1 /* This is the Linux kernel elf-loading code, ported into user space */ 2 #include <sys/time.h> 3 #include <sys/param.h> 4 5 #include <stdio.h> 6 #include <sys/types.h> 7 #include <fcntl.h> 8 #include <errno.h> 9 #include <unistd.h> 10 #include <sys/mman.h> 11 #include <sys/resource.h> 12 #include <stdlib.h> 13 #include <string.h> 14 #include <time.h> 15 16 #include "qemu.h" 17 #include "disas/disas.h" 18 19 #ifdef _ARCH_PPC64 20 #undef ARCH_DLINFO 21 #undef ELF_PLATFORM 22 #undef ELF_HWCAP 23 #undef ELF_CLASS 24 #undef ELF_DATA 25 #undef ELF_ARCH 26 #endif 27 28 #define ELF_OSABI ELFOSABI_SYSV 29 30 /* from personality.h */ 31 32 /* 33 * Flags for bug emulation. 34 * 35 * These occupy the top three bytes. 36 */ 37 enum { 38 ADDR_NO_RANDOMIZE = 0x0040000, /* disable randomization of VA space */ 39 FDPIC_FUNCPTRS = 0x0080000, /* userspace function ptrs point to 40 descriptors (signal handling) */ 41 MMAP_PAGE_ZERO = 0x0100000, 42 ADDR_COMPAT_LAYOUT = 0x0200000, 43 READ_IMPLIES_EXEC = 0x0400000, 44 ADDR_LIMIT_32BIT = 0x0800000, 45 SHORT_INODE = 0x1000000, 46 WHOLE_SECONDS = 0x2000000, 47 STICKY_TIMEOUTS = 0x4000000, 48 ADDR_LIMIT_3GB = 0x8000000, 49 }; 50 51 /* 52 * Personality types. 53 * 54 * These go in the low byte. Avoid using the top bit, it will 55 * conflict with error returns. 56 */ 57 enum { 58 PER_LINUX = 0x0000, 59 PER_LINUX_32BIT = 0x0000 | ADDR_LIMIT_32BIT, 60 PER_LINUX_FDPIC = 0x0000 | FDPIC_FUNCPTRS, 61 PER_SVR4 = 0x0001 | STICKY_TIMEOUTS | MMAP_PAGE_ZERO, 62 PER_SVR3 = 0x0002 | STICKY_TIMEOUTS | SHORT_INODE, 63 PER_SCOSVR3 = 0x0003 | STICKY_TIMEOUTS | WHOLE_SECONDS | SHORT_INODE, 64 PER_OSR5 = 0x0003 | STICKY_TIMEOUTS | WHOLE_SECONDS, 65 PER_WYSEV386 = 0x0004 | STICKY_TIMEOUTS | SHORT_INODE, 66 PER_ISCR4 = 0x0005 | STICKY_TIMEOUTS, 67 PER_BSD = 0x0006, 68 PER_SUNOS = 0x0006 | STICKY_TIMEOUTS, 69 PER_XENIX = 0x0007 | STICKY_TIMEOUTS | SHORT_INODE, 70 PER_LINUX32 = 0x0008, 71 PER_LINUX32_3GB = 0x0008 | ADDR_LIMIT_3GB, 72 PER_IRIX32 = 0x0009 | STICKY_TIMEOUTS,/* IRIX5 32-bit */ 73 PER_IRIXN32 = 0x000a | STICKY_TIMEOUTS,/* IRIX6 new 32-bit */ 74 PER_IRIX64 = 0x000b | STICKY_TIMEOUTS,/* IRIX6 64-bit */ 75 PER_RISCOS = 0x000c, 76 PER_SOLARIS = 0x000d | STICKY_TIMEOUTS, 77 PER_UW7 = 0x000e | STICKY_TIMEOUTS | MMAP_PAGE_ZERO, 78 PER_OSF4 = 0x000f, /* OSF/1 v4 */ 79 PER_HPUX = 0x0010, 80 PER_MASK = 0x00ff, 81 }; 82 83 /* 84 * Return the base personality without flags. 85 */ 86 #define personality(pers) (pers & PER_MASK) 87 88 /* this flag is uneffective under linux too, should be deleted */ 89 #ifndef MAP_DENYWRITE 90 #define MAP_DENYWRITE 0 91 #endif 92 93 /* should probably go in elf.h */ 94 #ifndef ELIBBAD 95 #define ELIBBAD 80 96 #endif 97 98 #ifdef TARGET_WORDS_BIGENDIAN 99 #define ELF_DATA ELFDATA2MSB 100 #else 101 #define ELF_DATA ELFDATA2LSB 102 #endif 103 104 #ifdef TARGET_ABI_MIPSN32 105 typedef abi_ullong target_elf_greg_t; 106 #define tswapreg(ptr) tswap64(ptr) 107 #else 108 typedef abi_ulong target_elf_greg_t; 109 #define tswapreg(ptr) tswapal(ptr) 110 #endif 111 112 #ifdef USE_UID16 113 typedef abi_ushort target_uid_t; 114 typedef abi_ushort target_gid_t; 115 #else 116 typedef abi_uint target_uid_t; 117 typedef abi_uint target_gid_t; 118 #endif 119 typedef abi_int target_pid_t; 120 121 #ifdef TARGET_I386 122 123 #define ELF_PLATFORM get_elf_platform() 124 125 static const char *get_elf_platform(void) 126 { 127 static char elf_platform[] = "i386"; 128 int family = (thread_env->cpuid_version >> 8) & 0xff; 129 if (family > 6) 130 family = 6; 131 if (family >= 3) 132 elf_platform[1] = '0' + family; 133 return elf_platform; 134 } 135 136 #define ELF_HWCAP get_elf_hwcap() 137 138 static uint32_t get_elf_hwcap(void) 139 { 140 return thread_env->cpuid_features; 141 } 142 143 #ifdef TARGET_X86_64 144 #define ELF_START_MMAP 0x2aaaaab000ULL 145 #define elf_check_arch(x) ( ((x) == ELF_ARCH) ) 146 147 #define ELF_CLASS ELFCLASS64 148 #define ELF_ARCH EM_X86_64 149 150 static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop) 151 { 152 regs->rax = 0; 153 regs->rsp = infop->start_stack; 154 regs->rip = infop->entry; 155 } 156 157 #define ELF_NREG 27 158 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG]; 159 160 /* 161 * Note that ELF_NREG should be 29 as there should be place for 162 * TRAPNO and ERR "registers" as well but linux doesn't dump 163 * those. 164 * 165 * See linux kernel: arch/x86/include/asm/elf.h 166 */ 167 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *env) 168 { 169 (*regs)[0] = env->regs[15]; 170 (*regs)[1] = env->regs[14]; 171 (*regs)[2] = env->regs[13]; 172 (*regs)[3] = env->regs[12]; 173 (*regs)[4] = env->regs[R_EBP]; 174 (*regs)[5] = env->regs[R_EBX]; 175 (*regs)[6] = env->regs[11]; 176 (*regs)[7] = env->regs[10]; 177 (*regs)[8] = env->regs[9]; 178 (*regs)[9] = env->regs[8]; 179 (*regs)[10] = env->regs[R_EAX]; 180 (*regs)[11] = env->regs[R_ECX]; 181 (*regs)[12] = env->regs[R_EDX]; 182 (*regs)[13] = env->regs[R_ESI]; 183 (*regs)[14] = env->regs[R_EDI]; 184 (*regs)[15] = env->regs[R_EAX]; /* XXX */ 185 (*regs)[16] = env->eip; 186 (*regs)[17] = env->segs[R_CS].selector & 0xffff; 187 (*regs)[18] = env->eflags; 188 (*regs)[19] = env->regs[R_ESP]; 189 (*regs)[20] = env->segs[R_SS].selector & 0xffff; 190 (*regs)[21] = env->segs[R_FS].selector & 0xffff; 191 (*regs)[22] = env->segs[R_GS].selector & 0xffff; 192 (*regs)[23] = env->segs[R_DS].selector & 0xffff; 193 (*regs)[24] = env->segs[R_ES].selector & 0xffff; 194 (*regs)[25] = env->segs[R_FS].selector & 0xffff; 195 (*regs)[26] = env->segs[R_GS].selector & 0xffff; 196 } 197 198 #else 199 200 #define ELF_START_MMAP 0x80000000 201 202 /* 203 * This is used to ensure we don't load something for the wrong architecture. 204 */ 205 #define elf_check_arch(x) ( ((x) == EM_386) || ((x) == EM_486) ) 206 207 /* 208 * These are used to set parameters in the core dumps. 209 */ 210 #define ELF_CLASS ELFCLASS32 211 #define ELF_ARCH EM_386 212 213 static inline void init_thread(struct target_pt_regs *regs, 214 struct image_info *infop) 215 { 216 regs->esp = infop->start_stack; 217 regs->eip = infop->entry; 218 219 /* SVR4/i386 ABI (pages 3-31, 3-32) says that when the program 220 starts %edx contains a pointer to a function which might be 221 registered using `atexit'. This provides a mean for the 222 dynamic linker to call DT_FINI functions for shared libraries 223 that have been loaded before the code runs. 224 225 A value of 0 tells we have no such handler. */ 226 regs->edx = 0; 227 } 228 229 #define ELF_NREG 17 230 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG]; 231 232 /* 233 * Note that ELF_NREG should be 19 as there should be place for 234 * TRAPNO and ERR "registers" as well but linux doesn't dump 235 * those. 236 * 237 * See linux kernel: arch/x86/include/asm/elf.h 238 */ 239 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *env) 240 { 241 (*regs)[0] = env->regs[R_EBX]; 242 (*regs)[1] = env->regs[R_ECX]; 243 (*regs)[2] = env->regs[R_EDX]; 244 (*regs)[3] = env->regs[R_ESI]; 245 (*regs)[4] = env->regs[R_EDI]; 246 (*regs)[5] = env->regs[R_EBP]; 247 (*regs)[6] = env->regs[R_EAX]; 248 (*regs)[7] = env->segs[R_DS].selector & 0xffff; 249 (*regs)[8] = env->segs[R_ES].selector & 0xffff; 250 (*regs)[9] = env->segs[R_FS].selector & 0xffff; 251 (*regs)[10] = env->segs[R_GS].selector & 0xffff; 252 (*regs)[11] = env->regs[R_EAX]; /* XXX */ 253 (*regs)[12] = env->eip; 254 (*regs)[13] = env->segs[R_CS].selector & 0xffff; 255 (*regs)[14] = env->eflags; 256 (*regs)[15] = env->regs[R_ESP]; 257 (*regs)[16] = env->segs[R_SS].selector & 0xffff; 258 } 259 #endif 260 261 #define USE_ELF_CORE_DUMP 262 #define ELF_EXEC_PAGESIZE 4096 263 264 #endif 265 266 #ifdef TARGET_ARM 267 268 #define ELF_START_MMAP 0x80000000 269 270 #define elf_check_arch(x) ( (x) == EM_ARM ) 271 272 #define ELF_CLASS ELFCLASS32 273 #define ELF_ARCH EM_ARM 274 275 static inline void init_thread(struct target_pt_regs *regs, 276 struct image_info *infop) 277 { 278 abi_long stack = infop->start_stack; 279 memset(regs, 0, sizeof(*regs)); 280 regs->ARM_cpsr = 0x10; 281 if (infop->entry & 1) 282 regs->ARM_cpsr |= CPSR_T; 283 regs->ARM_pc = infop->entry & 0xfffffffe; 284 regs->ARM_sp = infop->start_stack; 285 /* FIXME - what to for failure of get_user()? */ 286 get_user_ual(regs->ARM_r2, stack + 