         if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) {
 212                 NEW_AUX_ENT(AT_EXECFD, (elf_addr_t) bprm->interp_data);
 213         }
 214 #undef NEW_AUX_ENT
 215         /* AT_NULL is zero; clear the rest too */
 216         memset(&elf_info[ei_index], 0,
 217                sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]);
 218
 219         /* And advance past the AT_NULL entry.  */
 220         ei_index += 2;
 221
 222         sp = STACK_ADD(p, ei_index);
 223
 224         items = (argc + 1) + (envc + 1);
 225         if (interp_aout) {
 226                 items += 3; /* a.out interpreters require argv & envp too */
 227         } else {
 228                 items += 1; /* ELF interpreters only put argc on the stack */
 229         }
 230         bprm->p = STACK_ROUND(sp, items);
 231
 232         /* Point sp at the lowest address on the stack */
 233 #ifdef CONFIG_STACK_GROWSUP
 234         sp = (elf_addr_t __user *)bprm->p - items - ei_index;
 235         bprm->exec = (unsigned long) sp; /* XXX: PARISC HACK */
 236 #else
 237         sp = (elf_addr_t __user *)bprm->p;
 238 #endif
 239
 240         /* Now, let's put argc (and argv, envp if appropriate) on the stack */
 241         if (__put_user(argc, sp++))
 242                 return -EFAULT;
 243         if (interp_aout) {
 244                 argv = sp + 2;
 245                 envp = argv + argc + 1;
 246                 __put_user((elf_addr_t)(unsigned long)argv, sp++);
 247                 __put_user((elf_addr_t)(unsigned long)envp, sp++);
 248         } else {
 249                 argv = sp;
 250                 envp = argv + argc + 1;
 251         }
 252
 253         /* Populate argv and envp */
 254         p = current->mm->arg_end = current->mm->arg_start;
 255         while (argc-- > 0) {
 256                 size_t len;
 257                 __put_user((elf_addr_t)p, argv++);
 258                 len = strnlen_user((void __user *)p, PAGE_SIZE*MAX_ARG_PAGES);
 259                 if (!len || len > PAGE_SIZE*MAX_ARG_PAGES)
 260                         return 0;
 261                 p += len;
 262         }
 263         if (__put_user(0, argv))
 264                 return -EFAULT;
 265         current->mm->arg_end = current->mm->env_start = p;
 266         while (envc-- > 0) {
 267                 size_t len;
 268                 __put_user((elf_addr_t)p, envp++);
 269                 len = strnlen_user((void __user *)p, PAGE_SIZE*MAX_ARG_PAGES);
 270                 if (!len || len > PAGE_SIZE*MAX_ARG_PAGES)
 271                         return 0;
 272                 p += len;
 273         }
 274         if (__put_user(0, envp))
 275                 return -EFAULT;
 276         current->mm->env_end = p;
 277
 278         /* Put the elf_info on the stack in the right place.  */
 279         sp = (elf_addr_t __user *)envp + 1;
 280         if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
 281                 return -EFAULT;
 282         return 0;
 283 }
 284
 285 #ifndef elf_map
 286
 287 static unsigned long elf_map(struct file *filep, unsigned long addr,
 288                         struct elf_phdr *eppnt, int prot, int type)
 289 {
 290         unsigned long map_addr;
 291
 292         down_write(&current->mm->mmap_sem);
 293         map_addr = do_mmap(filep, ELF_PAGESTART(addr),
 294                            eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr), prot, type,
 295                            eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr));
 296         up_write(&current->mm->mmap_sem);
 297         return(map_addr);
 298 }
 299
 300 #endif /* !elf_map */
 301
 302 /* This is much more generalized than the library routine read function,
 303    so we keep this separate.  Technically the library read function
 304    is only provided so that we can read a.out libraries that have
 305    an ELF header */
 306
 307 static unsigned long load_elf_interp(struct elfhdr * interp_elf_ex,
 308                                      struct file * interpreter,
 309                                      unsigned long *interp_load_addr)
 310 {
 311         struct elf_phdr *elf_phdata;
 312         struct elf_phdr *eppnt;
 313         unsigned long load_addr = 0;
 314         int load_addr_set = 0;
 315         unsigned long last_bss = 0, elf_bss = 0;
 316         unsigned long error = ~0UL;
 317         int retval, i, size;
 318
 319         /* First of all, some simple consistency checks */
 320         if (interp_elf_ex->e_type != ET_EXEC &&
 321             interp_elf_ex->e_type != ET_DYN)
 322                 goto out;
 323         if (!elf_check_arch(interp_elf_ex))
 324                 goto out;
 325         if (!interpreter->f_op || !interpreter->f_op->mmap)
 326                 goto out;
 327
 328         /*
 329          * If the size of this structure has changed, then punt, since
 330          * we will be doing the wrong thing.
 331          */
 332         if (interp_elf_ex->e_phentsize != sizeof(struct elf_phdr))
 333                 goto out;
 334         if (interp_elf_ex->e_phnum < 1 ||
 335                 interp_elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr))
 336                 goto out;
 337
 338         /* Now read in all of the header information */
 339
 340         size = sizeof(struct elf_phdr) * interp_elf_ex->e_phnum;
 341         if (size > ELF_MIN_ALIGN)
 342                 goto out;
 343         elf_phdata = (struct elf_phdr *) kmalloc(size, GFP_KERNEL);
 344         if (!elf_phdata)
 345                 goto out;
 346
 347         retval = kernel_read(interpreter,interp_elf_ex->e_phoff,(char *)elf_phdata,size);
 348         error = -EIO;
 349         if (retval != size) {
 350                 if (retval < 0)
 351                         error = retval;
 352                 goto out_close;
 353         }
 354
 355         eppnt = elf_phdata;
 356         for (i=0; i<interp_elf_ex->e_phnum; i++, eppnt++) {
 357           if (eppnt->p_type == PT_LOAD) {
 358             int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
 359             int elf_prot = 0;
 360             unsigned long vaddr = 0;
 361             unsigned long k, map_addr;
 362
 363             if (eppnt->p_flags & PF_R) elf_prot =  PROT_READ;
 364             if (eppnt->p_flags & PF_W) elf_prot |= PROT_WRITE;
 365             if (eppnt->p_flags & PF_X) elf_prot |= PROT_EXEC;
 366             vaddr = eppnt->p_vaddr;
 367             if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
 368                 elf_type |= MAP_FIXED;
 369
 370             map_addr = elf_map(interpreter, load_addr + vaddr, eppnt, elf_prot, elf_type);
 371             error = map_addr;
 372             if (BAD_ADDR(map_addr))
 373                 goto out_close;
 374
 375             if (!load_addr_set && interp_elf_ex->e_type == ET_DYN) {
 376                 load_addr = map_addr - ELF_PAGESTART(vaddr);
 377                 load_addr_set = 1;
 378             }
 379
 380             /*
 381              * Check to see if the section's size will overflow the
 382              * allowed task size. Note that p_filesz must always be
 383              * <= p_memsize so it is only necessary to check p_memsz.
