xref: /openbmc/linux/fs/binfmt_elf.c (revision d5cb9783536a41df9f9cba5b0a1d78047ed787f7)
1 /*
2  * linux/fs/binfmt_elf.c
3  *
4  * These are the functions used to load ELF format executables as used
5  * on SVr4 machines.  Information on the format may be found in the book
6  * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
7  * Tools".
8  *
9  * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com).
10  */
11 
12 #include <linux/module.h>
13 #include <linux/kernel.h>
14 #include <linux/fs.h>
15 #include <linux/stat.h>
16 #include <linux/time.h>
17 #include <linux/mm.h>
18 #include <linux/mman.h>
19 #include <linux/a.out.h>
20 #include <linux/errno.h>
21 #include <linux/signal.h>
22 #include <linux/binfmts.h>
23 #include <linux/string.h>
24 #include <linux/file.h>
25 #include <linux/fcntl.h>
26 #include <linux/ptrace.h>
27 #include <linux/slab.h>
28 #include <linux/shm.h>
29 #include <linux/personality.h>
30 #include <linux/elfcore.h>
31 #include <linux/init.h>
32 #include <linux/highuid.h>
33 #include <linux/smp.h>
34 #include <linux/smp_lock.h>
35 #include <linux/compiler.h>
36 #include <linux/highmem.h>
37 #include <linux/pagemap.h>
38 #include <linux/security.h>
39 #include <linux/syscalls.h>
40 #include <linux/random.h>
41 
42 #include <asm/uaccess.h>
43 #include <asm/param.h>
44 #include <asm/page.h>
45 
46 #include <linux/elf.h>
47 
48 static int load_elf_binary(struct linux_binprm * bprm, struct pt_regs * regs);
49 static int load_elf_library(struct file*);
50 static unsigned long elf_map (struct file *, unsigned long, struct elf_phdr *, int, int);
51 extern int dump_fpu (struct pt_regs *, elf_fpregset_t *);
52 
53 #ifndef elf_addr_t
54 #define elf_addr_t unsigned long
55 #endif
56 
57 /*
58  * If we don't support core dumping, then supply a NULL so we
59  * don't even try.
60  */
61 #ifdef USE_ELF_CORE_DUMP
62 static int elf_core_dump(long signr, struct pt_regs * regs, struct file * file);
63 #else
64 #define elf_core_dump	NULL
65 #endif
66 
67 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
68 # define ELF_MIN_ALIGN	ELF_EXEC_PAGESIZE
69 #else
70 # define ELF_MIN_ALIGN	PAGE_SIZE
71 #endif
72 
73 #ifndef ELF_CORE_EFLAGS
74 #define ELF_CORE_EFLAGS	0
75 #endif
76 
77 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
78 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
79 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
80 
81 static struct linux_binfmt elf_format = {
82 		.module		= THIS_MODULE,
83 		.load_binary	= load_elf_binary,
84 		.load_shlib	= load_elf_library,
85 		.core_dump	= elf_core_dump,
86 		.min_coredump	= ELF_EXEC_PAGESIZE
87 };
88 
89 #define BAD_ADDR(x)	((unsigned long)(x) > TASK_SIZE)
90 
91 static int set_brk(unsigned long start, unsigned long end)
92 {
93 	start = ELF_PAGEALIGN(start);
94 	end = ELF_PAGEALIGN(end);
95 	if (end > start) {
96 		unsigned long addr;
97 		down_write(&current->mm->mmap_sem);
98 		addr = do_brk(start, end - start);
99 		up_write(&current->mm->mmap_sem);
100 		if (BAD_ADDR(addr))
101 			return addr;
102 	}
103 	current->mm->start_brk = current->mm->brk = end;
104 	return 0;
105 }
106 
107 
108 /* We need to explicitly zero any fractional pages
109    after the data section (i.e. bss).  This would
110    contain the junk from the file that should not
111    be in memory */
112 
113 
114 static int padzero(unsigned long elf_bss)
115 {
116 	unsigned long nbyte;
117 
118 	nbyte = ELF_PAGEOFFSET(elf_bss);
119 	if (nbyte) {
120 		nbyte = ELF_MIN_ALIGN - nbyte;
121 		if (clear_user((void __user *) elf_bss, nbyte))
122 			return -EFAULT;
123 	}
124 	return 0;
125 }
126 
127 /* Let's use some macros to make this stack manipulation a litle clearer */
128 #ifdef CONFIG_STACK_GROWSUP
129 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
130 #define STACK_ROUND(sp, items) \
131 	((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
132 #define STACK_ALLOC(sp, len) ({ elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; old_sp; })
133 #else
134 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
135 #define STACK_ROUND(sp, items) \
136 	(((unsigned long) (sp - items)) &~ 15UL)
137 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
138 #endif
139 
140 static int
141 create_elf_tables(struct linux_binprm *bprm, struct elfhdr * exec,
142 		int interp_aout, unsigned long load_addr,
143 		unsigned long interp_load_addr)
144 {
145 	unsigned long p = bprm->p;
146 	int argc = bprm->argc;
147 	int envc = bprm->envc;
148 	elf_addr_t __user *argv;
149 	elf_addr_t __user *envp;
150 	elf_addr_t __user *sp;
151 	elf_addr_t __user *u_platform;
152 	const char *k_platform = ELF_PLATFORM;
153 	int items;
154 	elf_addr_t *elf_info;
155 	int ei_index = 0;
156 	struct task_struct *tsk = current;
157 
158 	/*
159 	 * If this architecture has a platform capability string, copy it
160 	 * to userspace.  In some cases (Sparc), this info is impossible
161 	 * for userspace to get any other way, in others (i386) it is
162 	 * merely difficult.
163 	 */
164 
165 	u_platform = NULL;
166 	if (k_platform) {
167 		size_t len = strlen(k_platform) + 1;
168 
169 		/*
170 		 * In some cases (e.g. Hyper-Threading), we want to avoid L1
171 		 * evictions by the processes running on the same package. One
172 		 * thing we can do is to shuffle the initial stack for them.
173 		 */
174 
175 		p = arch_align_stack(p);
176 
177 		u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
178 		if (__copy_to_user(u_platform, k_platform, len))
179 			return -EFAULT;
180 	}
181 
182 	/* Create the ELF interpreter info */
183 	elf_info = (elf_addr_t *) current->mm->saved_auxv;
184 #define NEW_AUX_ENT(id, val) \
185 	do { elf_info[ei_index++] = id; elf_info[ei_index++] = val; } while (0)
186 
187 #ifdef ARCH_DLINFO
188 	/*
189 	 * ARCH_DLINFO must come first so PPC can do its special alignment of
190 	 * AUXV.