8); /* envp */ 287 get_user_ual(regs->ARM_r1, stack + 4); /* envp */ 288 /* XXX: it seems that r0 is zeroed after ! */ 289 regs->ARM_r0 = 0; 290 /* For uClinux PIC binaries. */ 291 /* XXX: Linux does this only on ARM with no MMU (do we care ?) */ 292 regs->ARM_r10 = infop->start_data; 293 } 294 295 #define ELF_NREG 18 296 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG]; 297 298 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUARMState *env) 299 { 300 (*regs)[0] = tswapreg(env->regs[0]); 301 (*regs)[1] = tswapreg(env->regs[1]); 302 (*regs)[2] = tswapreg(env->regs[2]); 303 (*regs)[3] = tswapreg(env->regs[3]); 304 (*regs)[4] = tswapreg(env->regs[4]); 305 (*regs)[5] = tswapreg(env->regs[5]); 306 (*regs)[6] = tswapreg(env->regs[6]); 307 (*regs)[7] = tswapreg(env->regs[7]); 308 (*regs)[8] = tswapreg(env->regs[8]); 309 (*regs)[9] = tswapreg(env->regs[9]); 310 (*regs)[10] = tswapreg(env->regs[10]); 311 (*regs)[11] = tswapreg(env->regs[11]); 312 (*regs)[12] = tswapreg(env->regs[12]); 313 (*regs)[13] = tswapreg(env->regs[13]); 314 (*regs)[14] = tswapreg(env->regs[14]); 315 (*regs)[15] = tswapreg(env->regs[15]); 316 317 (*regs)[16] = tswapreg(cpsr_read((CPUARMState *)env)); 318 (*regs)[17] = tswapreg(env->regs[0]); /* XXX */ 319 } 320 321 #define USE_ELF_CORE_DUMP 322 #define ELF_EXEC_PAGESIZE 4096 323 324 enum 325 { 326 ARM_HWCAP_ARM_SWP = 1 << 0, 327 ARM_HWCAP_ARM_HALF = 1 << 1, 328 ARM_HWCAP_ARM_THUMB = 1 << 2, 329 ARM_HWCAP_ARM_26BIT = 1 << 3, 330 ARM_HWCAP_ARM_FAST_MULT = 1 << 4, 331 ARM_HWCAP_ARM_FPA = 1 << 5, 332 ARM_HWCAP_ARM_VFP = 1 << 6, 333 ARM_HWCAP_ARM_EDSP = 1 << 7, 334 ARM_HWCAP_ARM_JAVA = 1 << 8, 335 ARM_HWCAP_ARM_IWMMXT = 1 << 9, 336 ARM_HWCAP_ARM_THUMBEE = 1 << 10, 337 ARM_HWCAP_ARM_NEON = 1 << 11, 338 ARM_HWCAP_ARM_VFPv3 = 1 << 12, 339 ARM_HWCAP_ARM_VFPv3D16 = 1 << 13, 340 }; 341 342 #define TARGET_HAS_VALIDATE_GUEST_SPACE 343 /* Return 1 if the proposed guest space is suitable for the guest. 344 * Return 0 if the proposed guest space isn't suitable, but another 345 * address space should be tried. 346 * Return -1 if there is no way the proposed guest space can be 347 * valid regardless of the base. 348 * The guest code may leave a page mapped and populate it if the 349 * address is suitable. 350 */ 351 static int validate_guest_space(unsigned long guest_base, 352 unsigned long guest_size) 353 { 354 unsigned long real_start, test_page_addr; 355 356 /* We need to check that we can force a fault on access to the 357 * commpage at 0xffff0fxx 358 */ 359 test_page_addr = guest_base + (0xffff0f00 & qemu_host_page_mask); 360 361 /* If the commpage lies within the already allocated guest space, 362 * then there is no way we can allocate it. 363 */ 364 if (test_page_addr >= guest_base 365 && test_page_addr <= (guest_base + guest_size)) { 366 return -1; 367 } 368 369 /* Note it needs to be writeable to let us initialise it */ 370 real_start = (unsigned long) 371 mmap((void *)test_page_addr, qemu_host_page_size, 372 PROT_READ | PROT_WRITE, 373 MAP_ANONYMOUS | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); 374 375 /* If we can't map it then try another address */ 376 if (real_start == -1ul) { 377 return 0; 378 } 379 380 if (real_start != test_page_addr) { 381 /* OS didn't put the page where we asked - unmap and reject */ 382 munmap((void *)real_start, qemu_host_page_size); 383 return 0; 384 } 385 386 /* Leave the page mapped 387 * Populate it (mmap should have left it all 0'd) 388 */ 389 390 /* Kernel helper versions */ 391 __put_user(5, (uint32_t *)g2h(0xffff0ffcul)); 392 393 /* Now it's populated make it RO */ 394 if (mprotect((void *)test_page_addr, qemu_host_page_size, PROT_READ)) { 395 perror("Protecting guest commpage"); 396 exit(-1); 397 } 398 399 return 1; /* All good */ 400 } 401 402 403 #define ELF_HWCAP get_elf_hwcap() 404 405 static uint32_t get_elf_hwcap(void) 406 { 407 CPUARMState *e = thread_env; 408 uint32_t hwcaps = 0; 409 410 hwcaps |= ARM_HWCAP_ARM_SWP; 411 hwcaps |= ARM_HWCAP_ARM_HALF; 412 hwcaps |= ARM_HWCAP_ARM_THUMB; 413 hwcaps |= ARM_HWCAP_ARM_FAST_MULT; 414 hwcaps |= ARM_HWCAP_ARM_FPA; 415 416 /* probe for the extra features */ 417 #define GET_FEATURE(feat, hwcap) \ 418 do {if (arm_feature(e, feat)) { hwcaps |= hwcap; } } while (0) 419 GET_FEATURE(ARM_FEATURE_VFP, ARM_HWCAP_ARM_VFP); 420 GET_FEATURE(ARM_FEATURE_IWMMXT, ARM_HWCAP_ARM_IWMMXT); 421 GET_FEATURE(ARM_FEATURE_THUMB2EE, ARM_HWCAP_ARM_THUMBEE); 422 GET_FEATURE(ARM_FEATURE_NEON, ARM_HWCAP_ARM_NEON); 423 GET_FEATURE(ARM_FEATURE_VFP3, ARM_HWCAP_ARM_VFPv3); 424 GET_FEATURE(ARM_FEATURE_VFP_FP16, ARM_HWCAP_ARM_VFPv3D16); 425 #undef GET_FEATURE 426 427 return hwcaps; 428 } 429 430 #endif 431 432 #ifdef TARGET_UNICORE32 433 434 #define ELF_START_MMAP 0x80000000 435 436 #define elf_check_arch(x) ((x) == EM_UNICORE32) 437 438 #define ELF_CLASS ELFCLASS32 439 #define ELF_DATA ELFDATA2LSB 440 #define ELF_ARCH EM_UNICORE32 441 442 static inline void init_thread(struct target_pt_regs *regs, 443 struct image_info *infop) 444 { 445 abi_long stack = infop->start_stack; 446 memset(regs, 0, sizeof(*regs)); 447 regs->UC32_REG_asr = 0x10; 448 regs->UC32_REG_pc = infop->entry & 0xfffffffe; 449 regs->UC32_REG_sp = infop->start_stack; 450 /* FIXME - what to for failure of get_user()? */ 451 get_user_ual(regs->UC32_REG_02, stack + 8); /* envp */ 452 get_user_ual(regs->UC32_REG_01, stack + 4); /* envp */ 453 /* XXX: it seems that r0 is zeroed after ! */ 454 regs->UC32_REG_00 = 0; 455 } 456 457 #define ELF_NREG 34 458 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG]; 459 460 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUUniCore32State *env) 461 { 462 (*regs)[0] = env->regs[0]; 463 (*regs)[1] = env->regs[1]; 464 (*regs)[2] = env->regs[2]; 465 (*regs)[3] = env->regs[3]; 466 (*regs)[4] = env->regs[4]; 467 (*regs)[5] = env->regs[5]; 468 (*regs)[6] = env->regs[6]; 469 (*regs)[7] = env->regs[7]; 470 (*regs)[8] = env->regs[8]; 471 (*regs)[9] = env->regs[9]; 472 (*regs)[10] = env->regs[10]; 473 (*regs)[11] = env->regs[11]; 474 (*regs)[12] = env->regs[12]; 475 (*regs)[13] = env->regs[13]; 476 (*regs)[14] = env->regs[14]; 477 (*regs)[15] = env->regs[15]; 478 (*regs)[16] = env->regs[16]; 479 (*regs)[17] = env->regs[17]; 480 (*regs)[18] = env->regs[18]; 481 (*regs)[19] = env->regs[19]; 482 (*regs)[20] = env->regs[20]; 483 (*regs)[21] = env->regs[21]; 484 (*regs)[22] = env->regs[22]; 485 (*regs)[23] = env->regs[23]; 486 (*regs)[24] = env->regs[24]; 487 (*regs)[25] = env->regs[25]; 488 (*regs)[26] = env->regs[26]; 489 (*regs)[27] = env->regs[27]; 490 (*regs)[28] = env->regs[28]; 491 (*regs)[29] = env->regs[29]; 492 (*regs)[30] = env->regs[30]; 493 (*regs)[31] = env->regs[31]; 494 495 (*regs)[32] = cpu_asr_read((CPUUniCore32State *)env); 496 (*regs)[33] = env->regs[0]; /* XXX */ 497 } 498 499 #define USE_ELF_CORE_DUMP 500 #define ELF_EXEC_PAGESIZE 4096 501 502 #define ELF_HWCAP (UC32_HWCAP_CMOV | UC32_HWCAP_UCF64) 503 504 #endif 505 506 #ifdef TARGET_SPARC 507 #ifdef TARGET_SPARC64 508 509 #define ELF_START_MMAP 0x80000000 510 #define ELF_HWCAP (HWCAP_SPARC_FLUSH | HWCAP_SPARC_STBAR | HWCAP_SPARC_SWAP \ 511 | HWCAP_SPARC_MULDIV | HWCAP_SPARC_V9) 512 #ifndef TARGET_ABI32 513 #define elf_check_arch(x) ( (x) == EM_SPARCV9 || (x) == EM_SPARC32PLUS ) 514 #else 515 #define elf_check_arch(x) ( (x) == EM_SPARC32PLUS || (x) == EM_SPARC ) 516 #endif 517 518 #define ELF_CLASS ELFCLASS64 519 #define ELF_ARCH EM_SPARCV9 520 521 #define STACK_BIAS 2047 522 523 static inline void init_thread(struct target_pt_regs *regs, 524 struct image_info *infop) 525 { 526 #ifndef TARGET_ABI32 527 regs->tstate = 0; 528 #endif 529 regs->pc = infop->entry; 530 regs->npc = regs->pc + 4; 531 regs->y = 0; 532 #ifdef TARGET_ABI32 533 regs->u_regs[14] = infop->start_stack - 16 * 4; 534 #else 535 if (personality(infop->personality) == PER_LINUX32) 536 regs->u_regs[14] = infop->start_stack - 16 * 4; 537 else 538 regs->u_regs[14] = infop->start_stack - 16 * 8 - STACK_BIAS; 539 #endif 540 } 541 542 #else 543 #define ELF_START_MMAP 0x80000000 544 #define ELF_HWCAP (HWCAP_SPARC_FLUSH | HWCAP_SPARC_STBAR | HWCAP_SPARC_SWAP \ 545 | HWCAP_SPARC_MULDIV) 546 #define elf_check_arch(x) ( (x) == EM_SPARC ) 547 548 #define ELF_CLASS ELFCLASS32 549 #define ELF_ARCH EM_SPARC 550 551 static inline void init_thread(struct target_pt_regs *regs, 552 struct image_info *infop) 553 { 554 regs->psr = 0; 555 regs->pc = infop->entry; 556 regs->npc = regs->pc + 4; 557 regs->y = 0; 558 regs->u_regs[14] = infop->start_stack - 16 * 4; 559 } 560 561 #endif 562 #endif 563 564 #ifdef TARGET_PPC 565 566 #define ELF_START_MMAP 0x80000000 567 568 #if defined(TARGET_PPC64) && !defined(TARGET_ABI32) 569 570 #define elf_check_arch(x) ( (x) == EM_PPC64 ) 571 572 #define ELF_CLASS ELFCLASS64 573 574 #else 575 576 #define elf_check_arch(x) ( (x) == EM_PPC ) 577 578 #define ELF_CLASS ELFCLASS32 579 580 #endif 581 582 #define ELF_ARCH EM_PPC 583 584 /* Feature masks for the Aux Vector Hardware Capabilities (AT_HWCAP). 