 384              */
 385             k = load_addr + eppnt->p_vaddr;
 386             if (k > TASK_SIZE || eppnt->p_filesz > eppnt->p_memsz ||
 387                 eppnt->p_memsz > TASK_SIZE || TASK_SIZE - eppnt->p_memsz < k) {
 388                 error = -ENOMEM;
 389                 goto out_close;
 390             }
 391
 392             /*
 393              * Find the end of the file mapping for this phdr, and keep
 394              * track of the largest address we see for this.
 395              */
 396             k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
 397             if (k > elf_bss)
 398                 elf_bss = k;
 399
 400             /*
 401              * Do the same thing for the memory mapping - between
 402              * elf_bss and last_bss is the bss section.
 403              */
 404             k = load_addr + eppnt->p_memsz + eppnt->p_vaddr;
 405             if (k > last_bss)
 406                 last_bss = k;
 407           }
 408         }
 409
 410         /*
 411          * Now fill out the bss section.  First pad the last page up
 412          * to the page boundary, and then perform a mmap to make sure
 413          * that there are zero-mapped pages up to and including the
 414          * last bss page.
 415          */
 416         if (padzero(elf_bss)) {
 417                 error = -EFAULT;
 418                 goto out_close;
 419         }
 420
 421         elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);   /* What we have mapped so far */
 422
 423         /* Map the last of the bss segment */
 424         if (last_bss > elf_bss) {
 425                 down_write(&current->mm->mmap_sem);
 426                 error = do_brk(elf_bss, last_bss - elf_bss);
 427                 up_write(&current->mm->mmap_sem);
 428                 if (BAD_ADDR(error))
 429                         goto out_close;
 430         }
 431
 432         *interp_load_addr = load_addr;
 433         error = ((unsigned long) interp_elf_ex->e_entry) + load_addr;
 434
 435 out_close:
 436         kfree(elf_phdata);
 437 out:
 438         return error;
 439 }
 440
 441 static unsigned long load_aout_interp(struct exec * interp_ex,
 442                              struct file * interpreter)
 443 {
 444         unsigned long text_data, elf_entry = ~0UL;
 445         char __user * addr;
 446         loff_t offset;
 447
 448         current->mm->end_code = interp_ex->a_text;
 449         text_data = interp_ex->a_text + interp_ex->a_data;
 450         current->mm->end_data = text_data;
 451         current->mm->brk = interp_ex->a_bss + text_data;
 452
 453         switch (N_MAGIC(*interp_ex)) {
 454         case OMAGIC:
 455                 offset = 32;
 456                 addr = (char __user *)0;
 457                 break;
 458         case ZMAGIC:
 459         case QMAGIC:
 460                 offset = N_TXTOFF(*interp_ex);
 461                 addr = (char __user *) N_TXTADDR(*interp_ex);
 462                 break;
 463         default:
 464                 goto out;
 465         }
 466
 467         down_write(&current->mm->mmap_sem);
 468         do_brk(0, text_data);
 469         up_write(&current->mm->mmap_sem);
 470         if (!interpreter->f_op || !interpreter->f_op->read)
 471                 goto out;
 472         if (interpreter->f_op->read(interpreter, addr, text_data, &offset) < 0)
 473                 goto out;
 474         flush_icache_range((unsigned long)addr,
 475                            (unsigned long)addr + text_data);
 476
 477
 478         down_write(&current->mm->mmap_sem);
 479         do_brk(ELF_PAGESTART(text_data + ELF_MIN_ALIGN - 1),
 480                 interp_ex->a_bss);
 481         up_write(&current->mm->mmap_sem);
 482         elf_entry = interp_ex->a_entry;
 483
 484 out:
 485         return elf_entry;
 486 }
 487
 488 /*
 489  * These are the functions used to load ELF style executables and shared
 490  * libraries.  There is no binary dependent code anywhere else.
 491  */
 492
 493 #define INTERPRETER_NONE 0
 494 #define INTERPRETER_AOUT 1
 495 #define INTERPRETER_ELF 2
 496
 497
 498 static unsigned long randomize_stack_top(unsigned long stack_top)
 499 {
 500         unsigned int random_variable = 0;
 501
 502         if (current->flags & PF_RANDOMIZE)
 503                 random_variable = get_random_int() % (8*1024*1024);
 504 #ifdef CONFIG_STACK_GROWSUP
 505         return PAGE_ALIGN(stack_top + random_variable);
 506 #else
 507         return PAGE_ALIGN(stack_top - random_variable);
 508 #endif
 509 }
 510
 511 static int load_elf_binary(struct linux_binprm * bprm, struct pt_regs * regs)
 512 {
 513         struct file *interpreter = NULL; /* to shut gcc up */
 514         unsigned long load_addr = 0, load_bias = 0;
 515         int load_addr_set = 0;
 516         char * elf_interpreter = NULL;
 517         unsigned int interpreter_type = INTERPRETER_NONE;
 518         unsigned char ibcs2_interpreter = 0;
 519         unsigned long error;
 520         struct elf_phdr * elf_ppnt, *elf_phdata;
 521         unsigned long elf_bss, elf_brk;
 522         int elf_exec_fileno;
 523         int retval, i;
 524         unsigned int size;
 525         unsigned long elf_entry, interp_load_addr = 0;
 526         unsigned long start_code, end_code, start_data, end_data;
 527         unsigned long reloc_func_desc = 0;
 528         char passed_fileno[6];
 529         struct files_struct *files;
 530         int have_pt_gnu_stack, executable_stack = EXSTACK_DEFAULT;
 531         unsigned long def_flags = 0;
 532         struct {
 533                 struct elfhdr elf_ex;
 534                 struct elfhdr interp_elf_ex;
 535                 struct exec interp_ex;
 536         } *loc;
 537
 538         loc = kmalloc(sizeof(*loc), GFP_KERNEL);
 539         if (!loc) {
 540                 retval = -ENOMEM;
 541                 goto out_ret;
 542         }
 543
 544         /* Get the exec-header */
 545         loc->elf_ex = *((struct elfhdr *) bprm->buf);
 546
 547         retval = -ENOEXEC;
 548         /* First of all, some simple consistency checks */
 549         if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 550                 goto out;
 551
 552         if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN)
 553                 goto out;
 554         if (!elf_check_arch(&loc->elf_ex))
 555                 goto out;
 556         if (!bprm->file->f_op||!bprm->file->f_op->mmap)
 557                 goto out;
 558
 559         /* Now read in all of the header information */
 560
 561         if (loc->elf_ex.e_phentsize != sizeof(struct elf_phdr))
 562                 goto out;
 563         if (loc->elf_ex.e_phnum < 1 ||
 564                 loc->elf_ex.e_phnum > 65536U / sizeof(struct elf_phdr))
 565                 goto out;
 566         size = loc->elf_ex.e_phnum * sizeof(struct elf_phdr);
 567         retval = -ENOMEM;
 568         elf_phdata = (struct elf_phdr *) kmalloc(size, GFP_KERNEL);
 569         if (!elf_phdata)
 570                 goto out;
 571
 572         retval = kernel_read(bprm->file, loc->elf_ex.e_phoff, (char *) elf_phdata, size);
 573         if (retval != size) {
 574                 if (retval >= 0)
 575                         retval = -EIO;
 576                 goto out_free_ph;
 577         }
 578
 579         files = current->files;         /* Refcounted so ok */
 580         retval = unshare_files();
 581         if (retval < 0)
 582                 goto out_free_ph;
 583         if (files == current->files) {
 584                 put_files_struct(files);
 585                 files = NULL;
 586         }
 587
 588         /* exec will make our files private anyway, but for the a.out