191 	 */
192 	ARCH_DLINFO;
193 #endif
194 	NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
195 	NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
196 	NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
197 	NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
198 	NEW_AUX_ENT(AT_PHENT, sizeof (struct elf_phdr));
199 	NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
200 	NEW_AUX_ENT(AT_BASE, interp_load_addr);
201 	NEW_AUX_ENT(AT_FLAGS, 0);
202 	NEW_AUX_ENT(AT_ENTRY, exec->e_entry);
203 	NEW_AUX_ENT(AT_UID, (elf_addr_t) tsk->uid);
204 	NEW_AUX_ENT(AT_EUID, (elf_addr_t) tsk->euid);
205 	NEW_AUX_ENT(AT_GID, (elf_addr_t) tsk->gid);
206 	NEW_AUX_ENT(AT_EGID, (elf_addr_t) tsk->egid);
207  	NEW_AUX_ENT(AT_SECURE, (elf_addr_t) security_bprm_secureexec(bprm));
208 	if (k_platform) {
209 		NEW_AUX_ENT(AT_PLATFORM, (elf_addr_t)(unsigned long)u_platform);
210 	}
211 	if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) {
212 		NEW_AUX_ENT(AT_EXECFD, (elf_addr_t) bprm->interp_data);
213 	}
214 #undef NEW_AUX_ENT
215 	/* AT_NULL is zero; clear the rest too */
216 	memset(&elf_info[ei_index], 0,
217 	       sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]);
218 
219 	/* And advance past the AT_NULL entry.  */
220 	ei_index += 2;
221 
222 	sp = STACK_ADD(p, ei_index);
223 
224 	items = (argc + 1) + (envc + 1);
225 	if (interp_aout) {
226 		items += 3; /* a.out interpreters require argv & envp too */
227 	} else {
228 		items += 1; /* ELF interpreters only put argc on the stack */
229 	}
230 	bprm->p = STACK_ROUND(sp, items);
231 
232 	/* Point sp at the lowest address on the stack */
233 #ifdef CONFIG_STACK_GROWSUP
234 	sp = (elf_addr_t __user *)bprm->p - items - ei_index;
235 	bprm->exec = (unsigned long) sp; /* XXX: PARISC HACK */
236 #else
237 	sp = (elf_addr_t __user *)bprm->p;
238 #endif
239 
240 	/* Now, let's put argc (and argv, envp if appropriate) on the stack */
241 	if (__put_user(argc, sp++))
242 		return -EFAULT;
243 	if (interp_aout) {
244 		argv = sp + 2;
245 		envp = argv + argc + 1;
246 		__put_user((elf_addr_t)(unsigned long)argv, sp++);
247 		__put_user((elf_addr_t)(unsigned long)envp, sp++);
248 	} else {
249 		argv = sp;
250 		envp = argv + argc + 1;
251 	}
252 
253 	/* Populate argv and envp */
254 	p = current->mm->arg_end = current->mm->arg_start;
255 	while (argc-- > 0) {
256 		size_t len;
257 		__put_user((elf_addr_t)p, argv++);
258 		len = strnlen_user((void __user *)p, PAGE_SIZE*MAX_ARG_PAGES);
259 		if (!len || len > PAGE_SIZE*MAX_ARG_PAGES)
260 			return 0;
261 		p += len;
262 	}
263 	if (__put_user(0, argv))
264 		return -EFAULT;
265 	current->mm->arg_end = current->mm->env_start = p;
266 	while (envc-- > 0) {
267 		size_t len;
268 		__put_user((elf_addr_t)p, envp++);
269 		len = strnlen_user((void __user *)p, PAGE_SIZE*MAX_ARG_PAGES);
270 		if (!len || len > PAGE_SIZE*MAX_ARG_PAGES)
271 			return 0;
272 		p += len;
273 	}
274 	if (__put_user(0, envp))
275 		return -EFAULT;
276 	current->mm->env_end = p;
277 
278 	/* Put the elf_info on the stack in the right place.  */
279 	sp = (elf_addr_t __user *)envp + 1;
280 	if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
281 		return -EFAULT;
282 	return 0;
283 }
284 
285 #ifndef elf_map
286 
287 static unsigned long elf_map(struct file *filep, unsigned long addr,
288 			struct elf_phdr *eppnt, int prot, int type)
289 {
290 	unsigned long map_addr;
291 
292 	down_write(&current->mm->mmap_sem);
293 	map_addr = do_mmap(filep, ELF_PAGESTART(addr),
294 			   eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr), prot, type,
295 			   eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr));
296 	up_write(&current->mm->mmap_sem);
297 	return(map_addr);
298 }
299 
300 #endif /* !elf_map */
301 
302 /* This is much more generalized than the library routine read function,
303    so we keep this separate.  Technically the library read function
304    is only provided so that we can read a.out libraries that have
305    an ELF header */
306 
307 static unsigned long load_elf_interp(struct elfhdr * interp_elf_ex,
308 				     struct file * interpreter,
309 				     unsigned long *interp_load_addr)
310 {
311 	struct elf_phdr *elf_phdata;
312 	struct elf_phdr *eppnt;
313 	unsigned long load_addr = 0;
314 	int load_addr_set = 0;
315 	unsigned long last_bss = 0, elf_bss = 0;
316 	unsigned long error = ~0UL;
317 	int retval, i, size;
318 
319 	/* First of all, some simple consistency checks */
320 	if (interp_elf_ex->e_type != ET_EXEC &&
321 	    interp_elf_ex->e_type != ET_DYN)
322 		goto out;
323 	if (!elf_check_arch(interp_elf_ex))
324 		goto out;
325 	if (!interpreter->f_op || !interpreter->f_op->mmap)
326 		goto out;
327 
328 	/*
329 	 * If the size of this structure has changed, then punt, since
330 	 * we will be doing the wrong thing.
331 	 */
332 	if (interp_elf_ex->e_phentsize != sizeof(struct elf_phdr))
333 		goto out;
334 	if (interp_elf_ex->e_phnum < 1 ||
335 		interp_elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr))
336 		goto out;
337 
338 	/* Now read in all of the header information */
339 
340 	size = sizeof(struct elf_phdr) * interp_elf_ex->e_phnum;
341 	if (size > ELF_MIN_ALIGN)
342 		goto out;
343 	elf_phdata = (struct elf_phdr *) kmalloc(size, GFP_KERNEL);
344 	if (!elf_phdata)
345 		goto out;
346 
347 	retval = kernel_read(interpreter,interp_elf_ex->e_phoff,(char *)elf_phdata,size);
348 	error = -EIO;
349 	if (retval != size) {
350 		if (retval < 0)
351 			error = retval;
352 		goto out_close;
353 	}
354 
355 	eppnt = elf_phdata;
356 	for (i=0; i<interp_elf_ex->e_phnum; i++, eppnt++) {
357 	  if (eppnt->p_type == PT_LOAD) {
358 	    int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
359 	    int elf_prot = 0;
360 	    unsigned long vaddr = 0;
361 	    unsigned long k, map_addr;
362 
363 	    if (eppnt->p_flags & PF_R) elf_prot =  PROT_READ;
364 	    if (eppnt->p_flags & PF_W) elf_prot |= PROT_WRITE;
365 	    if (eppnt->p_flags & PF_X) elf_prot |= PROT_EXEC;
366 	    vaddr = eppnt->p_vaddr;
367 	    if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
368 	    	elf_type |= MAP_FIXED;
369 
370 	    map_addr = elf_map(interpreter, load_addr + vaddr, eppnt, elf_prot, elf_type);
371 	    error = map_addr;
372 	    if (BAD_ADDR(map_addr))
373 	    	goto out_close;
374 
375 	    if (!load_addr_set && interp_elf_ex->e_type == ET_DYN) {
376 		load_addr = map_addr - ELF_PAGESTART(vaddr);
377 		load_addr_set = 1;
378 	    }
379 
380 	    /*
381 	     * Check to see if the section's size will overflow the
382 	     * allowed task size. Note that p_filesz must always be
383 	     * <= p_memsize so it is only necessary to check p_memsz.
384 	     */
385 	    k = load_addr + eppnt->p_vaddr;
386 	    if (k > TASK_SIZE || eppnt->p_filesz > eppnt->p_memsz ||
387 		eppnt->p_memsz > TASK_SIZE || TASK_SIZE - eppnt->p_memsz < k) {
388 	        error = -ENOMEM;
389 		goto out_close;
390 	    }
391 
392 	    /*
393 	     * Find the end of the file mapping for this phdr, and keep
394 	     * track of the largest address we see for this.
395 	     */
396 	    k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
397 	    if (k > elf_bss)
398 		elf_bss = k;
399 
400 	    /*
401 	     * Do the same thing for the memory mapping - between
402 	     * elf_bss and last_bss is the bss section.
403 	     */
404 	    k = load_addr + eppnt->p_memsz + eppnt->p_vaddr;
405 	    if (k > last_bss)
406 		last_bss = k;
407 	  }
408 	}
409 
410 	/*
411 	 * Now fill out the bss section.  First pad the last page up
412 	 * to the page boundary, and then perform a mmap to make sure
413 	 * that there are zero-mapped pages up to and including the
414 	 * last bss page.