585 See arch/powerpc/include/asm/cputable.h. */ 586 enum { 587 QEMU_PPC_FEATURE_32 = 0x80000000, 588 QEMU_PPC_FEATURE_64 = 0x40000000, 589 QEMU_PPC_FEATURE_601_INSTR = 0x20000000, 590 QEMU_PPC_FEATURE_HAS_ALTIVEC = 0x10000000, 591 QEMU_PPC_FEATURE_HAS_FPU = 0x08000000, 592 QEMU_PPC_FEATURE_HAS_MMU = 0x04000000, 593 QEMU_PPC_FEATURE_HAS_4xxMAC = 0x02000000, 594 QEMU_PPC_FEATURE_UNIFIED_CACHE = 0x01000000, 595 QEMU_PPC_FEATURE_HAS_SPE = 0x00800000, 596 QEMU_PPC_FEATURE_HAS_EFP_SINGLE = 0x00400000, 597 QEMU_PPC_FEATURE_HAS_EFP_DOUBLE = 0x00200000, 598 QEMU_PPC_FEATURE_NO_TB = 0x00100000, 599 QEMU_PPC_FEATURE_POWER4 = 0x00080000, 600 QEMU_PPC_FEATURE_POWER5 = 0x00040000, 601 QEMU_PPC_FEATURE_POWER5_PLUS = 0x00020000, 602 QEMU_PPC_FEATURE_CELL = 0x00010000, 603 QEMU_PPC_FEATURE_BOOKE = 0x00008000, 604 QEMU_PPC_FEATURE_SMT = 0x00004000, 605 QEMU_PPC_FEATURE_ICACHE_SNOOP = 0x00002000, 606 QEMU_PPC_FEATURE_ARCH_2_05 = 0x00001000, 607 QEMU_PPC_FEATURE_PA6T = 0x00000800, 608 QEMU_PPC_FEATURE_HAS_DFP = 0x00000400, 609 QEMU_PPC_FEATURE_POWER6_EXT = 0x00000200, 610 QEMU_PPC_FEATURE_ARCH_2_06 = 0x00000100, 611 QEMU_PPC_FEATURE_HAS_VSX = 0x00000080, 612 QEMU_PPC_FEATURE_PSERIES_PERFMON_COMPAT = 0x00000040, 613 614 QEMU_PPC_FEATURE_TRUE_LE = 0x00000002, 615 QEMU_PPC_FEATURE_PPC_LE = 0x00000001, 616 }; 617 618 #define ELF_HWCAP get_elf_hwcap() 619 620 static uint32_t get_elf_hwcap(void) 621 { 622 CPUPPCState *e = thread_env; 623 uint32_t features = 0; 624 625 /* We don't have to be terribly complete here; the high points are 626 Altivec/FP/SPE support. Anything else is just a bonus. */ 627 #define GET_FEATURE(flag, feature) \ 628 do {if (e->insns_flags & flag) features |= feature; } while(0) 629 GET_FEATURE(PPC_64B, QEMU_PPC_FEATURE_64); 630 GET_FEATURE(PPC_FLOAT, QEMU_PPC_FEATURE_HAS_FPU); 631 GET_FEATURE(PPC_ALTIVEC, QEMU_PPC_FEATURE_HAS_ALTIVEC); 632 GET_FEATURE(PPC_SPE, QEMU_PPC_FEATURE_HAS_SPE); 633 GET_FEATURE(PPC_SPE_SINGLE, QEMU_PPC_FEATURE_HAS_EFP_SINGLE); 634 GET_FEATURE(PPC_SPE_DOUBLE, QEMU_PPC_FEATURE_HAS_EFP_DOUBLE); 635 GET_FEATURE(PPC_BOOKE, QEMU_PPC_FEATURE_BOOKE); 636 GET_FEATURE(PPC_405_MAC, QEMU_PPC_FEATURE_HAS_4xxMAC); 637 #undef GET_FEATURE 638 639 return features; 640 } 641 642 /* 643 * The requirements here are: 644 * - keep the final alignment of sp (sp & 0xf) 645 * - make sure the 32-bit value at the first 16 byte aligned position of 646 * AUXV is greater than 16 for glibc compatibility. 647 * AT_IGNOREPPC is used for that. 648 * - for compatibility with glibc ARCH_DLINFO must always be defined on PPC, 649 * even if DLINFO_ARCH_ITEMS goes to zero or is undefined. 650 */ 651 #define DLINFO_ARCH_ITEMS 5 652 #define ARCH_DLINFO \ 653 do { \ 654 NEW_AUX_ENT(AT_DCACHEBSIZE, 0x20); \ 655 NEW_AUX_ENT(AT_ICACHEBSIZE, 0x20); \ 656 NEW_AUX_ENT(AT_UCACHEBSIZE, 0); \ 657 /* \ 658 * Now handle glibc compatibility. \ 659 */ \ 660 NEW_AUX_ENT(AT_IGNOREPPC, AT_IGNOREPPC); \ 661 NEW_AUX_ENT(AT_IGNOREPPC, AT_IGNOREPPC); \ 662 } while (0) 663 664 static inline void init_thread(struct target_pt_regs *_regs, struct image_info *infop) 665 { 666 _regs->gpr[1] = infop->start_stack; 667 #if defined(TARGET_PPC64) && !defined(TARGET_ABI32) 668 _regs->gpr[2] = ldq_raw(infop->entry + 8) + infop->load_bias; 669 infop->entry = ldq_raw(infop->entry) + infop->load_bias; 670 #endif 671 _regs->nip = infop->entry; 672 } 673 674 /* See linux kernel: arch/powerpc/include/asm/elf.h. */ 675 #define ELF_NREG 48 676 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG]; 677 678 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUPPCState *env) 679 { 680 int i; 681 target_ulong ccr = 0; 682 683 for (i = 0; i < ARRAY_SIZE(env->gpr); i++) { 684 (*regs)[i] = tswapreg(env->gpr[i]); 685 } 686 687 (*regs)[32] = tswapreg(env->nip); 688 (*regs)[33] = tswapreg(env->msr); 689 (*regs)[35] = tswapreg(env->ctr); 690 (*regs)[36] = tswapreg(env->lr); 691 (*regs)[37] = tswapreg(env->xer); 692 693 for (i = 0; i < ARRAY_SIZE(env->crf); i++) { 694 ccr |= env->crf[i] << (32 - ((i + 1) * 4)); 695 } 696 (*regs)[38] = tswapreg(ccr); 697 } 698 699 #define USE_ELF_CORE_DUMP 700 #define ELF_EXEC_PAGESIZE 4096 701 702 #endif 703 704 #ifdef TARGET_MIPS 705 706 #define ELF_START_MMAP 0x80000000 707 708 #define elf_check_arch(x) ( (x) == EM_MIPS ) 709 710 #ifdef TARGET_MIPS64 711 #define ELF_CLASS ELFCLASS64 712 #else 713 #define ELF_CLASS ELFCLASS32 714 #endif 715 #define ELF_ARCH EM_MIPS 716 717 static inline void init_thread(struct target_pt_regs *regs, 718 struct image_info *infop) 719 { 720 regs->cp0_status = 2 << CP0St_KSU; 721 regs->cp0_epc = infop->entry; 722 regs->regs[29] = infop->start_stack; 723 } 724 725 /* See linux kernel: arch/mips/include/asm/elf.h. */ 726 #define ELF_NREG 45 727 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG]; 728 729 /* See linux kernel: arch/mips/include/asm/reg.h. */ 730 enum { 731 #ifdef TARGET_MIPS64 732 TARGET_EF_R0 = 0, 733 #else 734 TARGET_EF_R0 = 6, 735 #endif 736 TARGET_EF_R26 = TARGET_EF_R0 + 26, 737 TARGET_EF_R27 = TARGET_EF_R0 + 27, 738 TARGET_EF_LO = TARGET_EF_R0 + 32, 739 TARGET_EF_HI = TARGET_EF_R0 + 33, 740 TARGET_EF_CP0_EPC = TARGET_EF_R0 + 34, 741 TARGET_EF_CP0_BADVADDR = TARGET_EF_R0 + 35, 742 TARGET_EF_CP0_STATUS = TARGET_EF_R0 + 36, 743 TARGET_EF_CP0_CAUSE = TARGET_EF_R0 + 37 744 }; 745 746 /* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs. */ 747 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMIPSState *env) 748 { 749 int i; 750 751 for (i = 0; i < TARGET_EF_R0; i++) { 752 (*regs)[i] = 0; 753 } 754 (*regs)[TARGET_EF_R0] = 0; 755 756 for (i = 1; i < ARRAY_SIZE(env->active_tc.gpr); i++) { 757 (*regs)[TARGET_EF_R0 + i] = tswapreg(env->active_tc.gpr[i]); 758 } 759 760 (*regs)[TARGET_EF_R26] = 0; 761 (*regs)[TARGET_EF_R27] = 0; 762 (*regs)[TARGET_EF_LO] = tswapreg(env->active_tc.LO[0]); 763 (*regs)[TARGET_EF_HI] = tswapreg(env->active_tc.HI[0]); 764 (*regs)[TARGET_EF_CP0_EPC] = tswapreg(env->active_tc.PC); 765 (*regs)[TARGET_EF_CP0_BADVADDR] = tswapreg(env->CP0_BadVAddr); 766 (*regs)[TARGET_EF_CP0_STATUS] = tswapreg(env->CP0_Status); 767 (*regs)[TARGET_EF_CP0_CAUSE] = tswapreg(env->CP0_Cause); 768 } 769 770 #define USE_ELF_CORE_DUMP 771 #define ELF_EXEC_PAGESIZE 4096 772 773 #endif /* TARGET_MIPS */ 774 775 #ifdef TARGET_MICROBLAZE 776 777 #define ELF_START_MMAP 0x80000000 778 779 #define elf_check_arch(x) ( (x) == EM_MICROBLAZE || (x) == EM_MICROBLAZE_OLD) 780 781 #define ELF_CLASS ELFCLASS32 782 #define ELF_ARCH EM_MICROBLAZE 783 784 static inline void init_thread(struct target_pt_regs *regs, 785 struct image_info *infop) 786 { 787 regs->pc = infop->entry; 788 regs->r1 = infop->start_stack; 789 790 } 791 792 #define ELF_EXEC_PAGESIZE 4096 793 794 #define USE_ELF_CORE_DUMP 795 #define ELF_NREG 38 796 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG]; 797 798 /* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs. */ 799 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMBState *env) 800 { 801 int i, pos = 0; 802 803 for (i = 0; i < 32; i++) { 804 (*regs)[pos++] = tswapreg(env->regs[i]); 805 } 806 807 for (i = 0; i < 6; i++) { 808 (*regs)[pos++] = tswapreg(env->sregs[i]); 809 } 810 } 811 812 #endif /* TARGET_MICROBLAZE */ 813 814 #ifdef TARGET_OPENRISC 815 816 #define ELF_START_MMAP 0x08000000 817 818 #define elf_check_arch(x) ((x) == EM_OPENRISC) 819 820 #define ELF_ARCH EM_OPENRISC 821 #define ELF_CLASS ELFCLASS32 822 #define ELF_DATA ELFDATA2MSB 823 824 static inline void init_thread(struct target_pt_regs *regs, 825 struct image_info *infop) 826 { 827 regs->pc = infop->entry; 828 regs->gpr[1] = infop->start_stack; 829 } 830 