 589            loader stuff we need to do it earlier */
 590
 591         retval = get_unused_fd();
 592         if (retval < 0)
 593                 goto out_free_fh;
 594         get_file(bprm->file);
 595         fd_install(elf_exec_fileno = retval, bprm->file);
 596
 597         elf_ppnt = elf_phdata;
 598         elf_bss = 0;
 599         elf_brk = 0;
 600
 601         start_code = ~0UL;
 602         end_code = 0;
 603         start_data = 0;
 604         end_data = 0;
 605
 606         for (i = 0; i < loc->elf_ex.e_phnum; i++) {
 607                 if (elf_ppnt->p_type == PT_INTERP) {
 608                         /* This is the program interpreter used for
 609                          * shared libraries - for now assume that this
 610                          * is an a.out format binary
 611                          */
 612
 613                         retval = -ENOEXEC;
 614                         if (elf_ppnt->p_filesz > PATH_MAX ||
 615                             elf_ppnt->p_filesz < 2)
 616                                 goto out_free_file;
 617
 618                         retval = -ENOMEM;
 619                         elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz,
 620                                                            GFP_KERNEL);
 621                         if (!elf_interpreter)
 622                                 goto out_free_file;
 623
 624                         retval = kernel_read(bprm->file, elf_ppnt->p_offset,
 625                                            elf_interpreter,
 626                                            elf_ppnt->p_filesz);
 627                         if (retval != elf_ppnt->p_filesz) {
 628                                 if (retval >= 0)
 629                                         retval = -EIO;
 630                                 goto out_free_interp;
 631                         }
 632                         /* make sure path is NULL terminated */
 633                         retval = -ENOEXEC;
 634                         if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
 635                                 goto out_free_interp;
 636
 637                         /* If the program interpreter is one of these two,
 638                          * then assume an iBCS2 image. Otherwise assume
 639                          * a native linux image.
 640                          */
 641                         if (strcmp(elf_interpreter,"/usr/lib/libc.so.1") == 0 ||
 642                             strcmp(elf_interpreter,"/usr/lib/ld.so.1") == 0)
 643                                 ibcs2_interpreter = 1;
 644
 645                         /*
 646                          * The early SET_PERSONALITY here is so that the lookup
 647                          * for the interpreter happens in the namespace of the
 648                          * to-be-execed image.  SET_PERSONALITY can select an
 649                          * alternate root.
 650                          *
 651                          * However, SET_PERSONALITY is NOT allowed to switch
 652                          * this task into the new images's memory mapping
 653                          * policy - that is, TASK_SIZE must still evaluate to
 654                          * that which is appropriate to the execing application.
 655                          * This is because exit_mmap() needs to have TASK_SIZE
 656                          * evaluate to the size of the old image.
 657                          *
 658                          * So if (say) a 64-bit application is execing a 32-bit
 659                          * application it is the architecture's responsibility
 660                          * to defer changing the value of TASK_SIZE until the
 661                          * switch really is going to happen - do this in
 662                          * flush_thread().      - akpm
 663                          */
 664                         SET_PERSONALITY(loc->elf_ex, ibcs2_interpreter);
 665
 666                         interpreter = open_exec(elf_interpreter);
 667                         retval = PTR_ERR(interpreter);
 668                         if (IS_ERR(interpreter))
 669                                 goto out_free_interp;
 670                         retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE);
 671                         if (retval != BINPRM_BUF_SIZE) {
 672                                 if (retval >= 0)
 673                                         retval = -EIO;
 674                                 goto out_free_dentry;
 675                         }
 676
 677                         /* Get the exec headers */
 678                         loc->interp_ex = *((struct exec *) bprm->buf);
 679                         loc->interp_elf_ex = *((struct elfhdr *) bprm->buf);
 680                         break;
 681                 }
 682                 elf_ppnt++;
 683         }
 684
 685         elf_ppnt = elf_phdata;
 686         for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)
 687                 if (elf_ppnt->p_type == PT_GNU_STACK) {
 688                         if (elf_ppnt->p_flags & PF_X)
 689                                 executable_stack = EXSTACK_ENABLE_X;
 690                         else
 691                                 executable_stack = EXSTACK_DISABLE_X;
 692                         break;
 693                 }
 694         have_pt_gnu_stack = (i < loc->elf_ex.e_phnum);
 695
 696         /* Some simple consistency checks for the interpreter */
 697         if (elf_interpreter) {
 698                 interpreter_type = INTERPRETER_ELF | INTERPRETER_AOUT;
 699
 700                 /* Now figure out which format our binary is */
 701                 if ((N_MAGIC(loc->interp_ex) != OMAGIC) &&
 702                     (N_MAGIC(loc->interp_ex) != ZMAGIC) &&
 703                     (N_MAGIC(loc->interp_ex) != QMAGIC))
 704                         interpreter_type = INTERPRETER_ELF;
 705
 706                 if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
 707                         interpreter_type &= ~INTERPRETER_ELF;
 708
 709                 retval = -ELIBBAD;
 710                 if (!interpreter_type)
 711                         goto out_free_dentry;
 712
 713                 /* Make sure only one type was selected */
 714                 if ((interpreter_type & INTERPRETER_ELF) &&
 715                      interpreter_type != INTERPRETER_ELF) {
 716                         // FIXME - ratelimit this before re-enabling
 717                         // printk(KERN_WARNING "ELF: Ambiguous type, using ELF\n");
 718                         interpreter_type = INTERPRETER_ELF;
 719                 }
 720                 /* Verify the interpreter has a valid arch */
 721                 if ((interpreter_type == INTERPRETER_ELF) &&
 722                     !elf_check_arch(&loc->interp_elf_ex))
 723                         goto out_free_dentry;
 724         } else {
 725                 /* Executables without an interpreter also need a personality  */
 726                 SET_PERSONALITY(loc->elf_ex, ibcs2_interpreter);
 727         }
 728
 729         /* OK, we are done with that, now set up the arg stuff,
 730            and then start this sucker up */
 731
 732         if ((!bprm->sh_bang) && (interpreter_type == INTERPRETER_AOUT)) {
 733                 char *passed_p = passed_fileno;
 734                 sprintf(passed_fileno, "%d", elf_exec_fileno);
 735
 736                 if (elf_interpreter) {
 737                         retval = copy_strings_kernel(1, &passed_p, bprm);
 738                         if (retval)
 739                                 goto out_free_dentry;
 740                         bprm->argc++;