415 	 */
416 	if (padzero(elf_bss)) {
417 		error = -EFAULT;
418 		goto out_close;
419 	}
420 
421 	elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);	/* What we have mapped so far */
422 
423 	/* Map the last of the bss segment */
424 	if (last_bss > elf_bss) {
425 		down_write(&current->mm->mmap_sem);
426 		error = do_brk(elf_bss, last_bss - elf_bss);
427 		up_write(&current->mm->mmap_sem);
428 		if (BAD_ADDR(error))
429 			goto out_close;
430 	}
431 
432 	*interp_load_addr = load_addr;
433 	error = ((unsigned long) interp_elf_ex->e_entry) + load_addr;
434 
435 out_close:
436 	kfree(elf_phdata);
437 out:
438 	return error;
439 }
440 
441 static unsigned long load_aout_interp(struct exec * interp_ex,
442 			     struct file * interpreter)
443 {
444 	unsigned long text_data, elf_entry = ~0UL;
445 	char __user * addr;
446 	loff_t offset;
447 
448 	current->mm->end_code = interp_ex->a_text;
449 	text_data = interp_ex->a_text + interp_ex->a_data;
450 	current->mm->end_data = text_data;
451 	current->mm->brk = interp_ex->a_bss + text_data;
452 
453 	switch (N_MAGIC(*interp_ex)) {
454 	case OMAGIC:
455 		offset = 32;
456 		addr = (char __user *)0;
457 		break;
458 	case ZMAGIC:
459 	case QMAGIC:
460 		offset = N_TXTOFF(*interp_ex);
461 		addr = (char __user *) N_TXTADDR(*interp_ex);
462 		break;
463 	default:
464 		goto out;
465 	}
466 
467 	down_write(&current->mm->mmap_sem);
468 	do_brk(0, text_data);
469 	up_write(&current->mm->mmap_sem);
470 	if (!interpreter->f_op || !interpreter->f_op->read)
471 		goto out;
472 	if (interpreter->f_op->read(interpreter, addr, text_data, &offset) < 0)
473 		goto out;
474 	flush_icache_range((unsigned long)addr,
475 	                   (unsigned long)addr + text_data);
476 
477 
478 	down_write(&current->mm->mmap_sem);
479 	do_brk(ELF_PAGESTART(text_data + ELF_MIN_ALIGN - 1),
480 		interp_ex->a_bss);
481 	up_write(&current->mm->mmap_sem);
482 	elf_entry = interp_ex->a_entry;
483 
484 out:
485 	return elf_entry;
486 }
487 
488 /*
489  * These are the functions used to load ELF style executables and shared
490  * libraries.  There is no binary dependent code anywhere else.
491  */
492 
493 #define INTERPRETER_NONE 0
494 #define INTERPRETER_AOUT 1
495 #define INTERPRETER_ELF 2
496 
497 
498 static unsigned long randomize_stack_top(unsigned long stack_top)
499 {
500 	unsigned int random_variable = 0;
501 
502 	if (current->flags & PF_RANDOMIZE)
503 		random_variable = get_random_int() % (8*1024*1024);
504 #ifdef CONFIG_STACK_GROWSUP
505 	return PAGE_ALIGN(stack_top + random_variable);
506 #else
507 	return PAGE_ALIGN(stack_top - random_variable);
508 #endif
509 }
510 
511 static int load_elf_binary(struct linux_binprm * bprm, struct pt_regs * regs)
512 {
513 	struct file *interpreter = NULL; /* to shut gcc up */
514  	unsigned long load_addr = 0, load_bias = 0;
515 	int load_addr_set = 0;
516 	char * elf_interpreter = NULL;
517 	unsigned int interpreter_type = INTERPRETER_NONE;
518 	unsigned char ibcs2_interpreter = 0;
519 	unsigned long error;
520 	struct elf_phdr * elf_ppnt, *elf_phdata;
521 	unsigned long elf_bss, elf_brk;
522 	int elf_exec_fileno;
523 	int retval, i;
524 	unsigned int size;
525 	unsigned long elf_entry, interp_load_addr = 0;
526 	unsigned long start_code, end_code, start_data, end_data;
527 	unsigned long reloc_func_desc = 0;
528 	char passed_fileno[6];
529 	struct files_struct *files;
530 	int have_pt_gnu_stack, executable_stack = EXSTACK_DEFAULT;
531 	unsigned long def_flags = 0;
532 	struct {
533 		struct elfhdr elf_ex;
534 		struct elfhdr interp_elf_ex;
535   		struct exec interp_ex;
536 	} *loc;
537 
538 	loc = kmalloc(sizeof(*loc), GFP_KERNEL);
539 	if (!loc) {
540 		retval = -ENOMEM;
541 		goto out_ret;
542 	}
543 
544 	/* Get the exec-header */
545 	loc->elf_ex = *((struct elfhdr *) bprm->buf);
546 
547 	retval = -ENOEXEC;
548 	/* First of all, some simple consistency checks */
549 	if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
550 		goto out;
551 
552 	if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN)
553 		goto out;
554 	if (!elf_check_arch(&loc->elf_ex))
555 		goto out;
556 	if (!bprm->file->f_op||!bprm->file->f_op->mmap)
557 		goto out;
558 
559 	/* Now read in all of the header information */
560 
561 	if (loc->elf_ex.e_phentsize != sizeof(struct elf_phdr))
562 		goto out;
563 	if (loc->elf_ex.e_phnum < 1 ||
564 	 	loc->elf_ex.e_phnum > 65536U / sizeof(struct elf_phdr))
565 		goto out;
566 	size = loc->elf_ex.e_phnum * sizeof(struct elf_phdr);
567 	retval = -ENOMEM;
568 	elf_phdata = (struct elf_phdr *) kmalloc(size, GFP_KERNEL);
569 	if (!elf_phdata)
570 		goto out;
571 
572 	retval = kernel_read(bprm->file, loc->elf_ex.e_phoff, (char *) elf_phdata, size);
573 	if (retval != size) {
574 		if (retval >= 0)
575 			retval = -EIO;
576 		goto out_free_ph;
577 	}
578 
579 	files = current->files;		/* Refcounted so ok */
580 	retval = unshare_files();
581 	if (retval < 0)
582 		goto out_free_ph;
583 	if (files == current->files) {
584 		put_files_struct(files);
585 		files = NULL;
586 	}
587 
588 	/* exec will make our files private anyway, but for the a.out
589 	   loader stuff we need to do it earlier */
590 
591 	retval = get_unused_fd();
592 	if (retval < 0)
593 		goto out_free_fh;
594 	get_file(bprm->file);
595 	fd_install(elf_exec_fileno = retval, bprm->file);
596 
597 	elf_ppnt = elf_phdata;
598 	elf_bss = 0;
599 	elf_brk = 0;
600 
601 	start_code = ~0UL;
602 	end_code = 0;
603 	start_data = 0;
604 	end_data = 0;
605 
606 	for (i = 0; i < loc->elf_ex.e_phnum; i++) {
607 		if (elf_ppnt->p_type == PT_INTERP) {
608 			/* This is the program interpreter used for
609 			 * shared libraries - for now assume that this
610 			 * is an a.out format binary
611 			 */
612 
613 			retval = -ENOEXEC;
614 			if (elf_ppnt->p_filesz > PATH_MAX ||
615 			    elf_ppnt->p_filesz < 2)
616 				goto out_free_file;
617 
618 			retval = -ENOMEM;
619 			elf_interpreter = (char *) kmalloc(elf_ppnt->p_filesz,
620 							   GFP_KERNEL);
621 			if (!elf_interpreter)
622 				goto out_free_file;
623 
624 			retval = kernel_read(bprm->file, elf_ppnt->p_offset,
625 					   elf_interpreter,
626 					   elf_ppnt->p_filesz);
627 			if (retval != elf_ppnt->p_filesz) {
628 				if (retval >= 0)
629 					retval = -EIO;
630 				goto out_free_interp;
631 			}
632 			/* make sure path is NULL terminated */
633 			retval = -ENOEXEC;
634 			if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
635 				goto out_free_interp;
636 
637 			/* If the program interpreter is one of these two,
638 			 * then assume an iBCS2 image. Otherwise assume
639 			 * a native linux image.
640 			 */
641 			if (strcmp(elf_interpreter,"/usr/lib/libc.so.1") == 0 ||
642 			    strcmp(elf_interpreter,"/usr/lib/ld.so.1") == 0)
643 				ibcs2_interpreter = 1;
644 
645 			/*
646 			 * The early SET_PERSONALITY here is so that the lookup
647 			 * for the interpreter happens in the namespace of the
648 			 * to-be-execed image.  SET_PERSONALITY can select an
649 			 * alternate root.