831 #define USE_ELF_CORE_DUMP 832 #define ELF_EXEC_PAGESIZE 8192 833 834 /* See linux kernel arch/openrisc/include/asm/elf.h. */ 835 #define ELF_NREG 34 /* gprs and pc, sr */ 836 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG]; 837 838 static void elf_core_copy_regs(target_elf_gregset_t *regs, 839 const CPUOpenRISCState *env) 840 { 841 int i; 842 843 for (i = 0; i < 32; i++) { 844 (*regs)[i] = tswapreg(env->gpr[i]); 845 } 846 847 (*regs)[32] = tswapreg(env->pc); 848 (*regs)[33] = tswapreg(env->sr); 849 } 850 #define ELF_HWCAP 0 851 #define ELF_PLATFORM NULL 852 853 #endif /* TARGET_OPENRISC */ 854 855 #ifdef TARGET_SH4 856 857 #define ELF_START_MMAP 0x80000000 858 859 #define elf_check_arch(x) ( (x) == EM_SH ) 860 861 #define ELF_CLASS ELFCLASS32 862 #define ELF_ARCH EM_SH 863 864 static inline void init_thread(struct target_pt_regs *regs, 865 struct image_info *infop) 866 { 867 /* Check other registers XXXXX */ 868 regs->pc = infop->entry; 869 regs->regs[15] = infop->start_stack; 870 } 871 872 /* See linux kernel: arch/sh/include/asm/elf.h. */ 873 #define ELF_NREG 23 874 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG]; 875 876 /* See linux kernel: arch/sh/include/asm/ptrace.h. */ 877 enum { 878 TARGET_REG_PC = 16, 879 TARGET_REG_PR = 17, 880 TARGET_REG_SR = 18, 881 TARGET_REG_GBR = 19, 882 TARGET_REG_MACH = 20, 883 TARGET_REG_MACL = 21, 884 TARGET_REG_SYSCALL = 22 885 }; 886 887 static inline void elf_core_copy_regs(target_elf_gregset_t *regs, 888 const CPUSH4State *env) 889 { 890 int i; 891 892 for (i = 0; i < 16; i++) { 893 (*regs[i]) = tswapreg(env->gregs[i]); 894 } 895 896 (*regs)[TARGET_REG_PC] = tswapreg(env->pc); 897 (*regs)[TARGET_REG_PR] = tswapreg(env->pr); 898 (*regs)[TARGET_REG_SR] = tswapreg(env->sr); 899 (*regs)[TARGET_REG_GBR] = tswapreg(env->gbr); 900 (*regs)[TARGET_REG_MACH] = tswapreg(env->mach); 901 (*regs)[TARGET_REG_MACL] = tswapreg(env->macl); 902 (*regs)[TARGET_REG_SYSCALL] = 0; /* FIXME */ 903 } 904 905 #define USE_ELF_CORE_DUMP 906 #define ELF_EXEC_PAGESIZE 4096 907 908 #endif 909 910 #ifdef TARGET_CRIS 911 912 #define ELF_START_MMAP 0x80000000 913 914 #define elf_check_arch(x) ( (x) == EM_CRIS ) 915 916 #define ELF_CLASS ELFCLASS32 917 #define ELF_ARCH EM_CRIS 918 919 static inline void init_thread(struct target_pt_regs *regs, 920 struct image_info *infop) 921 { 922 regs->erp = infop->entry; 923 } 924 925 #define ELF_EXEC_PAGESIZE 8192 926 927 #endif 928 929 #ifdef TARGET_M68K 930 931 #define ELF_START_MMAP 0x80000000 932 933 #define elf_check_arch(x) ( (x) == EM_68K ) 934 935 #define ELF_CLASS ELFCLASS32 936 #define ELF_ARCH EM_68K 937 938 /* ??? Does this need to do anything? 939 #define ELF_PLAT_INIT(_r) */ 940 941 static inline void init_thread(struct target_pt_regs *regs, 942 struct image_info *infop) 943 { 944 regs->usp = infop->start_stack; 945 regs->sr = 0; 946 regs->pc = infop->entry; 947 } 948 949 /* See linux kernel: arch/m68k/include/asm/elf.h. */ 950 #define ELF_NREG 20 951 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG]; 952 953 static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUM68KState *env) 954 { 955 (*regs)[0] = tswapreg(env->dregs[1]); 956 (*regs)[1] = tswapreg(env->dregs[2]); 957 (*regs)[2] = tswapreg(env->dregs[3]); 958 (*regs)[3] = tswapreg(env->dregs[4]); 959 (*regs)[4] = tswapreg(env->dregs[5]); 960 (*regs)[5] = tswapreg(env->dregs[6]); 961 (*regs)[6] = tswapreg(env->dregs[7]); 962 (*regs)[7] = tswapreg(env->aregs[0]); 963 (*regs)[8] = tswapreg(env->aregs[1]); 964 (*regs)[9] = tswapreg(env->aregs[2]); 965 (*regs)[10] = tswapreg(env->aregs[3]); 966 (*regs)[11] = tswapreg(env->aregs[4]); 967 (*regs)[12] = tswapreg(env->aregs[5]); 968 (*regs)[13] = tswapreg(env->aregs[6]); 969 (*regs)[14] = tswapreg(env->dregs[0]); 970 (*regs)[15] = tswapreg(env->aregs[7]); 971 (*regs)[16] = tswapreg(env->dregs[0]); /* FIXME: orig_d0 */ 972 (*regs)[17] = tswapreg(env->sr); 973 (*regs)[18] = tswapreg(env->pc); 974 (*regs)[19] = 0; /* FIXME: regs->format | regs->vector */ 975 } 976 977 #define USE_ELF_CORE_DUMP 978 #define ELF_EXEC_PAGESIZE 8192 979 980 #endif 981 982 #ifdef TARGET_ALPHA 983 984 #define ELF_START_MMAP (0x30000000000ULL) 985 986 #define elf_check_arch(x) ( (x) == ELF_ARCH ) 987 988 #define ELF_CLASS ELFCLASS64 989 #define ELF_ARCH EM_ALPHA 990 991 static inline void init_thread(struct target_pt_regs *regs, 992 struct image_info *infop) 993 { 994 regs->pc = infop->entry; 995 regs->ps = 8; 996 regs->usp = infop->start_stack; 997 } 998 999 #define ELF_EXEC_PAGESIZE 8192 1000 1001 #endif /* TARGET_ALPHA */ 1002 1003 #ifdef TARGET_S390X 1004 1005 #define ELF_START_MMAP (0x20000000000ULL) 1006 1007 #define elf_check_arch(x) ( (x) == ELF_ARCH ) 1008 1009 #define ELF_CLASS ELFCLASS64 1010 #define ELF_DATA ELFDATA2MSB 1011 #define ELF_ARCH EM_S390 1012 1013 static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop) 1014 { 1015 regs->psw.addr = infop->entry; 1016 regs->psw.mask = PSW_MASK_64 | PSW_MASK_32; 1017 regs->gprs[15] = infop->start_stack; 1018 } 1019 1020 #endif /* TARGET_S390X */ 1021 1022 #ifndef ELF_PLATFORM 1023 #define ELF_PLATFORM (NULL) 1024 #endif 1025 1026 #ifndef ELF_HWCAP 1027 #define ELF_HWCAP 0 1028 #endif 1029 1030 #ifdef TARGET_ABI32 1031 #undef ELF_CLASS 1032 #define ELF_CLASS ELFCLASS32 1033 #undef bswaptls 1034 #define bswaptls(ptr) bswap32s(ptr) 1035 #endif 1036 1037 #include "elf.h" 1038 1039 struct exec 1040 { 1041 unsigned int a_info; /* Use macros N_MAGIC, etc for access */ 1042 unsigned int a_text; /* length of text, in bytes */ 1043 unsigned int a_data; /* length of data, in bytes */ 1044 unsigned int a_bss; /* length of uninitialized data area, in bytes */ 1045 unsigned int a_syms; /* length of symbol table data in file, in bytes */ 1046 unsigned int a_entry; /* start address */ 1047 unsigned int a_trsize; /* length of relocation info for text, in bytes */ 1048 unsigned int a_drsize; /* length of relocation info for data, in bytes */ 1049 }; 1050 1051 1052 #define N_MAGIC(exec) ((exec).a_info & 0xffff) 1053 #define OMAGIC 0407 1054 #define NMAGIC 0410 1055 #define ZMAGIC 0413 1056 #define QMAGIC 0314 1057 1058 /* Necessary parameters */ 1059 #define TARGET_ELF_EXEC_PAGESIZE TARGET_PAGE_SIZE 1060 #define TARGET_ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(TARGET_ELF_EXEC_PAGESIZE-1)) 1061 #define TARGET_ELF_PAGEOFFSET(_v) ((_v) & (TARGET_ELF_EXEC_PAGESIZE-1)) 1062 1063 #define DLINFO_ITEMS 13 1064 1065 static inline void memcpy_fromfs(void * to, const void * from, unsigned long n) 1066 { 1067 memcpy(to, from, n); 1068 } 1069 1070 #ifdef BSWAP_NEEDED 1071 static void bswap_ehdr(struct elfhdr *ehdr) 1072 { 1073 bswap16s(&ehdr->e_type); /* Object file type */ 1074 bswap16s(&ehdr->e_machine); /* Architecture */ 1075 bswap32s(&ehdr->e_version); /* Object file version */ 1076 bswaptls(&ehdr->e_entry); /* Entry point virtual address */ 1077 bswaptls(&ehdr->e_phoff); /* Program header table file offset */ 1078 bswaptls(&ehdr->e_shoff); /* Section header table file offset */ 1079 bswap32s(&ehdr->e_flags); /* Processor-specific flags */ 1080 bswap16s(&ehdr->e_ehsize); /* ELF header size in bytes */ 1081 bswap16s(&ehdr->e_phentsize); /* Program header table entry size */ 1082 bswap16s(&ehdr->e_phnum); /* Program header table entry count */ 1083 bswap16s(&ehdr->e_shentsize); /* Section header table entry size */ 1084 bswap16s(&ehdr->e_shnum); /* Section header table entry count */ 1085 bswap16s(&ehdr->e_shstrndx); /* Section header string table index */ 1086 } 1087 1088 static void bswap_phdr(struct elf_phdr *phdr, int phnum) 1089 { 1090 int i; 1091 for (i = 0; i < phnum; ++i, ++phdr) { 1092 bswap32s(&phdr->p_type); /* Segment type */ 1093 bswap32s(&phdr->p_flags); /* Segment flags */ 1094 bswaptls(&phdr->p_offset); /* Segment file offset */ 1095 bswaptls(&phdr->p_vaddr); /* Segment virtual address */ 1096 bswaptls(&phdr->p_paddr); /* Segment physical address */ 1097 bswaptls(&phdr->p_filesz); /* Segment size in file */ 1098 bswaptls(&phdr->p_memsz); /* Segment size in memory */ 1099 bswaptls(&phdr->p_align); /* Segment alignment */ 1100 } 1101 } 1102 1103 static void bswap_shdr(struct elf_shdr *shdr, int shnum) 1104 { 1105 int i; 1106 for (i = 0; i < shnum; ++i, ++shdr) { 1107 bswap32s(&shdr->sh_name); 1108 bswap32s(&shdr->sh_type); 1109 bswaptls(&shdr->sh_flags); 1110 bswaptls(&shdr->sh_addr); 1111 bswaptls(&shdr->sh_offset); 1112 bswaptls(&shdr->sh_size); 1113 bswap32s(&shdr->sh_link); 1114 bswap32s(&shdr->sh_info); 1115 bswaptls(&shdr->sh_addralign); 1116 bswaptls(&shdr->sh_entsize); 1117 } 1118 } 1119 1120 static void bswap_sym(struct elf_sym *sym) 1121 { 1122 bswap32s(&sym->st_name); 1123 bswaptls(&sym->st_value); 1124 bswaptls(&sym->st_size); 1125 bswap16s(&sym->st_shndx); 1126 } 1127 #else 1128 static inline void bswap_ehdr(struct elfhdr *ehdr) { } 1129 static inline void bswap_phdr(struct elf_phdr *phdr, int phnum) { } 1130 static inline void bswap_shdr(struct elf_shdr *shdr, int shnum) { } 1131 static inline void bswap_sym(struct elf_sym *sym) { } 1132 #endif 1133 1134 #ifdef USE_ELF_CORE_DUMP 1135 static int elf_core_dump(int, const CPUArchState *); 1136 #endif /* USE_ELF_CORE_DUMP */ 1137 static void load_symbols(struct elfhdr *hdr, int fd, abi_ulong load_bias); 1138 1139 /* Verify the portions of EHDR within E_IDENT for the target. 