 741                 }
 742         }
 743
 744         /* Flush all traces of the currently running executable */
 745         retval = flush_old_exec(bprm);
 746         if (retval)
 747                 goto out_free_dentry;
 748
 749         /* Discard our unneeded old files struct */
 750         if (files) {
 751                 steal_locks(files);
 752                 put_files_struct(files);
 753                 files = NULL;
 754         }
 755
 756         /* OK, This is the point of no return */
 757         current->mm->start_data = 0;
 758         current->mm->end_data = 0;
 759         current->mm->end_code = 0;
 760         current->mm->mmap = NULL;
 761         current->flags &= ~PF_FORKNOEXEC;
 762         current->mm->def_flags = def_flags;
 763
 764         /* Do this immediately, since STACK_TOP as used in setup_arg_pages
 765            may depend on the personality.  */
 766         SET_PERSONALITY(loc->elf_ex, ibcs2_interpreter);
 767         if (elf_read_implies_exec(loc->elf_ex, executable_stack))
 768                 current->personality |= READ_IMPLIES_EXEC;
 769
 770         if ( !(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
 771                 current->flags |= PF_RANDOMIZE;
 772         arch_pick_mmap_layout(current->mm);
 773
 774         /* Do this so that we can load the interpreter, if need be.  We will
 775            change some of these later */
 776         current->mm->free_area_cache = current->mm->mmap_base;
 777         current->mm->cached_hole_size = 0;
 778         retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
 779                                  executable_stack);
 780         if (retval < 0) {
 781                 send_sig(SIGKILL, current, 0);
 782                 goto out_free_dentry;
 783         }
 784
 785         current->mm->start_stack = bprm->p;
 786
 787         /* Now we do a little grungy work by mmaping the ELF image into
 788            the correct location in memory.  At this point, we assume that
 789            the image should be loaded at fixed address, not at a variable
 790            address. */
 791
 792         for(i = 0, elf_ppnt = elf_phdata; i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
 793                 int elf_prot = 0, elf_flags;
 794                 unsigned long k, vaddr;
 795
 796                 if (elf_ppnt->p_type != PT_LOAD)
 797                         continue;
 798
 799                 if (unlikely (elf_brk > elf_bss)) {
 800                         unsigned long nbyte;
 801
 802                         /* There was a PT_LOAD segment with p_memsz > p_filesz
 803                            before this one. Map anonymous pages, if needed,
 804                            and clear the area.  */
 805                         retval = set_brk (elf_bss + load_bias,
 806                                           elf_brk + load_bias);
 807                         if (retval) {
 808                                 send_sig(SIGKILL, current, 0);
 809                                 goto out_free_dentry;
 810                         }
 811                         nbyte = ELF_PAGEOFFSET(elf_bss);
 812                         if (nbyte) {
 813                                 nbyte = ELF_MIN_ALIGN - nbyte;
 814                                 if (nbyte > elf_brk - elf_bss)
 815                                         nbyte = elf_brk - elf_bss;
 816                                 if (clear_user((void __user *)elf_bss +
 817                                                         load_bias, nbyte)) {
 818                                         /*
 819                                          * This bss-zeroing can fail if the ELF
 820                                          * file specifies odd protections.  So
 821                                          * we don't check the return value
 822                                          */
 823                                 }
 824                         }
 825                 }
 826
 827                 if (elf_ppnt->p_flags & PF_R) elf_prot |= PROT_READ;
 828                 if (elf_ppnt->p_flags & PF_W) elf_prot |= PROT_WRITE;
 829                 if (elf_ppnt->p_flags & PF_X) elf_prot |= PROT_EXEC;
 830
 831                 elf_flags = MAP_PRIVATE|MAP_DENYWRITE|MAP_EXECUTABLE;
 832
 833                 vaddr = elf_ppnt->p_vaddr;
 834                 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
 835                         elf_flags |= MAP_FIXED;
 836                 } else if (loc->elf_ex.e_type == ET_DYN) {
 837                         /* Try and get dynamic programs out of the way of the default mmap
 838                            base, as well as whatever program they might try to exec.  This
 839                            is because the brk will follow the loader, and is not movable.  */
 840                         load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 841                 }
 842
 843                 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags);
 844                 if (BAD_ADDR(error)) {
 845                         send_sig(SIGKILL, current, 0);
 846                         goto out_free_dentry;
 847                 }
 848
 849                 if (!load_addr_set) {
 850                         load_addr_set = 1;
 851                         load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);
 852                         if (loc->elf_ex.e_type == ET_DYN) {
 853                                 load_bias += error -
 854                                              ELF_PAGESTART(load_bias + vaddr);
 855                                 load_addr += load_bias;
 856                                 reloc_func_desc = load_bias;
 857                         }
 858                 }
 859                 k = elf_ppnt->p_vaddr;
 860                 if (k < start_code) start_code = k;
 861                 if (start_data < k) start_data = k;
 862
 863                 /*
 864                  * Check to see if the section's size will overflow the
 865                  * allowed task size. Note that p_filesz must always be
 866                  * <= p_memsz so it is only necessary to check p_memsz.
 867                  */
 868                 if (k > TASK_SIZE || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
 869                     elf_ppnt->p_memsz > TASK_SIZE ||
 870                     TASK_SIZE - elf_ppnt->p_memsz < k) {
 871                         /* set_brk can never work.  Avoid overflows.  */
 872                         send_sig(SIGKILL, current, 0);
 873                         goto out_free_dentry;
 874                 }
 875
 876                 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
 877
 878                 if (k > elf_bss)
 879                         elf_bss = k;
 880                 if ((elf_ppnt->p_flags & PF_X) && end_code < k)
 881                         end_code = k;
 882                 if (end_data < k)
 883                         end_data = k;
 884                 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
 885                 if (k > elf_brk)
 886                         elf_brk = k;
 887         }
 888
 889         loc->elf_ex.e_entry += load_bias;
 890         elf_bss += load_bias;
 891         elf_brk += load_bias;
 892         start_code += load_bias;
 893         end_code += load_bias;
 894         start_data += load_bias;
 895         end_data += load_bias;
 896
 897         /* Calling set_brk effectively mmaps the pages that we need
 898          * for the bss and break sections.  We must do this before
 899          * mapping in the interpreter, to make sure it doesn't wind
 900          * up getting placed where the bss needs to go.