650 			 *
651 			 * However, SET_PERSONALITY is NOT allowed to switch
652 			 * this task into the new images's memory mapping
653 			 * policy - that is, TASK_SIZE must still evaluate to
654 			 * that which is appropriate to the execing application.
655 			 * This is because exit_mmap() needs to have TASK_SIZE
656 			 * evaluate to the size of the old image.
657 			 *
658 			 * So if (say) a 64-bit application is execing a 32-bit
659 			 * application it is the architecture's responsibility
660 			 * to defer changing the value of TASK_SIZE until the
661 			 * switch really is going to happen - do this in
662 			 * flush_thread().	- akpm
663 			 */
664 			SET_PERSONALITY(loc->elf_ex, ibcs2_interpreter);
665 
666 			interpreter = open_exec(elf_interpreter);
667 			retval = PTR_ERR(interpreter);
668 			if (IS_ERR(interpreter))
669 				goto out_free_interp;
670 			retval = kernel_read(interpreter, 0, bprm->buf, BINPRM_BUF_SIZE);
671 			if (retval != BINPRM_BUF_SIZE) {
672 				if (retval >= 0)
673 					retval = -EIO;
674 				goto out_free_dentry;
675 			}
676 
677 			/* Get the exec headers */
678 			loc->interp_ex = *((struct exec *) bprm->buf);
679 			loc->interp_elf_ex = *((struct elfhdr *) bprm->buf);
680 			break;
681 		}
682 		elf_ppnt++;
683 	}
684 
685 	elf_ppnt = elf_phdata;
686 	for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)
687 		if (elf_ppnt->p_type == PT_GNU_STACK) {
688 			if (elf_ppnt->p_flags & PF_X)
689 				executable_stack = EXSTACK_ENABLE_X;
690 			else
691 				executable_stack = EXSTACK_DISABLE_X;
692 			break;
693 		}
694 	have_pt_gnu_stack = (i < loc->elf_ex.e_phnum);
695 
696 	/* Some simple consistency checks for the interpreter */
697 	if (elf_interpreter) {
698 		interpreter_type = INTERPRETER_ELF | INTERPRETER_AOUT;
699 
700 		/* Now figure out which format our binary is */
701 		if ((N_MAGIC(loc->interp_ex) != OMAGIC) &&
702 		    (N_MAGIC(loc->interp_ex) != ZMAGIC) &&
703 		    (N_MAGIC(loc->interp_ex) != QMAGIC))
704 			interpreter_type = INTERPRETER_ELF;
705 
706 		if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
707 			interpreter_type &= ~INTERPRETER_ELF;
708 
709 		retval = -ELIBBAD;
710 		if (!interpreter_type)
711 			goto out_free_dentry;
712 
713 		/* Make sure only one type was selected */
714 		if ((interpreter_type & INTERPRETER_ELF) &&
715 		     interpreter_type != INTERPRETER_ELF) {
716 	     		// FIXME - ratelimit this before re-enabling
717 			// printk(KERN_WARNING "ELF: Ambiguous type, using ELF\n");
718 			interpreter_type = INTERPRETER_ELF;
719 		}
720 		/* Verify the interpreter has a valid arch */
721 		if ((interpreter_type == INTERPRETER_ELF) &&
722 		    !elf_check_arch(&loc->interp_elf_ex))
723 			goto out_free_dentry;
724 	} else {
725 		/* Executables without an interpreter also need a personality  */
726 		SET_PERSONALITY(loc->elf_ex, ibcs2_interpreter);
727 	}
728 
729 	/* OK, we are done with that, now set up the arg stuff,
730 	   and then start this sucker up */
731 
732 	if ((!bprm->sh_bang) && (interpreter_type == INTERPRETER_AOUT)) {
733 		char *passed_p = passed_fileno;
734 		sprintf(passed_fileno, "%d", elf_exec_fileno);
735 
736 		if (elf_interpreter) {
737 			retval = copy_strings_kernel(1, &passed_p, bprm);
738 			if (retval)
739 				goto out_free_dentry;
740 			bprm->argc++;
741 		}
742 	}
743 
744 	/* Flush all traces of the currently running executable */
745 	retval = flush_old_exec(bprm);
746 	if (retval)
747 		goto out_free_dentry;
748 
749 	/* Discard our unneeded old files struct */
750 	if (files) {
751 		steal_locks(files);
752 		put_files_struct(files);
753 		files = NULL;
754 	}
755 
756 	/* OK, This is the point of no return */
757 	current->mm->start_data = 0;
758 	current->mm->end_data = 0;
759 	current->mm->end_code = 0;
760 	current->mm->mmap = NULL;
761 	current->flags &= ~PF_FORKNOEXEC;
762 	current->mm->def_flags = def_flags;
763 
764 	/* Do this immediately, since STACK_TOP as used in setup_arg_pages
765 	   may depend on the personality.  */
766 	SET_PERSONALITY(loc->elf_ex, ibcs2_interpreter);
767 	if (elf_read_implies_exec(loc->elf_ex, executable_stack))
768 		current->personality |= READ_IMPLIES_EXEC;
769 
770 	if ( !(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
771 		current->flags |= PF_RANDOMIZE;
772 	arch_pick_mmap_layout(current->mm);
773 
774 	/* Do this so that we can load the interpreter, if need be.  We will
775 	   change some of these later */
776 	current->mm->free_area_cache = current->mm->mmap_base;
777 	current->mm->cached_hole_size = 0;
778 	retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
779 				 executable_stack);
780 	if (retval < 0) {
781 		send_sig(SIGKILL, current, 0);
782 		goto out_free_dentry;
783 	}
784 
785 	current->mm->start_stack = bprm->p;
786 
787 	/* Now we do a little grungy work by mmaping the ELF image into
788 	   the correct location in memory.  At this point, we assume that
789 	   the image should be loaded at fixed address, not at a variable
790 	   address. */
791 
792 	for(i = 0, elf_ppnt = elf_phdata; i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
793 		int elf_prot = 0, elf_flags;
794 		unsigned long k, vaddr;
795 
796 		if (elf_ppnt->p_type != PT_LOAD)
797 			continue;
798 
799 		if (unlikely (elf_brk > elf_bss)) {
800 			unsigned long nbyte;
801 
802 			/* There was a PT_LOAD segment with p_memsz > p_filesz
803 			   before this one. Map anonymous pages, if needed,
804 			   and clear the area.  */
805 			retval = set_brk (elf_bss + load_bias,
806 					  elf_brk + load_bias);
807 			if (retval) {
808 				send_sig(SIGKILL, current, 0);
809 				goto out_free_dentry;
810 			}
811 			nbyte = ELF_PAGEOFFSET(elf_bss);
812 			if (nbyte) {
813 				nbyte = ELF_MIN_ALIGN - nbyte;
814 				if (nbyte > elf_brk - elf_bss)
815 					nbyte = elf_brk - elf_bss;
816 				if (clear_user((void __user *)elf_bss +
817 							load_bias, nbyte)) {
818 					/*
819 					 * This bss-zeroing can fail if the ELF
820 					 * file specifies odd protections.  So
821 					 * we don't check the return value
822 					 */
823 				}
824 			}
825 		}
826 
827 		if (elf_ppnt->p_flags & PF_R) elf_prot |= PROT_READ;
828 		if (elf_ppnt->p_flags & PF_W) elf_prot |= PROT_WRITE;
829 		if (elf_ppnt->p_flags & PF_X) elf_prot |= PROT_EXEC;
830 
831 		elf_flags = MAP_PRIVATE|MAP_DENYWRITE|MAP_EXECUTABLE;
832 
833 		vaddr = elf_ppnt->p_vaddr;
834 		if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
835 			elf_flags |= MAP_FIXED;
836 		} else if (loc->elf_ex.e_type == ET_DYN) {
837 			/* Try and get dynamic programs out of the way of the default mmap
838 			   base, as well as whatever program they might try to exec.  This
839 			   is because the brk will follow the loader, and is not movable.  */
840 			load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
841 		}
842 
843 		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt, elf_prot, elf_flags);
844 		if (BAD_ADDR(error)) {
845 			send_sig(SIGKILL, current, 0);
846 			goto out_free_dentry;
847 		}
848 
849 		if (!load_addr_set) {
850 			load_addr_set = 1;
851 			load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);
852 			if (loc->elf_ex.e_type == ET_DYN) {
853 				load_bias += error -
854 				             ELF_PAGESTART(load_bias + vaddr);
855 				load_addr += load_bias;
856 				reloc_func_desc = load_bias;
857 			}
858 		}
859 		k = elf_ppnt->p_vaddr;
860 		if (k < start_code) start_code = k;
861 		if (start_data < k) start_data = k;
862 
863 		/*
864 		 * Check to see if the section's size will overflow the
865 		 * allowed task size. Note that p_filesz must always be
866 		 * <= p_memsz so it is only necessary to check p_memsz.