1140 This can be performed before bswapping the entire header. */ 1141 static bool elf_check_ident(struct elfhdr *ehdr) 1142 { 1143 return (ehdr->e_ident[EI_MAG0] == ELFMAG0 1144 && ehdr->e_ident[EI_MAG1] == ELFMAG1 1145 && ehdr->e_ident[EI_MAG2] == ELFMAG2 1146 && ehdr->e_ident[EI_MAG3] == ELFMAG3 1147 && ehdr->e_ident[EI_CLASS] == ELF_CLASS 1148 && ehdr->e_ident[EI_DATA] == ELF_DATA 1149 && ehdr->e_ident[EI_VERSION] == EV_CURRENT); 1150 } 1151 1152 /* Verify the portions of EHDR outside of E_IDENT for the target. 1153 This has to wait until after bswapping the header. */ 1154 static bool elf_check_ehdr(struct elfhdr *ehdr) 1155 { 1156 return (elf_check_arch(ehdr->e_machine) 1157 && ehdr->e_ehsize == sizeof(struct elfhdr) 1158 && ehdr->e_phentsize == sizeof(struct elf_phdr) 1159 && ehdr->e_shentsize == sizeof(struct elf_shdr) 1160 && (ehdr->e_type == ET_EXEC || ehdr->e_type == ET_DYN)); 1161 } 1162 1163 /* 1164 * 'copy_elf_strings()' copies argument/envelope strings from user 1165 * memory to free pages in kernel mem. These are in a format ready 1166 * to be put directly into the top of new user memory. 1167 * 1168 */ 1169 static abi_ulong copy_elf_strings(int argc,char ** argv, void **page, 1170 abi_ulong p) 1171 { 1172 char *tmp, *tmp1, *pag = NULL; 1173 int len, offset = 0; 1174 1175 if (!p) { 1176 return 0; /* bullet-proofing */ 1177 } 1178 while (argc-- > 0) { 1179 tmp = argv[argc]; 1180 if (!tmp) { 1181 fprintf(stderr, "VFS: argc is wrong"); 1182 exit(-1); 1183 } 1184 tmp1 = tmp; 1185 while (*tmp++); 1186 len = tmp - tmp1; 1187 if (p < len) { /* this shouldn't happen - 128kB */ 1188 return 0; 1189 } 1190 while (len) { 1191 --p; --tmp; --len; 1192 if (--offset < 0) { 1193 offset = p % TARGET_PAGE_SIZE; 1194 pag = (char *)page[p/TARGET_PAGE_SIZE]; 1195 if (!pag) { 1196 pag = g_try_malloc0(TARGET_PAGE_SIZE); 1197 page[p/TARGET_PAGE_SIZE] = pag; 1198 if (!pag) 1199 return 0; 1200 } 1201 } 1202 if (len == 0 || offset == 0) { 1203 *(pag + offset) = *tmp; 1204 } 1205 else { 1206 int bytes_to_copy = (len > offset) ? offset : len; 1207 tmp -= bytes_to_copy; 1208 p -= bytes_to_copy; 1209 offset -= bytes_to_copy; 1210 len -= bytes_to_copy; 1211 memcpy_fromfs(pag + offset, tmp, bytes_to_copy + 1); 1212 } 1213 } 1214 } 1215 return p; 1216 } 1217 1218 static abi_ulong setup_arg_pages(abi_ulong p, struct linux_binprm *bprm, 1219 struct image_info *info) 1220 { 1221 abi_ulong stack_base, size, error, guard; 1222 int i; 1223 1224 /* Create enough stack to hold everything. If we don't use 1225 it for args, we'll use it for something else. */ 1226 size = guest_stack_size; 1227 if (size < MAX_ARG_PAGES*TARGET_PAGE_SIZE) { 1228 size = MAX_ARG_PAGES*TARGET_PAGE_SIZE; 1229 } 1230 guard = TARGET_PAGE_SIZE; 1231 if (guard < qemu_real_host_page_size) { 1232 guard = qemu_real_host_page_size; 1233 } 1234 1235 error = target_mmap(0, size + guard, PROT_READ | PROT_WRITE, 1236 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); 1237 if (error == -1) { 1238 perror("mmap stack"); 1239 exit(-1); 1240 } 1241 1242 /* We reserve one extra page at the top of the stack as guard. */ 1243 target_mprotect(error, guard, PROT_NONE); 1244 1245 info->stack_limit = error + guard; 1246 stack_base = info->stack_limit + size - MAX_ARG_PAGES*TARGET_PAGE_SIZE; 1247 p += stack_base; 1248 1249 for (i = 0 ; i < MAX_ARG_PAGES ; i++) { 1250 if (bprm->page[i]) { 1251 info->rss++; 1252 /* FIXME - check return value of memcpy_to_target() for failure */ 1253 memcpy_to_target(stack_base, bprm->page[i], TARGET_PAGE_SIZE); 1254 g_free(bprm->page[i]); 1255 } 1256 stack_base += TARGET_PAGE_SIZE; 1257 } 1258 return p; 1259 } 1260 1261 /* Map and zero the bss. We need to explicitly zero any fractional pages 1262 after the data section (i.e. bss). */ 1263 static void zero_bss(abi_ulong elf_bss, abi_ulong last_bss, int prot) 1264 { 1265 uintptr_t host_start, host_map_start, host_end; 1266 1267 last_bss = TARGET_PAGE_ALIGN(last_bss); 1268 1269 /* ??? There is confusion between qemu_real_host_page_size and 1270 qemu_host_page_size here and elsewhere in target_mmap, which 1271 may lead to the end of the data section mapping from the file 1272 not being mapped. At least there was an explicit test and 1273 comment for that here, suggesting that "the file size must 1274 be known". The comment probably pre-dates the introduction 1275 of the fstat system call in target_mmap which does in fact 1276 find out the size. What isn't clear is if the workaround 1277 here is still actually needed. For now, continue with it, 1278 but merge it with the "normal" mmap that would allocate the bss. */ 1279 1280 host_start = (uintptr_t) g2h(elf_bss); 1281 host_end = (uintptr_t) g2h(last_bss); 1282 host_map_start = (host_start + qemu_real_host_page_size - 1); 1283 host_map_start &= -qemu_real_host_page_size; 1284 1285 if (host_map_start < host_end) { 1286 void *p = mmap((void *)host_map_start, host_end - host_map_start, 1287 prot, MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); 1288 if (p == MAP_FAILED) { 1289 perror("cannot mmap brk"); 1290 exit(-1); 1291 } 1292 1293 /* Since we didn't use target_mmap, make sure to record 1294 the validity of the pages with qemu. */ 1295 page_set_flags(elf_bss & TARGET_PAGE_MASK, last_bss, prot|PAGE_VALID); 1296 } 1297 1298 if (host_start < host_map_start) { 1299 memset((void *)host_start, 0, host_map_start - host_start); 1300 } 1301 } 1302 1303 #ifdef CONFIG_USE_FDPIC 1304 static abi_ulong loader_build_fdpic_loadmap(struct image_info *info, abi_ulong sp) 1305 { 1306 uint16_t n; 1307 struct elf32_fdpic_loadseg *loadsegs = info->loadsegs; 1308 1309 /* elf32_fdpic_loadseg */ 1310 n = info->nsegs; 1311 while (n--) { 1312 sp -= 12; 1313 put_user_u32(loadsegs[n].addr, sp+0); 1314 put_user_u32(loadsegs[n].p_vaddr, sp+4); 1315 put_user_u32(loadsegs[n].p_memsz, sp+8); 1316 } 1317 1318 /* elf32_fdpic_loadmap */ 1319 sp -= 4; 1320 put_user_u16(0, sp+0); /* version */ 1321 put_user_u16(info->nsegs, sp+2); /* nsegs */ 1322 1323 info->personality = PER_LINUX_FDPIC; 1324 info->loadmap_addr = sp; 1325 1326 return sp; 1327 } 1328 #endif 1329 1330 static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc, 1331 struct elfhdr *exec, 1332 struct image_info *info, 1333 struct image_info *interp_info) 1334 { 1335 abi_ulong sp; 1336 abi_ulong sp_auxv; 1337 int size; 1338 int i; 1339 abi_ulong u_rand_bytes; 1340 uint8_t k_rand_bytes[16]; 1341 abi_ulong u_platform; 1342 const char *k_platform; 1343 const int n = sizeof(elf_addr_t); 1344 1345 sp = p; 1346 1347 #ifdef CONFIG_USE_FDPIC 1348 /* Needs to be before we load the env/argc/... */ 1349 if (elf_is_fdpic(exec)) { 1350 /* Need 4 byte alignment for these structs */ 1351 sp &= ~3; 1352 sp = loader_build_fdpic_loadmap(info, sp); 1353 info->other_info = interp_info; 1354 if (interp_info) { 1355 interp_info->other_info = info; 1356 sp = loader_build_fdpic_loadmap(interp_info, sp); 1357 } 1358 } 1359 #endif 1360 1361 u_platform = 0; 1362 k_platform = ELF_PLATFORM; 1363 if (k_platform) { 1364 size_t len = strlen(k_platform) + 1; 1365 sp -= (len + n - 1) & ~(n - 1); 1366 u_platform = sp; 1367 /* FIXME - check return value of memcpy_to_target() for failure */ 1368 memcpy_to_target(sp, k_platform, len); 1369 } 1370 1371 /* 1372 * Generate 16 random bytes for userspace PRNG seeding (not 1373 * cryptically secure but it's not the aim of QEMU). 