 901          */
 902         retval = set_brk(elf_bss, elf_brk);
 903         if (retval) {
 904                 send_sig(SIGKILL, current, 0);
 905                 goto out_free_dentry;
 906         }
 907         if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
 908                 send_sig(SIGSEGV, current, 0);
 909                 retval = -EFAULT; /* Nobody gets to see this, but.. */
 910                 goto out_free_dentry;
 911         }
 912
 913         if (elf_interpreter) {
 914                 if (interpreter_type == INTERPRETER_AOUT)
 915                         elf_entry = load_aout_interp(&loc->interp_ex,
 916                                                      interpreter);
 917                 else
 918                         elf_entry = load_elf_interp(&loc->interp_elf_ex,
 919                                                     interpreter,
 920                                                     &interp_load_addr);
 921                 if (BAD_ADDR(elf_entry)) {
 922                         printk(KERN_ERR "Unable to load interpreter %.128s\n",
 923                                 elf_interpreter);
 924                         force_sig(SIGSEGV, current);
 925                         retval = -ENOEXEC; /* Nobody gets to see this, but.. */
 926                         goto out_free_dentry;
 927                 }
 928                 reloc_func_desc = interp_load_addr;
 929
 930                 allow_write_access(interpreter);
 931                 fput(interpreter);
 932                 kfree(elf_interpreter);
 933         } else {
 934                 elf_entry = loc->elf_ex.e_entry;
 935         }
 936
 937         kfree(elf_phdata);
 938
 939         if (interpreter_type != INTERPRETER_AOUT)
 940                 sys_close(elf_exec_fileno);
 941
 942         set_binfmt(&elf_format);
 943
 944 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
 945         retval = arch_setup_additional_pages(bprm, executable_stack);
 946         if (retval < 0) {
 947                 send_sig(SIGKILL, current, 0);
 948                 goto out;
 949         }
 950 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
 951
 952         compute_creds(bprm);
 953         current->flags &= ~PF_FORKNOEXEC;
 954         create_elf_tables(bprm, &loc->elf_ex, (interpreter_type == INTERPRETER_AOUT),
 955                         load_addr, interp_load_addr);
 956         /* N.B. passed_fileno might not be initialized? */
 957         if (interpreter_type == INTERPRETER_AOUT)
 958                 current->mm->arg_start += strlen(passed_fileno) + 1;
 959         current->mm->end_code = end_code;
 960         current->mm->start_code = start_code;
 961         current->mm->start_data = start_data;
 962         current->mm->end_data = end_data;
 963         current->mm->start_stack = bprm->p;
 964
 965         if (current->personality & MMAP_PAGE_ZERO) {
 966                 /* Why this, you ask???  Well SVr4 maps page 0 as read-only,
 967                    and some applications "depend" upon this behavior.
 968                    Since we do not have the power to recompile these, we
 969                    emulate the SVr4 behavior.  Sigh.  */
 970                 down_write(&current->mm->mmap_sem);
 971                 error = do_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
 972                                 MAP_FIXED | MAP_PRIVATE, 0);
 973                 up_write(&current->mm->mmap_sem);
 974         }
 975
 976 #ifdef ELF_PLAT_INIT
 977         /*
 978          * The ABI may specify that certain registers be set up in special
 979          * ways (on i386 %edx is the address of a DT_FINI function, for
 980          * example.  In addition, it may also specify (eg, PowerPC64 ELF)
 981          * that the e_entry field is the address of the function descriptor
 982          * for the startup routine, rather than the address of the startup
 983          * routine itself.  This macro performs whatever initialization to
 984          * the regs structure is required as well as any relocations to the
 985          * function descriptor entries when executing dynamically links apps.
 986          */
 987         ELF_PLAT_INIT(regs, reloc_func_desc);
 988 #endif
 989
 990         start_thread(regs, elf_entry, bprm->p);
 991         if (unlikely(current->ptrace & PT_PTRACED)) {
 992                 if (current->ptrace & PT_TRACE_EXEC)
 993                         ptrace_notify ((PTRACE_EVENT_EXEC << 8) | SIGTRAP);
 994                 else
 995                         send_sig(SIGTRAP, current, 0);
 996         }
 997         retval = 0;
 998 out:
 999         kfree(loc);
1000 out_ret:
1001         return retval;
1002
1003         /* error cleanup */
1004 out_free_dentry:
1005         allow_write_access(interpreter);
1006         if (interpreter)
1007                 fput(interpreter);
1008 out_free_interp:
1009         kfree(elf_interpreter);
1010 out_free_file:
1011         sys_close(elf_exec_fileno);
1012 out_free_fh:
1013         if (files) {
1014                 put_files_struct(current->files);
1015                 current->files = files;
1016         }
1017 out_free_ph:
1018         kfree(elf_phdata);
1019         goto out;
1020 }
1021
1022 /* This is really simpleminded and specialized - we are loading an
1023    a.out library that is given an ELF header. */
1024
1025 static int load_elf_library(struct file *file)
1026 {
1027         struct elf_phdr *elf_phdata;
1028         struct elf_phdr *eppnt;
1029         unsigned long elf_bss, bss, len;
1030         int retval, error, i, j;
1031         struct elfhdr elf_ex;
1032
1033         error = -ENOEXEC;
1034         retval = kernel_read(file, 0, (char *) &elf_ex, sizeof(elf_ex));
1035         if (retval != sizeof(elf_ex))
1036                 goto out;
1037
1038         if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
1039                 goto out;
1040
1041         /* First of all, some simple consistency checks */
1042         if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
1043            !elf_check_arch(&elf_ex) || !file->f_op || !file->f_op->mmap)
1044                 goto out;
1045
1046         /* Now read in all of the header information */
1047
1048         j = sizeof(struct elf_phdr) * elf_ex.e_phnum;
1049         /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1050
1051         error = -ENOMEM;
1052         elf_phdata = kmalloc(j, GFP_KERNEL);
1053         if (!elf_phdata)
1054                 goto out;
1055
1056         eppnt = elf_phdata;
1057         error = -ENOEXEC;
1058         retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);
1059         if (retval != j)
1060                 goto out_free_ph;
1061
1062         for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1063                 if ((eppnt + i)->p_type == PT_LOAD)
1064                         j++;
1065         if (j != 1)
1066                 goto out_free_ph;
1067
1068         while (eppnt->p_type != PT_LOAD)
1069                 eppnt++;
1070
1071         /* Now use mmap to map the library into memory. */
1072         down_write(&current->mm->mmap_sem);
1073         error = do_mmap(file,
1074                         ELF_PAGESTART(eppnt->p_vaddr),
1075                         (eppnt->p_filesz +
1076                          ELF_PAGEOFFSET(eppnt->p_vaddr)),
1077                         PROT_READ | PROT_WRITE | PROT_EXEC,
1078                         MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
1079                         (eppnt->p_offset -
1080                          ELF_PAGEOFFSET(eppnt->p_vaddr)));
1081         up_write(&current->mm->mmap_sem);
1082         if (error != ELF_PAGESTART(eppnt->p_vaddr))
1083                 goto out_free_ph;
1084
1085         elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
1086         if (padzero(elf_bss)) {
1087                 error = -EFAULT;
1088                 goto out_free_ph;
1089         }
1090
1091         len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr + ELF_MIN_ALIGN - 1);
1092         bss = eppnt->p_memsz + eppnt->p_vaddr;
1093         if (bss > len) {
1094                 down_write(&current->mm->mmap_sem);
1095                 do_brk(len, bss - len);
1096                 up_write(&current->mm->mmap_sem);
1097         }
1098         error = 0;
1099
1100 out_free_ph:
1101         kfree(elf_phdata);
1102 out:
1103         return error;
1104 }
1105
1106 /*
1107  * Note that some platforms still use traditional core dumps and not
1108  * the ELF core dump.  Each platform can select it as appropriate.
1109  */
1110 #ifdef USE_ELF_CORE_DUMP
1111
1112 /*
1113  * ELF core dumper
1114  *
1115  * Modelled on fs/exec.c:aout_core_dump()
1116  * Jeremy Fitzhardinge <jeremy@sw.oz.au>
1117  */
1118 /*
1119  * These are the only things you should do on a core-file: use only these
1120  * functions to write out all the necessary info.