867 		 */
868 		if (k > TASK_SIZE || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
869 		    elf_ppnt->p_memsz > TASK_SIZE ||
870 		    TASK_SIZE - elf_ppnt->p_memsz < k) {
871 			/* set_brk can never work.  Avoid overflows.  */
872 			send_sig(SIGKILL, current, 0);
873 			goto out_free_dentry;
874 		}
875 
876 		k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
877 
878 		if (k > elf_bss)
879 			elf_bss = k;
880 		if ((elf_ppnt->p_flags & PF_X) && end_code < k)
881 			end_code = k;
882 		if (end_data < k)
883 			end_data = k;
884 		k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
885 		if (k > elf_brk)
886 			elf_brk = k;
887 	}
888 
889 	loc->elf_ex.e_entry += load_bias;
890 	elf_bss += load_bias;
891 	elf_brk += load_bias;
892 	start_code += load_bias;
893 	end_code += load_bias;
894 	start_data += load_bias;
895 	end_data += load_bias;
896 
897 	/* Calling set_brk effectively mmaps the pages that we need
898 	 * for the bss and break sections.  We must do this before
899 	 * mapping in the interpreter, to make sure it doesn't wind
900 	 * up getting placed where the bss needs to go.
901 	 */
902 	retval = set_brk(elf_bss, elf_brk);
903 	if (retval) {
904 		send_sig(SIGKILL, current, 0);
905 		goto out_free_dentry;
906 	}
907 	if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
908 		send_sig(SIGSEGV, current, 0);
909 		retval = -EFAULT; /* Nobody gets to see this, but.. */
910 		goto out_free_dentry;
911 	}
912 
913 	if (elf_interpreter) {
914 		if (interpreter_type == INTERPRETER_AOUT)
915 			elf_entry = load_aout_interp(&loc->interp_ex,
916 						     interpreter);
917 		else
918 			elf_entry = load_elf_interp(&loc->interp_elf_ex,
919 						    interpreter,
920 						    &interp_load_addr);
921 		if (BAD_ADDR(elf_entry)) {
922 			printk(KERN_ERR "Unable to load interpreter %.128s\n",
923 				elf_interpreter);
924 			force_sig(SIGSEGV, current);
925 			retval = -ENOEXEC; /* Nobody gets to see this, but.. */
926 			goto out_free_dentry;
927 		}
928 		reloc_func_desc = interp_load_addr;
929 
930 		allow_write_access(interpreter);
931 		fput(interpreter);
932 		kfree(elf_interpreter);
933 	} else {
934 		elf_entry = loc->elf_ex.e_entry;
935 	}
936 
937 	kfree(elf_phdata);
938 
939 	if (interpreter_type != INTERPRETER_AOUT)
940 		sys_close(elf_exec_fileno);
941 
942 	set_binfmt(&elf_format);
943 
944 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
945 	retval = arch_setup_additional_pages(bprm, executable_stack);
946 	if (retval < 0) {
947 		send_sig(SIGKILL, current, 0);
948 		goto out;
949 	}
950 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
951 
952 	compute_creds(bprm);
953 	current->flags &= ~PF_FORKNOEXEC;
954 	create_elf_tables(bprm, &loc->elf_ex, (interpreter_type == INTERPRETER_AOUT),
955 			load_addr, interp_load_addr);
956 	/* N.B. passed_fileno might not be initialized? */
957 	if (interpreter_type == INTERPRETER_AOUT)
958 		current->mm->arg_start += strlen(passed_fileno) + 1;
959 	current->mm->end_code = end_code;
960 	current->mm->start_code = start_code;
961 	current->mm->start_data = start_data;
962 	current->mm->end_data = end_data;
963 	current->mm->start_stack = bprm->p;
964 
965 	if (current->personality & MMAP_PAGE_ZERO) {
966 		/* Why this, you ask???  Well SVr4 maps page 0 as read-only,
967 		   and some applications "depend" upon this behavior.
968 		   Since we do not have the power to recompile these, we
969 		   emulate the SVr4 behavior.  Sigh.  */
970 		down_write(&current->mm->mmap_sem);
971 		error = do_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
972 				MAP_FIXED | MAP_PRIVATE, 0);
973 		up_write(&current->mm->mmap_sem);
974 	}
975 
976 #ifdef ELF_PLAT_INIT
977 	/*
978 	 * The ABI may specify that certain registers be set up in special
979 	 * ways (on i386 %edx is the address of a DT_FINI function, for
980 	 * example.  In addition, it may also specify (eg, PowerPC64 ELF)
981 	 * that the e_entry field is the address of the function descriptor
982 	 * for the startup routine, rather than the address of the startup
983 	 * routine itself.  This macro performs whatever initialization to
984 	 * the regs structure is required as well as any relocations to the
985 	 * function descriptor entries when executing dynamically links apps.
986 	 */
987 	ELF_PLAT_INIT(regs, reloc_func_desc);
988 #endif
989 
990 	start_thread(regs, elf_entry, bprm->p);
991 	if (unlikely(current->ptrace & PT_PTRACED)) {
992 		if (current->ptrace & PT_TRACE_EXEC)
993 			ptrace_notify ((PTRACE_EVENT_EXEC << 8) | SIGTRAP);
994 		else
995 			send_sig(SIGTRAP, current, 0);
996 	}
997 	retval = 0;
998 out:
999 	kfree(loc);
1000 out_ret:
1001 	return retval;
1002 
1003 	/* error cleanup */
1004 out_free_dentry:
1005 	allow_write_access(interpreter);
1006 	if (interpreter)
1007 		fput(interpreter);
1008 out_free_interp:
1009 	if (elf_interpreter)
1010 		kfree(elf_interpreter);
1011 out_free_file:
1012 	sys_close(elf_exec_fileno);
1013 out_free_fh:
1014 	if (files) {
1015 		put_files_struct(current->files);
1016 		current->files = files;
1017 	}
1018 out_free_ph:
1019 	kfree(elf_phdata);
1020 	goto out;
1021 }
1022 
1023 /* This is really simpleminded and specialized - we are loading an
1024    a.out library that is given an ELF header. */
1025 
1026 static int load_elf_library(struct file *file)
1027 {
1028 	struct elf_phdr *elf_phdata;
1029 	struct elf_phdr *eppnt;
1030 	unsigned long elf_bss, bss, len;
1031 	int retval, error, i, j;
1032 	struct elfhdr elf_ex;
1033 
1034 	error = -ENOEXEC;
1035 	retval = kernel_read(file, 0, (char *) &elf_ex, sizeof(elf_ex));
1036 	if (retval != sizeof(elf_ex))
1037 		goto out;
1038 
1039 	if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
1040 		goto out;
1041 
1042 	/* First of all, some simple consistency checks */
1043 	if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
1044 	   !elf_check_arch(&elf_ex) || !file->f_op || !file->f_op->mmap)
1045 		goto out;
1046 
1047 	/* Now read in all of the header information */
1048 
1049 	j = sizeof(struct elf_phdr) * elf_ex.e_phnum;
1050 	/* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1051 
1052 	error = -ENOMEM;
1053 	elf_phdata = kmalloc(j, GFP_KERNEL);
1054 	if (!elf_phdata)
1055 		goto out;
1056 
1057 	eppnt = elf_phdata;
1058 	error = -ENOEXEC;
1059 	retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);
1060 	if (retval != j)
1061 		goto out_free_ph;
1062 
1063 	for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1064 		if ((eppnt + i)->p_type == PT_LOAD)
1065 			j++;
1066 	if (j != 1)
1067 		goto out_free_ph;
1068 
1069 	while (eppnt->p_type != PT_LOAD)
1070 		eppnt++;
1071 
1072 	/* Now use mmap to map the library into memory. */
1073 	down_write(&current->mm->mmap_sem);
1074 	error = do_mmap(file,
1075 			ELF_PAGESTART(eppnt->p_vaddr),
1076 			(eppnt->p_filesz +
1077 			 ELF_PAGEOFFSET(eppnt->p_vaddr)),
1078 			PROT_READ | PROT_WRITE | PROT_EXEC,
1079 			MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
1080 			(eppnt->p_offset -
1081 			 ELF_PAGEOFFSET(eppnt->p_vaddr)));
1082 	up_write(&current->mm->mmap_sem);
1083 	if (error != ELF_PAGESTART(eppnt->p_vaddr))
1084 		goto out_free_ph;
1085 
1086 	elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
1087 	if (padzero(elf_bss)) {
1088 		error = -EFAULT;
1089 		goto out_free_ph;
1090 	}
1091 
1092 	len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr + ELF_MIN_ALIGN - 1);
1093 	bss = eppnt->p_memsz + eppnt->p_vaddr;
1094 	if (bss > len) {
1095 		down_write(&current->mm->mmap_sem);
1096 		do_brk(len, bss - len);
1097 		up_write(&current->mm->mmap_sem);
1098 	}
1099 	error = 0;
1100 
1101 out_free_ph:
1102 	kfree(elf_phdata);
1103 out:
1104 	return error;
1105 }
1106 
1107 /*
1108  * Note that some platforms still use traditional core dumps and not
1109  * the ELF core dump.  Each platform can select it as appropriate.