1374 */ 1375 srand((unsigned int) time(NULL)); 1376 for (i = 0; i < 16; i++) { 1377 k_rand_bytes[i] = rand(); 1378 } 1379 sp -= 16; 1380 u_rand_bytes = sp; 1381 /* FIXME - check return value of memcpy_to_target() for failure */ 1382 memcpy_to_target(sp, k_rand_bytes, 16); 1383 1384 /* 1385 * Force 16 byte _final_ alignment here for generality. 1386 */ 1387 sp = sp &~ (abi_ulong)15; 1388 size = (DLINFO_ITEMS + 1) * 2; 1389 if (k_platform) 1390 size += 2; 1391 #ifdef DLINFO_ARCH_ITEMS 1392 size += DLINFO_ARCH_ITEMS * 2; 1393 #endif 1394 size += envc + argc + 2; 1395 size += 1; /* argc itself */ 1396 size *= n; 1397 if (size & 15) 1398 sp -= 16 - (size & 15); 1399 1400 /* This is correct because Linux defines 1401 * elf_addr_t as Elf32_Off / Elf64_Off 1402 */ 1403 #define NEW_AUX_ENT(id, val) do { \ 1404 sp -= n; put_user_ual(val, sp); \ 1405 sp -= n; put_user_ual(id, sp); \ 1406 } while(0) 1407 1408 sp_auxv = sp; 1409 NEW_AUX_ENT (AT_NULL, 0); 1410 1411 /* There must be exactly DLINFO_ITEMS entries here. */ 1412 NEW_AUX_ENT(AT_PHDR, (abi_ulong)(info->load_addr + exec->e_phoff)); 1413 NEW_AUX_ENT(AT_PHENT, (abi_ulong)(sizeof (struct elf_phdr))); 1414 NEW_AUX_ENT(AT_PHNUM, (abi_ulong)(exec->e_phnum)); 1415 NEW_AUX_ENT(AT_PAGESZ, (abi_ulong)(TARGET_PAGE_SIZE)); 1416 NEW_AUX_ENT(AT_BASE, (abi_ulong)(interp_info ? interp_info->load_addr : 0)); 1417 NEW_AUX_ENT(AT_FLAGS, (abi_ulong)0); 1418 NEW_AUX_ENT(AT_ENTRY, info->entry); 1419 NEW_AUX_ENT(AT_UID, (abi_ulong) getuid()); 1420 NEW_AUX_ENT(AT_EUID, (abi_ulong) geteuid()); 1421 NEW_AUX_ENT(AT_GID, (abi_ulong) getgid()); 1422 NEW_AUX_ENT(AT_EGID, (abi_ulong) getegid()); 1423 NEW_AUX_ENT(AT_HWCAP, (abi_ulong) ELF_HWCAP); 1424 NEW_AUX_ENT(AT_CLKTCK, (abi_ulong) sysconf(_SC_CLK_TCK)); 1425 NEW_AUX_ENT(AT_RANDOM, (abi_ulong) u_rand_bytes); 1426 1427 if (k_platform) 1428 NEW_AUX_ENT(AT_PLATFORM, u_platform); 1429 #ifdef ARCH_DLINFO 1430 /* 1431 * ARCH_DLINFO must come last so platform specific code can enforce 1432 * special alignment requirements on the AUXV if necessary (eg. PPC). 1433 */ 1434 ARCH_DLINFO; 1435 #endif 1436 #undef NEW_AUX_ENT 1437 1438 info->saved_auxv = sp; 1439 info->auxv_len = sp_auxv - sp; 1440 1441 sp = loader_build_argptr(envc, argc, sp, p, 0); 1442 return sp; 1443 } 1444 1445 #ifndef TARGET_HAS_VALIDATE_GUEST_SPACE 1446 /* If the guest doesn't have a validation function just agree */ 1447 static int validate_guest_space(unsigned long guest_base, 1448 unsigned long guest_size) 1449 { 1450 return 1; 1451 } 1452 #endif 1453 1454 unsigned long init_guest_space(unsigned long host_start, 1455 unsigned long host_size, 1456 unsigned long guest_start, 1457 bool fixed) 1458 { 1459 unsigned long current_start, real_start; 1460 int flags; 1461 1462 assert(host_start || host_size); 1463 1464 /* If just a starting address is given, then just verify that 1465 * address. */ 1466 if (host_start && !host_size) { 1467 if (validate_guest_space(host_start, host_size) == 1) { 1468 return host_start; 1469 } else { 1470 return (unsigned long)-1; 1471 } 1472 } 1473 1474 /* Setup the initial flags and start address. */ 1475 current_start = host_start & qemu_host_page_mask; 1476 flags = MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE; 1477 if (fixed) { 1478 flags |= MAP_FIXED; 1479 } 1480 1481 /* Otherwise, a non-zero size region of memory needs to be mapped 1482 * and validated. */ 1483 while (1) { 1484 unsigned long real_size = host_size; 1485 1486 /* Do not use mmap_find_vma here because that is limited to the 1487 * guest address space. We are going to make the 1488 * guest address space fit whatever we're given. 1489 */ 1490 real_start = (unsigned long) 1491 mmap((void *)current_start, host_size, PROT_NONE, flags, -1, 0); 1492 if (real_start == (unsigned long)-1) { 1493 return (unsigned long)-1; 1494 } 1495 1496 /* Ensure the address is properly aligned. */ 1497 if (real_start & ~qemu_host_page_mask) { 1498 munmap((void *)real_start, host_size); 1499 real_size = host_size + qemu_host_page_size; 1500 real_start = (unsigned long) 1501 mmap((void *)real_start, real_size, PROT_NONE, flags, -1, 0); 1502 if (real_start == (unsigned long)-1) { 1503 return (unsigned long)-1; 1504 } 1505 real_start = HOST_PAGE_ALIGN(real_start); 1506 } 1507 1508 /* Check to see if the address is valid. */ 1509 if (!host_start || real_start == current_start) { 1510 int valid = validate_guest_space(real_start - guest_start, 1511 real_size); 1512 if (valid == 1) { 1513 break; 1514 } else if (valid == -1) { 1515 return (unsigned long)-1; 1516 } 1517 /* valid == 0, so try again. */ 1518 } 1519 1520 /* That address didn't work. Unmap and try a different one. 1521 * The address the host picked because is typically right at 1522 * the top of the host address space and leaves the guest with 1523 * no usable address space. Resort to a linear search. We 1524 * already compensated for mmap_min_addr, so this should not 1525 * happen often. Probably means we got unlucky and host 1526 * address space randomization put a shared library somewhere 1527 * inconvenient. 1528 */ 1529 munmap((void *)real_start, host_size); 1530 current_start += qemu_host_page_size; 1531 if (host_start == current_start) { 1532 /* Theoretically possible if host doesn't have any suitably 1533 * aligned areas. Normally the first mmap will fail. 1534 */ 1535 return (unsigned long)-1; 1536 } 1537 } 1538 1539 qemu_log("Reserved 0x%lx bytes of guest address space\n", host_size); 1540 1541 return real_start; 1542 } 1543 1544 static void probe_guest_base(const char *image_name, 1545 abi_ulong loaddr, abi_ulong hiaddr) 1546 { 1547 /* Probe for a suitable guest base address, if the user has not set 1548 * it explicitly, and set guest_base appropriately. 1549 * In case of error we will print a suitable message and exit. 1550 */ 1551 #if defined(CONFIG_USE_GUEST_BASE) 1552 const char *errmsg; 1553 if (!have_guest_base && !reserved_va) { 1554 unsigned long host_start, real_start, host_size; 1555 1556 /* Round addresses to page boundaries. */ 1557 loaddr &= qemu_host_page_mask; 1558 hiaddr = HOST_PAGE_ALIGN(hiaddr); 1559 1560 if (loaddr < mmap_min_addr) { 1561 host_start = HOST_PAGE_ALIGN(mmap_min_addr); 1562 } else { 1563 host_start = loaddr; 1564 if (host_start != loaddr) { 1565 errmsg = "Address overflow loading ELF binary"; 1566 goto exit_errmsg; 1567 } 1568 } 1569 host_size = hiaddr - loaddr; 1570 1571 /* Setup the initial guest memory space with ranges gleaned from 1572 * the ELF image that is being loaded. 1573 */ 1574 real_start = init_guest_space(host_start, host_size, loaddr, false); 1575 if (real_start == (unsigned long)-1) { 1576 errmsg = "Unable to find space for application"; 1577 goto exit_errmsg; 1578 } 1579 guest_base = real_start - loaddr; 1580 1581 qemu_log("Relocating guest address space from 0x" 1582 TARGET_ABI_FMT_lx " to 0x%lx\n", 1583 loaddr, real_start); 1584 } 1585 return; 1586 1587 exit_errmsg: 1588 fprintf(stderr, "%s: %s\n", image_name, errmsg); 1589 exit(-1); 1590 #endif 1591 } 1592 1593 1594 /* Load an ELF image into the address space. 1595 1596 IMAGE_NAME is the filename of the image, to use in error messages. 1597 IMAGE_FD is the open file descriptor for the image. 1598 1599 BPRM_BUF is a copy of the beginning of the file; this of course 1600 contains the elf file header at offset 0. It is assumed that this 1601 buffer is sufficiently aligned to present no problems to the host 1602 in accessing data at aligned offsets within the buffer. 