1121  */
1122 static int dump_write(struct file *file, const void *addr, int nr)
1123 {
1124         return file->f_op->write(file, addr, nr, &file->f_pos) == nr;
1125 }
1126
1127 static int dump_seek(struct file *file, loff_t off)
1128 {
1129         if (file->f_op->llseek) {
1130                 if (file->f_op->llseek(file, off, 0) != off)
1131                         return 0;
1132         } else
1133                 file->f_pos = off;
1134         return 1;
1135 }
1136
1137 /*
1138  * Decide whether a segment is worth dumping; default is yes to be
1139  * sure (missing info is worse than too much; etc).
1140  * Personally I'd include everything, and use the coredump limit...
1141  *
1142  * I think we should skip something. But I am not sure how. H.J.
1143  */
1144 static int maydump(struct vm_area_struct *vma)
1145 {
1146         /* Do not dump I/O mapped devices or special mappings */
1147         if (vma->vm_flags & (VM_IO | VM_RESERVED))
1148                 return 0;
1149
1150         /* Dump shared memory only if mapped from an anonymous file.  */
1151         if (vma->vm_flags & VM_SHARED)
1152                 return vma->vm_file->f_dentry->d_inode->i_nlink == 0;
1153
1154         /* If it hasn't been written to, don't write it out */
1155         if (!vma->anon_vma)
1156                 return 0;
1157
1158         return 1;
1159 }
1160
1161 #define roundup(x, y)  ((((x)+((y)-1))/(y))*(y))
1162
1163 /* An ELF note in memory */
1164 struct memelfnote
1165 {
1166         const char *name;
1167         int type;
1168         unsigned int datasz;
1169         void *data;
1170 };
1171
1172 static int notesize(struct memelfnote *en)
1173 {
1174         int sz;
1175
1176         sz = sizeof(struct elf_note);
1177         sz += roundup(strlen(en->name) + 1, 4);
1178         sz += roundup(en->datasz, 4);
1179
1180         return sz;
1181 }
1182
1183 #define DUMP_WRITE(addr, nr)    \
1184         do { if (!dump_write(file, (addr), (nr))) return 0; } while(0)
1185 #define DUMP_SEEK(off)  \
1186         do { if (!dump_seek(file, (off))) return 0; } while(0)
1187
1188 static int writenote(struct memelfnote *men, struct file *file)
1189 {
1190         struct elf_note en;
1191
1192         en.n_namesz = strlen(men->name) + 1;
1193         en.n_descsz = men->datasz;
1194         en.n_type = men->type;
1195
1196         DUMP_WRITE(&en, sizeof(en));
1197         DUMP_WRITE(men->name, en.n_namesz);
1198         /* XXX - cast from long long to long to avoid need for libgcc.a */
1199         DUMP_SEEK(roundup((unsigned long)file->f_pos, 4));      /* XXX */
1200         DUMP_WRITE(men->data, men->datasz);
1201         DUMP_SEEK(roundup((unsigned long)file->f_pos, 4));      /* XXX */
1202
1203         return 1;
1204 }
1205 #undef DUMP_WRITE
1206 #undef DUMP_SEEK
1207
1208 #define DUMP_WRITE(addr, nr)    \
1209         if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
1210                 goto end_coredump;
1211 #define DUMP_SEEK(off)  \
1212         if (!dump_seek(file, (off))) \
1213                 goto end_coredump;
1214
1215 static inline void fill_elf_header(struct elfhdr *elf, int segs)
1216 {
1217         memcpy(elf->e_ident, ELFMAG, SELFMAG);
1218         elf->e_ident[EI_CLASS] = ELF_CLASS;
1219         elf->e_ident[EI_DATA] = ELF_DATA;
1220         elf->e_ident[EI_VERSION] = EV_CURRENT;
1221         elf->e_ident[EI_OSABI] = ELF_OSABI;
1222         memset(elf->e_ident+EI_PAD, 0, EI_NIDENT-EI_PAD);
1223
1224         elf->e_type = ET_CORE;
1225         elf->e_machine = ELF_ARCH;
1226         elf->e_version = EV_CURRENT;
1227         elf->e_entry = 0;
1228         elf->e_phoff = sizeof(struct elfhdr);
1229         elf->e_shoff = 0;
1230         elf->e_flags = ELF_CORE_EFLAGS;
1231         elf->e_ehsize = sizeof(struct elfhdr);
1232         elf->e_phentsize = sizeof(struct elf_phdr);
1233         elf->e_phnum = segs;
1234         elf->e_shentsize = 0;
1235         elf->e_shnum = 0;
1236         elf->e_shstrndx = 0;
1237         return;
1238 }
1239
1240 static inline void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, off_t offset)
1241 {
1242         phdr->p_type = PT_NOTE;
1243         phdr->p_offset = offset;
1244         phdr->p_vaddr = 0;
1245         phdr->p_paddr = 0;
1246         phdr->p_filesz = sz;
1247         phdr->p_memsz = 0;
1248         phdr->p_flags = 0;
1249         phdr->p_align = 0;
1250         return;
1251 }
1252
1253 static void fill_note(struct memelfnote *note, const char *name, int type,
1254                 unsigned int sz, void *data)
1255 {
1256         note->name = name;
1257         note->type = type;
1258         note->datasz = sz;
1259         note->data = data;
1260         return;
1261 }
1262
1263 /*
1264  * fill up all the fields in prstatus from the given task struct, except registers
1265  * which need to be filled up separately.
1266  */
1267 static void fill_prstatus(struct elf_prstatus *prstatus,
1268                         struct task_struct *p, long signr)
1269 {
1270         prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
1271         prstatus->pr_sigpend = p->pending.signal.sig[0];
1272         prstatus->pr_sighold = p->blocked.sig[0];
1273         prstatus->pr_pid = p->pid;
1274         prstatus->pr_ppid = p->parent->pid;
1275         prstatus->pr_pgrp = process_group(p);
1276         prstatus->pr_sid = p->signal->session;
1277         if (thread_group_leader(p)) {
1278                 /*
1279                  * This is the record for the group leader.  Add in the
1280                  * cumulative times of previous dead threads.  This total
1281                  * won't include the time of each live thread whose state
1282                  * is included in the core dump.  The final total reported
1283                  * to our parent process when it calls wait4 will include
1284                  * those sums as well as the little bit more time it takes
1285                  * this and each other thread to finish dying after the
1286                  * core dump synchronization phase.