1110  */
1111 #ifdef USE_ELF_CORE_DUMP
1112 
1113 /*
1114  * ELF core dumper
1115  *
1116  * Modelled on fs/exec.c:aout_core_dump()
1117  * Jeremy Fitzhardinge <jeremy@sw.oz.au>
1118  */
1119 /*
1120  * These are the only things you should do on a core-file: use only these
1121  * functions to write out all the necessary info.
1122  */
1123 static int dump_write(struct file *file, const void *addr, int nr)
1124 {
1125 	return file->f_op->write(file, addr, nr, &file->f_pos) == nr;
1126 }
1127 
1128 static int dump_seek(struct file *file, loff_t off)
1129 {
1130 	if (file->f_op->llseek) {
1131 		if (file->f_op->llseek(file, off, 0) != off)
1132 			return 0;
1133 	} else
1134 		file->f_pos = off;
1135 	return 1;
1136 }
1137 
1138 /*
1139  * Decide whether a segment is worth dumping; default is yes to be
1140  * sure (missing info is worse than too much; etc).
1141  * Personally I'd include everything, and use the coredump limit...
1142  *
1143  * I think we should skip something. But I am not sure how. H.J.
1144  */
1145 static int maydump(struct vm_area_struct *vma)
1146 {
1147 	/* Do not dump I/O mapped devices or special mappings */
1148 	if (vma->vm_flags & (VM_IO | VM_RESERVED))
1149 		return 0;
1150 
1151 	/* Dump shared memory only if mapped from an anonymous file.  */
1152 	if (vma->vm_flags & VM_SHARED)
1153 		return vma->vm_file->f_dentry->d_inode->i_nlink == 0;
1154 
1155 	/* If it hasn't been written to, don't write it out */
1156 	if (!vma->anon_vma)
1157 		return 0;
1158 
1159 	return 1;
1160 }
1161 
1162 #define roundup(x, y)  ((((x)+((y)-1))/(y))*(y))
1163 
1164 /* An ELF note in memory */
1165 struct memelfnote
1166 {
1167 	const char *name;
1168 	int type;
1169 	unsigned int datasz;
1170 	void *data;
1171 };
1172 
1173 static int notesize(struct memelfnote *en)
1174 {
1175 	int sz;
1176 
1177 	sz = sizeof(struct elf_note);
1178 	sz += roundup(strlen(en->name) + 1, 4);
1179 	sz += roundup(en->datasz, 4);
1180 
1181 	return sz;
1182 }
1183 
1184 #define DUMP_WRITE(addr, nr)	\
1185 	do { if (!dump_write(file, (addr), (nr))) return 0; } while(0)
1186 #define DUMP_SEEK(off)	\
1187 	do { if (!dump_seek(file, (off))) return 0; } while(0)
1188 
1189 static int writenote(struct memelfnote *men, struct file *file)
1190 {
1191 	struct elf_note en;
1192 
1193 	en.n_namesz = strlen(men->name) + 1;
1194 	en.n_descsz = men->datasz;
1195 	en.n_type = men->type;
1196 
1197 	DUMP_WRITE(&en, sizeof(en));
1198 	DUMP_WRITE(men->name, en.n_namesz);
1199 	/* XXX - cast from long long to long to avoid need for libgcc.a */
1200 	DUMP_SEEK(roundup((unsigned long)file->f_pos, 4));	/* XXX */
1201 	DUMP_WRITE(men->data, men->datasz);
1202 	DUMP_SEEK(roundup((unsigned long)file->f_pos, 4));	/* XXX */
1203 
1204 	return 1;
1205 }
1206 #undef DUMP_WRITE
1207 #undef DUMP_SEEK
1208 
1209 #define DUMP_WRITE(addr, nr)	\
1210 	if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
1211 		goto end_coredump;
1212 #define DUMP_SEEK(off)	\
1213 	if (!dump_seek(file, (off))) \
1214 		goto end_coredump;
1215 
1216 static inline void fill_elf_header(struct elfhdr *elf, int segs)
1217 {
1218 	memcpy(elf->e_ident, ELFMAG, SELFMAG);
1219 	elf->e_ident[EI_CLASS] = ELF_CLASS;
1220 	elf->e_ident[EI_DATA] = ELF_DATA;
1221 	elf->e_ident[EI_VERSION] = EV_CURRENT;
1222 	elf->e_ident[EI_OSABI] = ELF_OSABI;
1223 	memset(elf->e_ident+EI_PAD, 0, EI_NIDENT-EI_PAD);
1224 
1225 	elf->e_type = ET_CORE;
1226 	elf->e_machine = ELF_ARCH;
1227 	elf->e_version = EV_CURRENT;
1228 	elf->e_entry = 0;
1229 	elf->e_phoff = sizeof(struct elfhdr);
1230 	elf->e_shoff = 0;
1231 	elf->e_flags = ELF_CORE_EFLAGS;
1232 	elf->e_ehsize = sizeof(struct elfhdr);
1233 	elf->e_phentsize = sizeof(struct elf_phdr);
1234 	elf->e_phnum = segs;
1235 	elf->e_shentsize = 0;
1236 	elf->e_shnum = 0;
1237 	elf->e_shstrndx = 0;
1238 	return;
1239 }
1240 
1241 static inline void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, off_t offset)
1242 {
1243 	phdr->p_type = PT_NOTE;
1244 	phdr->p_offset = offset;
1245 	phdr->p_vaddr = 0;
1246 	phdr->p_paddr = 0;
1247 	phdr->p_filesz = sz;
1248 	phdr->p_memsz = 0;
1249 	phdr->p_flags = 0;
1250 	phdr->p_align = 0;
1251 	return;
1252 }
1253 
1254 static void fill_note(struct memelfnote *note, const char *name, int type,
1255 		unsigned int sz, void *data)
1256 {
1257 	note->name = name;
1258 	note->type = type;
1259 	note->datasz = sz;
1260 	note->data = data;
1261 	return;
1262 }
1263 
1264 /*
1265  * fill up all the fields in prstatus from the given task struct, except registers
1266  * which need to be filled up separately.