1603 1604 On return: INFO values will be filled in, as necessary or available. */ 1605 1606 static void load_elf_image(const char *image_name, int image_fd, 1607 struct image_info *info, char **pinterp_name, 1608 char bprm_buf[BPRM_BUF_SIZE]) 1609 { 1610 struct elfhdr *ehdr = (struct elfhdr *)bprm_buf; 1611 struct elf_phdr *phdr; 1612 abi_ulong load_addr, load_bias, loaddr, hiaddr, error; 1613 int i, retval; 1614 const char *errmsg; 1615 1616 /* First of all, some simple consistency checks */ 1617 errmsg = "Invalid ELF image for this architecture"; 1618 if (!elf_check_ident(ehdr)) { 1619 goto exit_errmsg; 1620 } 1621 bswap_ehdr(ehdr); 1622 if (!elf_check_ehdr(ehdr)) { 1623 goto exit_errmsg; 1624 } 1625 1626 i = ehdr->e_phnum * sizeof(struct elf_phdr); 1627 if (ehdr->e_phoff + i <= BPRM_BUF_SIZE) { 1628 phdr = (struct elf_phdr *)(bprm_buf + ehdr->e_phoff); 1629 } else { 1630 phdr = (struct elf_phdr *) alloca(i); 1631 retval = pread(image_fd, phdr, i, ehdr->e_phoff); 1632 if (retval != i) { 1633 goto exit_read; 1634 } 1635 } 1636 bswap_phdr(phdr, ehdr->e_phnum); 1637 1638 #ifdef CONFIG_USE_FDPIC 1639 info->nsegs = 0; 1640 info->pt_dynamic_addr = 0; 1641 #endif 1642 1643 /* Find the maximum size of the image and allocate an appropriate 1644 amount of memory to handle that. */ 1645 loaddr = -1, hiaddr = 0; 1646 for (i = 0; i < ehdr->e_phnum; ++i) { 1647 if (phdr[i].p_type == PT_LOAD) { 1648 abi_ulong a = phdr[i].p_vaddr; 1649 if (a < loaddr) { 1650 loaddr = a; 1651 } 1652 a += phdr[i].p_memsz; 1653 if (a > hiaddr) { 1654 hiaddr = a; 1655 } 1656 #ifdef CONFIG_USE_FDPIC 1657 ++info->nsegs; 1658 #endif 1659 } 1660 } 1661 1662 load_addr = loaddr; 1663 if (ehdr->e_type == ET_DYN) { 1664 /* The image indicates that it can be loaded anywhere. Find a 1665 location that can hold the memory space required. If the 1666 image is pre-linked, LOADDR will be non-zero. Since we do 1667 not supply MAP_FIXED here we'll use that address if and 1668 only if it remains available. */ 1669 load_addr = target_mmap(loaddr, hiaddr - loaddr, PROT_NONE, 1670 MAP_PRIVATE | MAP_ANON | MAP_NORESERVE, 1671 -1, 0); 1672 if (load_addr == -1) { 1673 goto exit_perror; 1674 } 1675 } else if (pinterp_name != NULL) { 1676 /* This is the main executable. Make sure that the low 1677 address does not conflict with MMAP_MIN_ADDR or the 1678 QEMU application itself. */ 1679 probe_guest_base(image_name, loaddr, hiaddr); 1680 } 1681 load_bias = load_addr - loaddr; 1682 1683 #ifdef CONFIG_USE_FDPIC 1684 { 1685 struct elf32_fdpic_loadseg *loadsegs = info->loadsegs = 1686 g_malloc(sizeof(*loadsegs) * info->nsegs); 1687 1688 for (i = 0; i < ehdr->e_phnum; ++i) { 1689 switch (phdr[i].p_type) { 1690 case PT_DYNAMIC: 1691 info->pt_dynamic_addr = phdr[i].p_vaddr + load_bias; 1692 break; 1693 case PT_LOAD: 1694 loadsegs->addr = phdr[i].p_vaddr + load_bias; 1695 loadsegs->p_vaddr = phdr[i].p_vaddr; 1696 loadsegs->p_memsz = phdr[i].p_memsz; 1697 ++loadsegs; 1698 break; 1699 } 1700 } 1701 } 1702 #endif 1703 1704 info->load_bias = load_bias; 1705 info->load_addr = load_addr; 1706 info->entry = ehdr->e_entry + load_bias; 1707 info->start_code = -1; 1708 info->end_code = 0; 1709 info->start_data = -1; 1710 info->end_data = 0; 1711 info->brk = 0; 1712 info->elf_flags = ehdr->e_flags; 1713 1714 for (i = 0; i < ehdr->e_phnum; i++) { 1715 struct elf_phdr *eppnt = phdr + i; 1716 if (eppnt->p_type == PT_LOAD) { 1717 abi_ulong vaddr, vaddr_po, vaddr_ps, vaddr_ef, vaddr_em; 1718 int elf_prot = 0; 1719 1720 if (eppnt->p_flags & PF_R) elf_prot = PROT_READ; 1721 if (eppnt->p_flags & PF_W) elf_prot |= PROT_WRITE; 1722 if (eppnt->p_flags & PF_X) elf_prot |= PROT_EXEC; 1723 1724 vaddr = load_bias + eppnt->p_vaddr; 1725 vaddr_po = TARGET_ELF_PAGEOFFSET(vaddr); 1726 vaddr_ps = TARGET_ELF_PAGESTART(vaddr); 1727 1728 error = target_mmap(vaddr_ps, eppnt->p_filesz + vaddr_po, 1729 elf_prot, MAP_PRIVATE | MAP_FIXED, 1730 image_fd, eppnt->p_offset - vaddr_po); 1731 if (error == -1) { 1732 goto exit_perror; 1733 } 1734 1735 vaddr_ef = vaddr + eppnt->p_filesz; 1736 vaddr_em = vaddr + eppnt->p_memsz; 1737 1738 /* If the load segment requests extra zeros (e.g. bss), map it. */ 1739 if (vaddr_ef < vaddr_em) { 1740 zero_bss(vaddr_ef, vaddr_em, elf_prot); 1741 } 1742 1743 /* Find the full program boundaries. */ 1744 if (elf_prot & PROT_EXEC) { 1745 if (vaddr < info->start_code) { 1746 info->start_code = vaddr; 1747 } 1748 if (vaddr_ef > info->end_code) { 1749 info->end_code = vaddr_ef; 1750 } 1751 } 1752 if (elf_prot & PROT_WRITE) { 1753 if (vaddr < info->start_data) { 1754 info->start_data = vaddr; 1755 } 1756 if (vaddr_ef > info->end_data) { 1757 info->end_data = vaddr_ef; 1758 } 1759 if (vaddr_em > info->brk) { 1760 info->brk = vaddr_em; 1761 } 1762 } 1763 } else if (eppnt->p_type == PT_INTERP && pinterp_name) { 1764 char *interp_name; 1765 1766 if (*pinterp_name) { 1767 errmsg = "Multiple PT_INTERP entries"; 1768 goto exit_errmsg; 1769 } 1770 interp_name = malloc(eppnt->p_filesz); 1771 if (!interp_name) { 1772 goto exit_perror; 1773 } 1774 1775 if (eppnt->p_offset + eppnt->p_filesz <= BPRM_BUF_SIZE) { 1776 memcpy(interp_name, bprm_buf + eppnt->p_offset, 1777 eppnt->p_filesz); 1778 } else { 1779 retval = pread(image_fd, interp_name, eppnt->p_filesz, 1780 eppnt->p_offset); 1781 if (retval != eppnt->p_filesz) { 1782 goto exit_perror; 1783 } 1784 } 1785 if (interp_name[eppnt->p_filesz - 1] != 0) { 1786 errmsg = "Invalid PT_INTERP entry"; 1787 goto exit_errmsg; 1788 } 1789 *pinterp_name = interp_name; 1790 } 1791 } 1792 1793 if (info->end_data == 0) { 1794 info->start_data = info->end_code; 1795 info->end_data = info->end_code; 1796 info->brk = info->end_code; 1797 } 1798 1799 if (qemu_log_enabled()) { 1800 load_symbols(ehdr, image_fd, load_bias); 1801 } 1802 1803 close(image_fd); 1804 return; 1805 1806 exit_read: 1807 if (retval >= 0) { 1808 errmsg = "Incomplete read of file header"; 1809 goto exit_errmsg; 1810 } 1811 exit_perror: 1812 errmsg = strerror(errno); 1813 exit_errmsg: 1814 fprintf(stderr, "%s: %s\n", image_name, errmsg); 1815 exit(-1); 1816 } 1817 1818 static void load_elf_interp(const char *filename, struct image_info *info, 1819 char bprm_buf[BPRM_BUF_SIZE]) 1820 { 1821 int fd, retval; 1822 1823 fd = open(path(filename), O_RDONLY); 1824 if (fd < 0) { 1825 goto exit_perror; 1826 } 1827 1828 retval = read(fd, bprm_buf, BPRM_BUF_SIZE); 1829 if (retval < 0) { 1830 goto exit_perror; 1831 } 1832 if (retval < BPRM_BUF_SIZE) { 1833 memset(bprm_buf + retval, 0, BPRM_BUF_SIZE - retval); 1834 } 1835 1836 load_elf_image(filename, fd, info, NULL, bprm_buf); 1837 return; 1838 1839 exit_perror: 1840 fprintf(stderr, "%s: %s\n", filename, strerror(errno)); 1841 exit(-1); 1842 } 1843 1844 static int symfind(const void *s0, const void *s1) 1845 { 1846 target_ulong addr = *(target_ulong *)s0; 1847 struct elf_sym *sym = (struct elf_sym *)s1; 1848 int result = 0; 1849 if (addr < sym->st_value) { 1850 result = -1; 1851 } else if (addr >= sym->st_value + sym->st_size) { 1852 result = 1; 1853 } 1854 return result; 1855 } 1856 1857 static const char *lookup_symbolxx(struct syminfo *s, target_ulong orig_addr) 1858 { 1859 #if ELF_CLASS == ELFCLASS32 1860 struct elf_sym *syms = s->disas_symtab.elf32; 1861 #else 1862 struct elf_sym *syms = s->disas_symtab.elf64; 1863 #endif 1864 1865 // binary search 1866 struct elf_sym *sym; 1867 1868 sym = bsearch(&orig_addr, syms, s->disas_num_syms, sizeof(*syms), symfind); 1869 if (sym != NULL) { 1870 return s->disas_strtab + sym->st_name; 1871 } 1872 1873 return ""; 1874 } 1875 1876 /* FIXME: This should use elf_ops.h */ 1877 static int symcmp(const void *s0, const void *s1) 1878 { 1879 struct elf_sym *sym0 = (struct elf_sym *)s0; 1880 struct elf_sym *sym1 = (struct elf_sym *)s1; 1881 return (sym0->st_value < sym1->st_value) 1882 ? -1 1883 : ((sym0->st_value > sym1->st_value) ? 