1287                  */
1288                 cputime_to_timeval(cputime_add(p->utime, p->signal->utime),
1289                                    &prstatus->pr_utime);
1290                 cputime_to_timeval(cputime_add(p->stime, p->signal->stime),
1291                                    &prstatus->pr_stime);
1292         } else {
1293                 cputime_to_timeval(p->utime, &prstatus->pr_utime);
1294                 cputime_to_timeval(p->stime, &prstatus->pr_stime);
1295         }
1296         cputime_to_timeval(p->signal->cutime, &prstatus->pr_cutime);
1297         cputime_to_timeval(p->signal->cstime, &prstatus->pr_cstime);
1298 }
1299
1300 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
1301                        struct mm_struct *mm)
1302 {
1303         unsigned int i, len;
1304
1305         /* first copy the parameters from user space */
1306         memset(psinfo, 0, sizeof(struct elf_prpsinfo));
1307
1308         len = mm->arg_end - mm->arg_start;
1309         if (len >= ELF_PRARGSZ)
1310                 len = ELF_PRARGSZ-1;
1311         if (copy_from_user(&psinfo->pr_psargs,
1312                            (const char __user *)mm->arg_start, len))
1313                 return -EFAULT;
1314         for(i = 0; i < len; i++)
1315                 if (psinfo->pr_psargs[i] == 0)
1316                         psinfo->pr_psargs[i] = ' ';
1317         psinfo->pr_psargs[len] = 0;
1318
1319         psinfo->pr_pid = p->pid;
1320         psinfo->pr_ppid = p->parent->pid;
1321         psinfo->pr_pgrp = process_group(p);
1322         psinfo->pr_sid = p->signal->session;
1323
1324         i = p->state ? ffz(~p->state) + 1 : 0;
1325         psinfo->pr_state = i;
1326         psinfo->pr_sname = (i < 0 || i > 5) ? '.' : "RSDTZW"[i];
1327         psinfo->pr_zomb = psinfo->pr_sname == 'Z';
1328         psinfo->pr_nice = task_nice(p);
1329         psinfo->pr_flag = p->flags;
1330         SET_UID(psinfo->pr_uid, p->uid);
1331         SET_GID(psinfo->pr_gid, p->gid);
1332         strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
1333
1334         return 0;
1335 }
1336
1337 /* Here is the structure in which status of each thread is captured. */
1338 struct elf_thread_status
1339 {
1340         struct list_head list;
1341         struct elf_prstatus prstatus;   /* NT_PRSTATUS */
1342         elf_fpregset_t fpu;             /* NT_PRFPREG */
1343         struct task_struct *thread;
1344 #ifdef ELF_CORE_COPY_XFPREGS
1345         elf_fpxregset_t xfpu;           /* NT_PRXFPREG */
1346 #endif
1347         struct memelfnote notes[3];
1348         int num_notes;
1349 };
1350
1351 /*
1352  * In order to add the specific thread information for the elf file format,
1353  * we need to keep a linked list of every threads pr_status and then
1354  * create a single section for them in the final core file.
1355  */
1356 static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
1357 {
1358         int sz = 0;
1359         struct task_struct *p = t->thread;
1360         t->num_notes = 0;
1361
1362         fill_prstatus(&t->prstatus, p, signr);
1363         elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
1364
1365         fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus), &(t->prstatus));
1366         t->num_notes++;
1367         sz += notesize(&t->notes[0]);
1368
1369         if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL, &t->fpu))) {
1370                 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu), &(t->fpu));
1371                 t->num_notes++;
1372                 sz += notesize(&t->notes[1]);
1373         }
1374
1375 #ifdef ELF_CORE_COPY_XFPREGS
1376         if (elf_core_copy_task_xfpregs(p, &t->xfpu)) {
1377                 fill_note(&t->notes[2], "LINUX", NT_PRXFPREG, sizeof(t->xfpu), &t->xfpu);
1378                 t->num_notes++;
1379                 sz += notesize(&t->notes[2]);
1380         }
1381 #endif
1382         return sz;
1383 }
1384
1385 /*
1386  * Actual dumper
1387  *
1388  * This is a two-pass process; first we find the offsets of the bits,
1389  * and then they are actually written out.  If we run out of core limit
1390  * we just truncate.
1391  */
1392 static int elf_core_dump(long signr, struct pt_regs * regs, struct file * file)
1393 {
1394 #define NUM_NOTES       6
1395         int has_dumped = 0;
1396         mm_segment_t fs;
1397         int segs;
1398         size_t size = 0;
1399         int i;
1400         struct vm_area_struct *vma;
1401         struct elfhdr *elf = NULL;
1402         off_t offset = 0, dataoff;
1403         unsigned long limit = current->signal->rlim[RLIMIT_CORE].rlim_cur;
1404         int numnote;
1405         struct memelfnote *notes = NULL;
1406         struct elf_prstatus *prstatus = NULL;   /* NT_PRSTATUS */
1407         struct elf_prpsinfo *psinfo = NULL;     /* NT_PRPSINFO */
1408         struct task_struct *g, *p;
1409         LIST_HEAD(thread_list);
1410         struct list_head *t;
1411         elf_fpregset_t *fpu = NULL;
1412 #ifdef ELF_CORE_COPY_XFPREGS
1413         elf_fpxregset_t *xfpu = NULL;
1414 #endif
1415         int thread_status_size = 0;
1416         elf_addr_t *auxv;
1417
1418         /*
1419          * We no longer stop all VM operations.
1420          *
1421          * This is because those proceses that could possibly change map_count or
1422          * the mmap / vma pages are now blocked in do_exit on current finishing
1423          * this core dump.
1424          *
1425          * Only ptrace can touch these memory addresses, but it doesn't change
1426          * the map_count or the pages allocated.  So no possibility of crashing
1427          * exists while dumping the mm->vm_next areas to the core file.
1428          */
1429
1430         /* alloc memory for large data structures: too large to be on stack */
1431         elf = kmalloc(sizeof(*elf), GFP_KERNEL);
1432         if (!elf)
1433                 goto cleanup;
1434         prstatus = kmalloc(sizeof(*prstatus), GFP_KERNEL);
1435         if (!prstatus)
1436                 goto cleanup;
1437         psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
1438         if (!psinfo)
1439                 goto cleanup;
1440         notes = kmalloc(NUM_NOTES * sizeof(struct memelfnote), GFP_KERNEL);
1441         if (!notes)
1442                 goto cleanup;
1443         fpu = kmalloc(sizeof(*fpu), GFP_KERNEL);
1444         if (!fpu)
1445                 goto cleanup;
1446 #ifdef ELF_CORE_COPY_XFPREGS
1447         xfpu = kmalloc(sizeof(*xfpu), GFP_KERNEL);
1448         if (!xfpu)
1449                 goto cleanup;
1450 #endif
1451
1452         if (signr) {
1453                 struct elf_thread_status *tmp;
1454                 read_lock(&tasklist_lock);
1455                 do_each_thread(g,p)
1456                         if (current->mm == p->mm && current != p) {
1457                                 tmp = kmalloc(sizeof(*tmp), GFP_ATOMIC);
1458                                 if (!tmp) {
1459                                         read_unlock(&tasklist_lock);
1460                                         goto cleanup;
1461                                 }
1462                                 memset(tmp, 0, sizeof(*tmp));
1463                                 INIT_LIST_HEAD(&tmp->list);
1464                                 tmp->thread = p;
1465                                 list_add(&tmp->list, &thread_list);
1466                         }
1467                 while_each_thread(g,p);
1468                 read_unlock(&tasklist_lock);
1469                 list_for_each(t, &thread_list) {
1470                         struct elf_thread_status *tmp;
1471                         int sz;
1472
1473                         tmp = list_entry(t, struct elf_thread_status, list);
1474                         sz = elf_dump_thread_status(signr, tmp);
1475                         thread_status_size += sz;
1476                 }
1477         }
1478         /* now collect the dump for the current */
1479         memset(prstatus, 0, sizeof(*prstatus));
1480         fill_prstatus(prstatus, current, signr);
1481         elf_core_copy_regs(&prstatus->pr_reg, regs);
1482
1483         segs = current->mm->map_count;
1484 #ifdef ELF_CORE_EXTRA_PHDRS
1485         segs += ELF_CORE_EXTRA_PHDRS;
1486 #endif
1487
1488         /* Set up header */
1489         fill_elf_header(elf, segs+1);   /* including notes section */
1490
1491         has_dumped = 1;
1492         current->flags |= PF_DUMPCORE;
1493
1494         /*
1495          * Set up the notes in similar form to SVR4 core dumps made
1496          * with info from their /proc.