1267  */
1268 static void fill_prstatus(struct elf_prstatus *prstatus,
1269 			struct task_struct *p, long signr)
1270 {
1271 	prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
1272 	prstatus->pr_sigpend = p->pending.signal.sig[0];
1273 	prstatus->pr_sighold = p->blocked.sig[0];
1274 	prstatus->pr_pid = p->pid;
1275 	prstatus->pr_ppid = p->parent->pid;
1276 	prstatus->pr_pgrp = process_group(p);
1277 	prstatus->pr_sid = p->signal->session;
1278 	if (thread_group_leader(p)) {
1279 		/*
1280 		 * This is the record for the group leader.  Add in the
1281 		 * cumulative times of previous dead threads.  This total
1282 		 * won't include the time of each live thread whose state
1283 		 * is included in the core dump.  The final total reported
1284 		 * to our parent process when it calls wait4 will include
1285 		 * those sums as well as the little bit more time it takes
1286 		 * this and each other thread to finish dying after the
1287 		 * core dump synchronization phase.
1288 		 */
1289 		cputime_to_timeval(cputime_add(p->utime, p->signal->utime),
1290 				   &prstatus->pr_utime);
1291 		cputime_to_timeval(cputime_add(p->stime, p->signal->stime),
1292 				   &prstatus->pr_stime);
1293 	} else {
1294 		cputime_to_timeval(p->utime, &prstatus->pr_utime);
1295 		cputime_to_timeval(p->stime, &prstatus->pr_stime);
1296 	}
1297 	cputime_to_timeval(p->signal->cutime, &prstatus->pr_cutime);
1298 	cputime_to_timeval(p->signal->cstime, &prstatus->pr_cstime);
1299 }
1300 
1301 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
1302 		       struct mm_struct *mm)
1303 {
1304 	unsigned int i, len;
1305 
1306 	/* first copy the parameters from user space */
1307 	memset(psinfo, 0, sizeof(struct elf_prpsinfo));
1308 
1309 	len = mm->arg_end - mm->arg_start;
1310 	if (len >= ELF_PRARGSZ)
1311 		len = ELF_PRARGSZ-1;
1312 	if (copy_from_user(&psinfo->pr_psargs,
1313 		           (const char __user *)mm->arg_start, len))
1314 		return -EFAULT;
1315 	for(i = 0; i < len; i++)
1316 		if (psinfo->pr_psargs[i] == 0)
1317 			psinfo->pr_psargs[i] = ' ';
1318 	psinfo->pr_psargs[len] = 0;
1319 
1320 	psinfo->pr_pid = p->pid;
1321 	psinfo->pr_ppid = p->parent->pid;
1322 	psinfo->pr_pgrp = process_group(p);
1323 	psinfo->pr_sid = p->signal->session;
1324 
1325 	i = p->state ? ffz(~p->state) + 1 : 0;
1326 	psinfo->pr_state = i;
1327 	psinfo->pr_sname = (i < 0 || i > 5) ? '.' : "RSDTZW"[i];
1328 	psinfo->pr_zomb = psinfo->pr_sname == 'Z';
1329 	psinfo->pr_nice = task_nice(p);
1330 	psinfo->pr_flag = p->flags;
1331 	SET_UID(psinfo->pr_uid, p->uid);
1332 	SET_GID(psinfo->pr_gid, p->gid);
1333 	strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
1334 
1335 	return 0;
1336 }
1337 
1338 /* Here is the structure in which status of each thread is captured. */
1339 struct elf_thread_status
1340 {
1341 	struct list_head list;
1342 	struct elf_prstatus prstatus;	/* NT_PRSTATUS */
1343 	elf_fpregset_t fpu;		/* NT_PRFPREG */
1344 	struct task_struct *thread;
1345 #ifdef ELF_CORE_COPY_XFPREGS
1346 	elf_fpxregset_t xfpu;		/* NT_PRXFPREG */
1347 #endif
1348 	struct memelfnote notes[3];
1349 	int num_notes;
1350 };
1351 
1352 /*
1353  * In order to add the specific thread information for the elf file format,
1354  * we need to keep a linked list of every threads pr_status and then
1355  * create a single section for them in the final core file.
1356  */
1357 static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
1358 {
1359 	int sz = 0;
1360 	struct task_struct *p = t->thread;
1361 	t->num_notes = 0;
1362 
1363 	fill_prstatus(&t->prstatus, p, signr);
1364 	elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
1365 
1366 	fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus), &(t->prstatus));
1367 	t->num_notes++;
1368 	sz += notesize(&t->notes[0]);
1369 
1370 	if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL, &t->fpu))) {
1371 		fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu), &(t->fpu));
1372 		t->num_notes++;
1373 		sz += notesize(&t->notes[1]);
1374 	}
1375 
1376 #ifdef ELF_CORE_COPY_XFPREGS
1377 	if (elf_core_copy_task_xfpregs(p, &t->xfpu)) {
1378 		fill_note(&t->notes[2], "LINUX", NT_PRXFPREG, sizeof(t->xfpu), &t->xfpu);
1379 		t->num_notes++;
1380 		sz += notesize(&t->notes[2]);
1381 	}
1382 #endif
1383 	return sz;
1384 }
1385 
1386 /*
1387  * Actual dumper
1388  *
1389  * This is a two-pass process; first we find the offsets of the bits,
1390  * and then they are actually written out.  If we run out of core limit
1391  * we just truncate.
1392  */
1393 static int elf_core_dump(long signr, struct pt_regs * regs, struct file * file)
1394 {
1395 #define	NUM_NOTES	6
1396 	int has_dumped = 0;
1397 	mm_segment_t fs;
1398 	int segs;
1399 	size_t size = 0;
1400 	int i;
1401 	struct vm_area_struct *vma;
1402 	struct elfhdr *elf = NULL;
1403 	off_t offset = 0, dataoff;
1404 	unsigned long limit = current->signal->rlim[RLIMIT_CORE].rlim_cur;
1405 	int numnote;
1406 	struct memelfnote *notes = NULL;
1407 	struct elf_prstatus *prstatus = NULL;	/* NT_PRSTATUS */
1408 	struct elf_prpsinfo *psinfo = NULL;	/* NT_PRPSINFO */
1409  	struct task_struct *g, *p;
1410  	LIST_HEAD(thread_list);
1411  	struct list_head *t;
1412 	elf_fpregset_t *fpu = NULL;
1413 #ifdef ELF_CORE_COPY_XFPREGS
1414 	elf_fpxregset_t *xfpu = NULL;
1415 #endif
1416 	int thread_status_size = 0;
1417 	elf_addr_t *auxv;
1418 
1419 	/*
1420 	 * We no longer stop all VM operations.
1421 	 *
1422 	 * This is because those proceses that could possibly change map_count or
1423 	 * the mmap / vma pages are now blocked in do_exit on current finishing
1424 	 * this core dump.
1425 	 *
1426 	 * Only ptrace can touch these memory addresses, but it doesn't change
1427 	 * the map_count or the pages allocated.  So no possibility of crashing
1428 	 * exists while dumping the mm->vm_next areas to the core file.
1429 	 */
1430 
1431 	/* alloc memory for large data structures: too large to be on stack */
1432 	elf = kmalloc(sizeof(*elf), GFP_KERNEL);
1433 	if (!elf)
1434 		goto cleanup;
1435 	prstatus = kmalloc(sizeof(*prstatus), GFP_KERNEL);
1436 	if (!prstatus)
1437 		goto cleanup;
1438 	psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
1439 	if (!psinfo)
1440 		goto cleanup;
1441 	notes = kmalloc(NUM_NOTES * sizeof(struct memelfnote), GFP_KERNEL);
1442 	if (!notes)
1443 		goto cleanup;
1444 	fpu = kmalloc(sizeof(*fpu), GFP_KERNEL);
1445 	if (!fpu)
1446 		goto cleanup;
1447 #ifdef ELF_CORE_COPY_XFPREGS
1448 	xfpu = kmalloc(sizeof(*xfpu), GFP_KERNEL);
1449 	if (!xfpu)
1450 		goto cleanup;
1451 #endif
1452 
1453 	if (signr) {
1454 		struct elf_thread_status *tmp;
1455 		read_lock(&tasklist_lock);
1456 		do_each_thread(g,p)
1457 			if (current->mm == p->mm && current != p) {
1458 				tmp = kmalloc(sizeof(*tmp), GFP_ATOMIC);
1459 				if (!tmp) {
1460 					read_unlock(&tasklist_lock);
1461 					goto cleanup;
1462 				}
1463 				memset(tmp, 0, sizeof(*tmp));
1464 				INIT_LIST_HEAD(&tmp->list);
1465 				tmp->thread = p;
1466 				list_add(&tmp->list, &thread_list);
1467 			}
1468 		while_each_thread(g,p);
1469 		read_unlock(&tasklist_lock);
1470 		list_for_each(t, &thread_list) {
1471 			struct elf_thread_status *tmp;
1472 			int sz;
1473 
1474 			tmp = list_entry(t, struct elf_thread_status, list);
1475 			sz = elf_dump_thread_status(signr, tmp);
1476 			thread_status_size += sz;
1477 		}
1478 	}
1479 	/* now collect the dump for the current */
1480 	memset(prstatus, 0, sizeof(*prstatus));
1481 	fill_prstatus(prstatus, current, signr);
1482 	elf_core_copy_regs(&prstatus->pr_reg, regs);
1483 
1484 	segs = current->mm->map_count;
1485 #ifdef ELF_CORE_EXTRA_PHDRS
1486 	segs += ELF_CORE_EXTRA_PHDRS;
1487 #endif
1488 
1489 	/* Set up header */
1490 	fill_elf_header(elf, segs+1);	/* including notes section */
1491 
1492 	has_dumped = 1;
1493 	current->flags |= PF_DUMPCORE;
1494 
1495 	/*
1496 	 * Set up the notes in similar form to SVR4 core dumps made
1497 	 * with info from their /proc.