1497          */
1498
1499         fill_note(notes +0, "CORE", NT_PRSTATUS, sizeof(*prstatus), prstatus);
1500
1501         fill_psinfo(psinfo, current->group_leader, current->mm);
1502         fill_note(notes +1, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
1503
1504         numnote = 2;
1505
1506         auxv = (elf_addr_t *) current->mm->saved_auxv;
1507
1508         i = 0;
1509         do
1510                 i += 2;
1511         while (auxv[i - 2] != AT_NULL);
1512         fill_note(&notes[numnote++], "CORE", NT_AUXV,
1513                   i * sizeof (elf_addr_t), auxv);
1514
1515         /* Try to dump the FPU. */
1516         if ((prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs, fpu)))
1517                 fill_note(notes + numnote++,
1518                           "CORE", NT_PRFPREG, sizeof(*fpu), fpu);
1519 #ifdef ELF_CORE_COPY_XFPREGS
1520         if (elf_core_copy_task_xfpregs(current, xfpu))
1521                 fill_note(notes + numnote++,
1522                           "LINUX", NT_PRXFPREG, sizeof(*xfpu), xfpu);
1523 #endif
1524
1525         fs = get_fs();
1526         set_fs(KERNEL_DS);
1527
1528         DUMP_WRITE(elf, sizeof(*elf));
1529         offset += sizeof(*elf);                         /* Elf header */
1530         offset += (segs+1) * sizeof(struct elf_phdr);   /* Program headers */
1531
1532         /* Write notes phdr entry */
1533         {
1534                 struct elf_phdr phdr;
1535                 int sz = 0;
1536
1537                 for (i = 0; i < numnote; i++)
1538                         sz += notesize(notes + i);
1539
1540                 sz += thread_status_size;
1541
1542                 fill_elf_note_phdr(&phdr, sz, offset);
1543                 offset += sz;
1544                 DUMP_WRITE(&phdr, sizeof(phdr));
1545         }
1546
1547         /* Page-align dumped data */
1548         dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
1549
1550         /* Write program headers for segments dump */
1551         for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) {
1552                 struct elf_phdr phdr;
1553                 size_t sz;
1554
1555                 sz = vma->vm_end - vma->vm_start;
1556
1557                 phdr.p_type = PT_LOAD;
1558                 phdr.p_offset = offset;
1559                 phdr.p_vaddr = vma->vm_start;
1560                 phdr.p_paddr = 0;
1561                 phdr.p_filesz = maydump(vma) ? sz : 0;
1562                 phdr.p_memsz = sz;
1563                 offset += phdr.p_filesz;
1564                 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
1565                 if (vma->vm_flags & VM_WRITE) phdr.p_flags |= PF_W;
1566                 if (vma->vm_flags & VM_EXEC) phdr.p_flags |= PF_X;
1567                 phdr.p_align = ELF_EXEC_PAGESIZE;
1568
1569                 DUMP_WRITE(&phdr, sizeof(phdr));
1570         }
1571
1572 #ifdef ELF_CORE_WRITE_EXTRA_PHDRS
1573         ELF_CORE_WRITE_EXTRA_PHDRS;
1574 #endif
1575
1576         /* write out the notes section */
1577         for (i = 0; i < numnote; i++)
1578                 if (!writenote(notes + i, file))
1579                         goto end_coredump;
1580
1581         /* write out the thread status notes section */
1582         list_for_each(t, &thread_list) {
1583                 struct elf_thread_status *tmp = list_entry(t, struct elf_thread_status, list);
1584                 for (i = 0; i < tmp->num_notes; i++)
1585                         if (!writenote(&tmp->notes[i], file))
1586                                 goto end_coredump;
1587         }
1588
1589         DUMP_SEEK(dataoff);
1590
1591         for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) {
1592                 unsigned long addr;
1593
1594                 if (!maydump(vma))
1595                         continue;
1596
1597                 for (addr = vma->vm_start;
1598                      addr < vma->vm_end;
1599                      addr += PAGE_SIZE) {
1600                         struct page* page;
1601                         struct vm_area_struct *vma;
1602
1603                         if (get_user_pages(current, current->mm, addr, 1, 0, 1,
1604                                                 &page, &vma) <= 0) {
1605                                 DUMP_SEEK (file->f_pos + PAGE_SIZE);
1606                         } else {
1607                                 if (page == ZERO_PAGE(addr)) {
1608                                         DUMP_SEEK (file->f_pos + PAGE_SIZE);
1609                                 } else {
1610                                         void *kaddr;
1611                                         flush_cache_page(vma, addr, page_to_pfn(page));
1612                                         kaddr = kmap(page);
1613                                         if ((size += PAGE_SIZE) > limit ||
1614                                             !dump_write(file, kaddr,
1615                                             PAGE_SIZE)) {
1616                                                 kunmap(page);
1617                                                 page_cache_release(page);
1618                                                 goto end_coredump;
1619                                         }
1620                                         kunmap(page);
1621                                 }
1622                                 page_cache_release(page);
1623                         }
1624                 }
1625         }
1626
1627 #ifdef ELF_CORE_WRITE_EXTRA_DATA
1628         ELF_CORE_WRITE_EXTRA_DATA;
1629 #endif
1630
1631         if ((off_t) file->f_pos != offset) {
1632                 /* Sanity check */
1633                 printk("elf_core_dump: file->f_pos (%ld) != offset (%ld)\n",
1634                        (off_t) file->f_pos, offset);
1635         }
1636
1637 end_coredump:
1638         set_fs(fs);
1639
1640 cleanup:
1641         while(!list_empty(&thread_list)) {
1642                 struct list_head *tmp = thread_list.next;
1643                 list_del(tmp);
1644                 kfree(list_entry(tmp, struct elf_thread_status, list));
1645         }
1646
1647         kfree(elf);
1648         kfree(prstatus);
1649         kfree(psinfo);
1650         kfree(notes);
1651         kfree(fpu);
1652 #ifdef ELF_CORE_COPY_XFPREGS
1653         kfree(xfpu);
1654 #endif
1655         return has_dumped;
1656 #undef NUM_NOTES
1657 }
1658
1659 #endif          /* USE_ELF_CORE_DUMP */
1660
1661 static int __init init_elf_binfmt(void)
1662 {
1663         return register_binfmt(&elf_format);
1664 }
1665
1666 static void __exit exit_elf_binfmt(void)
1667 {
1668         /* Remove the COFF and ELF loaders. */
1669         unregister_binfmt(&elf_format);
1670 }
1671
1672 core_initcall(init_elf_binfmt);
1673 module_exit(exit_elf_binfmt);
1674 MODULE_LICENSE("GPL");