1498 	 */
1499 
1500 	fill_note(notes +0, "CORE", NT_PRSTATUS, sizeof(*prstatus), prstatus);
1501 
1502 	fill_psinfo(psinfo, current->group_leader, current->mm);
1503 	fill_note(notes +1, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
1504 
1505 	numnote = 2;
1506 
1507 	auxv = (elf_addr_t *) current->mm->saved_auxv;
1508 
1509 	i = 0;
1510 	do
1511 		i += 2;
1512 	while (auxv[i - 2] != AT_NULL);
1513 	fill_note(&notes[numnote++], "CORE", NT_AUXV,
1514 		  i * sizeof (elf_addr_t), auxv);
1515 
1516   	/* Try to dump the FPU. */
1517 	if ((prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs, fpu)))
1518 		fill_note(notes + numnote++,
1519 			  "CORE", NT_PRFPREG, sizeof(*fpu), fpu);
1520 #ifdef ELF_CORE_COPY_XFPREGS
1521 	if (elf_core_copy_task_xfpregs(current, xfpu))
1522 		fill_note(notes + numnote++,
1523 			  "LINUX", NT_PRXFPREG, sizeof(*xfpu), xfpu);
1524 #endif
1525 
1526 	fs = get_fs();
1527 	set_fs(KERNEL_DS);
1528 
1529 	DUMP_WRITE(elf, sizeof(*elf));
1530 	offset += sizeof(*elf);				/* Elf header */
1531 	offset += (segs+1) * sizeof(struct elf_phdr);	/* Program headers */
1532 
1533 	/* Write notes phdr entry */
1534 	{
1535 		struct elf_phdr phdr;
1536 		int sz = 0;
1537 
1538 		for (i = 0; i < numnote; i++)
1539 			sz += notesize(notes + i);
1540 
1541 		sz += thread_status_size;
1542 
1543 		fill_elf_note_phdr(&phdr, sz, offset);
1544 		offset += sz;
1545 		DUMP_WRITE(&phdr, sizeof(phdr));
1546 	}
1547 
1548 	/* Page-align dumped data */
1549 	dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
1550 
1551 	/* Write program headers for segments dump */
1552 	for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) {
1553 		struct elf_phdr phdr;
1554 		size_t sz;
1555 
1556 		sz = vma->vm_end - vma->vm_start;
1557 
1558 		phdr.p_type = PT_LOAD;
1559 		phdr.p_offset = offset;
1560 		phdr.p_vaddr = vma->vm_start;
1561 		phdr.p_paddr = 0;
1562 		phdr.p_filesz = maydump(vma) ? sz : 0;
1563 		phdr.p_memsz = sz;
1564 		offset += phdr.p_filesz;
1565 		phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
1566 		if (vma->vm_flags & VM_WRITE) phdr.p_flags |= PF_W;
1567 		if (vma->vm_flags & VM_EXEC) phdr.p_flags |= PF_X;
1568 		phdr.p_align = ELF_EXEC_PAGESIZE;
1569 
1570 		DUMP_WRITE(&phdr, sizeof(phdr));
1571 	}
1572 
1573 #ifdef ELF_CORE_WRITE_EXTRA_PHDRS
1574 	ELF_CORE_WRITE_EXTRA_PHDRS;
1575 #endif
1576 
1577  	/* write out the notes section */
1578 	for (i = 0; i < numnote; i++)
1579 		if (!writenote(notes + i, file))
1580 			goto end_coredump;
1581 
1582 	/* write out the thread status notes section */
1583 	list_for_each(t, &thread_list) {
1584 		struct elf_thread_status *tmp = list_entry(t, struct elf_thread_status, list);
1585 		for (i = 0; i < tmp->num_notes; i++)
1586 			if (!writenote(&tmp->notes[i], file))
1587 				goto end_coredump;
1588 	}
1589 
1590 	DUMP_SEEK(dataoff);
1591 
1592 	for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) {
1593 		unsigned long addr;
1594 
1595 		if (!maydump(vma))
1596 			continue;
1597 
1598 		for (addr = vma->vm_start;
1599 		     addr < vma->vm_end;
1600 		     addr += PAGE_SIZE) {
1601 			struct page* page;
1602 			struct vm_area_struct *vma;
1603 
1604 			if (get_user_pages(current, current->mm, addr, 1, 0, 1,
1605 						&page, &vma) <= 0) {
1606 				DUMP_SEEK (file->f_pos + PAGE_SIZE);
1607 			} else {
1608 				if (page == ZERO_PAGE(addr)) {
1609 					DUMP_SEEK (file->f_pos + PAGE_SIZE);
1610 				} else {
1611 					void *kaddr;
1612 					flush_cache_page(vma, addr, page_to_pfn(page));
1613 					kaddr = kmap(page);
1614 					if ((size += PAGE_SIZE) > limit ||
1615 					    !dump_write(file, kaddr,
1616 					    PAGE_SIZE)) {
1617 						kunmap(page);
1618 						page_cache_release(page);
1619 						goto end_coredump;
1620 					}
1621 					kunmap(page);
1622 				}
1623 				page_cache_release(page);
1624 			}
1625 		}
1626 	}
1627 
1628 #ifdef ELF_CORE_WRITE_EXTRA_DATA
1629 	ELF_CORE_WRITE_EXTRA_DATA;
1630 #endif
1631 
1632 	if ((off_t) file->f_pos != offset) {
1633 		/* Sanity check */
1634 		printk("elf_core_dump: file->f_pos (%ld) != offset (%ld)\n",
1635 		       (off_t) file->f_pos, offset);
1636 	}
1637 
1638 end_coredump:
1639 	set_fs(fs);
1640 
1641 cleanup:
1642 	while(!list_empty(&thread_list)) {
1643 		struct list_head *tmp = thread_list.next;
1644 		list_del(tmp);
1645 		kfree(list_entry(tmp, struct elf_thread_status, list));
1646 	}
1647 
1648 	kfree(elf);
1649 	kfree(prstatus);
1650 	kfree(psinfo);
1651 	kfree(notes);
1652 	kfree(fpu);
1653 #ifdef ELF_CORE_COPY_XFPREGS
1654 	kfree(xfpu);
1655 #endif
1656 	return has_dumped;
1657 #undef NUM_NOTES
1658 }
1659 
1660 #endif		/* USE_ELF_CORE_DUMP */
1661 
1662 static int __init init_elf_binfmt(void)
1663 {
1664 	return register_binfmt(&elf_format);
1665 }
1666 
1667 static void __exit exit_elf_binfmt(void)
1668 {
1669 	/* Remove the COFF and ELF loaders. */
1670 	unregister_binfmt(&elf_format);
1671 }
1672 
1673 core_initcall(init_elf_binfmt);
1674 module_exit(exit_elf_binfmt);
1675 MODULE_LICENSE("GPL");
1676