1 : 0); 1884 } 1885 1886 /* Best attempt to load symbols from this ELF object. */ 1887 static void load_symbols(struct elfhdr *hdr, int fd, abi_ulong load_bias) 1888 { 1889 int i, shnum, nsyms, sym_idx = 0, str_idx = 0; 1890 struct elf_shdr *shdr; 1891 char *strings = NULL; 1892 struct syminfo *s = NULL; 1893 struct elf_sym *new_syms, *syms = NULL; 1894 1895 shnum = hdr->e_shnum; 1896 i = shnum * sizeof(struct elf_shdr); 1897 shdr = (struct elf_shdr *)alloca(i); 1898 if (pread(fd, shdr, i, hdr->e_shoff) != i) { 1899 return; 1900 } 1901 1902 bswap_shdr(shdr, shnum); 1903 for (i = 0; i < shnum; ++i) { 1904 if (shdr[i].sh_type == SHT_SYMTAB) { 1905 sym_idx = i; 1906 str_idx = shdr[i].sh_link; 1907 goto found; 1908 } 1909 } 1910 1911 /* There will be no symbol table if the file was stripped. */ 1912 return; 1913 1914 found: 1915 /* Now know where the strtab and symtab are. Snarf them. */ 1916 s = malloc(sizeof(*s)); 1917 if (!s) { 1918 goto give_up; 1919 } 1920 1921 i = shdr[str_idx].sh_size; 1922 s->disas_strtab = strings = malloc(i); 1923 if (!strings || pread(fd, strings, i, shdr[str_idx].sh_offset) != i) { 1924 goto give_up; 1925 } 1926 1927 i = shdr[sym_idx].sh_size; 1928 syms = malloc(i); 1929 if (!syms || pread(fd, syms, i, shdr[sym_idx].sh_offset) != i) { 1930 goto give_up; 1931 } 1932 1933 nsyms = i / sizeof(struct elf_sym); 1934 for (i = 0; i < nsyms; ) { 1935 bswap_sym(syms + i); 1936 /* Throw away entries which we do not need. */ 1937 if (syms[i].st_shndx == SHN_UNDEF 1938 || syms[i].st_shndx >= SHN_LORESERVE 1939 || ELF_ST_TYPE(syms[i].st_info) != STT_FUNC) { 1940 if (i < --nsyms) { 1941 syms[i] = syms[nsyms]; 1942 } 1943 } else { 1944 #if defined(TARGET_ARM) || defined (TARGET_MIPS) 1945 /* The bottom address bit marks a Thumb or MIPS16 symbol. */ 1946 syms[i].st_value &= ~(target_ulong)1; 1947 #endif 1948 syms[i].st_value += load_bias; 1949 i++; 1950 } 1951 } 1952 1953 /* No "useful" symbol. */ 1954 if (nsyms == 0) { 1955 goto give_up; 1956 } 1957 1958 /* Attempt to free the storage associated with the local symbols 1959 that we threw away. Whether or not this has any effect on the 1960 memory allocation depends on the malloc implementation and how 1961 many symbols we managed to discard. */ 1962 new_syms = realloc(syms, nsyms * sizeof(*syms)); 1963 if (new_syms == NULL) { 1964 goto give_up; 1965 } 1966 syms = new_syms; 1967 1968 qsort(syms, nsyms, sizeof(*syms), symcmp); 1969 1970 s->disas_num_syms = nsyms; 1971 #if ELF_CLASS == ELFCLASS32 1972 s->disas_symtab.elf32 = syms; 1973 #else 1974 s->disas_symtab.elf64 = syms; 1975 #endif 1976 s->lookup_symbol = lookup_symbolxx; 1977 s->next = syminfos; 1978 syminfos = s; 1979 1980 return; 1981 1982 give_up: 1983 free(s); 1984 free(strings); 1985 free(syms); 1986 } 1987 1988 int load_elf_binary(struct linux_binprm * bprm, struct target_pt_regs * regs, 1989 struct image_info * info) 1990 { 1991 struct image_info interp_info; 1992 struct elfhdr elf_ex; 1993 char *elf_interpreter = NULL; 1994 1995 info->start_mmap = (abi_ulong)ELF_START_MMAP; 1996 info->mmap = 0; 1997 info->rss = 0; 1998 1999 load_elf_image(bprm->filename, bprm->fd, info, 2000 &elf_interpreter, bprm->buf); 2001 2002 /* ??? We need a copy of the elf header for passing to create_elf_tables. 2003 If we do nothing, we'll have overwritten this when we re-use bprm->buf 2004 when we load the interpreter. */ 2005 elf_ex = *(struct elfhdr *)bprm->buf; 2006 2007 bprm->p = copy_elf_strings(1, &bprm->filename, bprm->page, bprm->p); 2008 bprm->p = copy_elf_strings(bprm->envc,bprm->envp,bprm->page,bprm->p); 2009 bprm->p = copy_elf_strings(bprm->argc,bprm->argv,bprm->page,bprm->p); 2010 if (!bprm->p) { 2011 fprintf(stderr, "%s: %s\n", bprm->filename, strerror(E2BIG)); 2012 exit(-1); 2013 } 2014 2015 /* Do this so that we can load the interpreter, if need be. We will 2016 change some of these later */ 2017 bprm->p = setup_arg_pages(bprm->p, bprm, info); 2018 2019 if (elf_interpreter) { 2020 load_elf_interp(elf_interpreter, &interp_info, bprm->buf); 2021 2022 /* If the program interpreter is one of these two, then assume 2023 an iBCS2 image. Otherwise assume a native linux image. */ 2024 2025 if (strcmp(elf_interpreter, "/usr/lib/libc.so.1") == 0 2026 || strcmp(elf_interpreter, "/usr/lib/ld.so.1") == 0) { 2027 info->personality = PER_SVR4; 2028 2029 /* Why this, you ask??? Well SVr4 maps page 0 as read-only, 2030 and some applications "depend" upon this behavior. Since 2031 we do not have the power to recompile these, we emulate 2032 the SVr4 behavior. Sigh. */ 2033 target_mmap(0, qemu_host_page_size, PROT_READ | PROT_EXEC, 2034 MAP_FIXED | MAP_PRIVATE, -1, 0); 2035 } 2036 } 2037 2038 bprm->p = create_elf_tables(bprm->p, bprm->argc, bprm->envc, &elf_ex, 2039 info, (elf_interpreter ? &interp_info : NULL)); 2040 info->start_stack = bprm->p; 2041 2042 /* If we have an interpreter, set that as the program's entry point. 2043 Copy the load_bias as well, to help PPC64 interpret the entry 2044 point as a function descriptor. Do this after creating elf tables 2045 so that we copy the original program entry point into the AUXV. */ 2046 if (elf_interpreter) { 2047 info->load_bias = interp_info.load_bias; 2048 info->entry = interp_info.entry; 2049 free(elf_interpreter); 2050 } 2051 2052 #ifdef USE_ELF_CORE_DUMP 2053 bprm->core_dump = &elf_core_dump; 2054 #endif 2055 2056 return 0; 2057 } 2058 2059 #ifdef USE_ELF_CORE_DUMP 2060 /* 2061 * Definitions to generate Intel SVR4-like core files. 2062 * These mostly have the same names as the SVR4 types with "target_elf_" 2063 * tacked on the front to prevent clashes with linux definitions, 2064 * and the typedef forms have been avoided. This is mostly like 2065 * the SVR4 structure, but more Linuxy, with things that Linux does 2066 * not support and which gdb doesn't really use excluded. 2067 * 2068 * Fields we don't dump (their contents is zero) in linux-user qemu 2069 * are marked with XXX. 2070 * 2071 * Core dump code is copied from linux kernel (fs/binfmt_elf.c). 2072 * 2073 * Porting ELF coredump for target is (quite) simple process. First you 2074 * define USE_ELF_CORE_DUMP in target ELF code (where init_thread() for 2075 * the target resides): 2076 * 2077 * #define USE_ELF_CORE_DUMP 2078 * 2079 * Next you define type of register set used for dumping. ELF specification 2080 * says that it needs to be array of elf_greg_t that has size of ELF_NREG. 2081 * 2082 * typedef <target_regtype> target_elf_greg_t; 2083 * #define ELF_NREG <number of registers> 2084 * typedef taret_elf_greg_t target_elf_gregset_t[ELF_NREG]; 2085 * 2086 * Last step is to implement target specific function that copies registers 2087 * from given cpu into just specified register set. Prototype is: 2088 * 2089 * static void elf_core_copy_regs(taret_elf_gregset_t *regs, 2090 * const CPUArchState *env); 2091 * 2092 * Parameters: 2093 * regs - copy register values into here (allocated and zeroed by caller) 2094 * env - copy registers from here 2095 * 2096 * Example for ARM target is provided in this file. 2097 */ 2098 2099 /* An ELF note in memory */ 2100 struct memelfnote { 2101 const char *name; 2102 size_t namesz; 2103 size_t namesz_rounded; 2104 int type; 2105 size_t datasz; 2106 size_t datasz_rounded; 2107 void *data; 2108 size_t notesz; 2109 }; 2110 2111 struct target_elf_siginfo { 2112 abi_int si_signo; /* signal number */ 2113 abi_int si_code; /* extra code */ 2114 abi_int si_errno; /* errno */ 2115 }; 2116 2117 struct target_elf_prstatus { 2118 struct target_elf_siginfo pr_info; /* Info associated with signal */ 2119 abi_short pr_cursig; /* Current signal */ 2120 abi_ulong pr_sigpend; /* XXX */ 2121 abi_ulong pr_sighold; /* XXX */ 2122 target_pid_t pr_pid; 2123 target_pid_t pr_ppid; 2124 target_pid_t pr_pgrp; 2125 target_pid_t pr_sid; 2126 struct target_timeval pr_utime; /* XXX User time */ 2127 struct target_timeval pr_stime; /* XXX System time */ 2128 struct target_timeval pr_cutime; /* XXX Cumulative user time */ 2129 struct target_timeval pr_cstime; /* XXX Cumulative system time */ 2130 target_elf_gregset_t pr_reg; /* GP registers */ 2131 abi_int pr_fpvalid; /* XXX */ 2132 }; 2133 2134 #define ELF_PRARGSZ (80) /* Number of chars for args */ 2135 2136 struct target_elf_prpsinfo { 2137 char pr_state; /* numeric process state */ 2138 char pr_sname; /* char for pr_state */ 2139 char pr_zomb; /* zombie */ 2140 char pr_nice; /* nice val */ 2141 abi_ulong pr_flag; /* flags */ 2142 target_uid_t pr_uid; 2143 target_gid_t pr_gid; 2144 target_pid_t pr_pid, pr_ppid, pr_pgrp, pr_sid; 2145 /* Lots missing */ 2146 char pr_fname[16]; /* filename of executable */ 2147 char pr_psargs[ELF_PRARGSZ]; /* initial part of arg list */ 2148 }; 2149 2150 /* Here is the structure in which status of each thread is captured. */ 2151 struct elf_thread_status { 2152 QTAILQ_ENTRY(elf_thread_status) ets_link; 2153 struct target_elf_prstatus prstatus; /* NT_PRSTATUS */ 2154 #if 0 2155 elf_fpregset_t fpu; /* NT_PRFPREG */ 2156 struct task_struct *thread; 2157 elf_fpxregset_t xfpu; /* ELF_CORE_XFPREG_TYPE */ 2158 #endif 2159 struct memelfnote notes[1]; 2160 int num_notes; 2161 }; 2162 2163 struct elf_note_info { 2164 struct memelfnote *notes; 2165 struct target_elf_prstatus *prstatus; /* NT_PRSTATUS */ 2166 struct target_elf_prpsinfo *psinfo; /* NT_PRPSINFO */ 2167 2168 QTAILQ_HEAD(thread_list_head, elf_thread_status) thread_list; 2169 #if 0 2170 /* 2171 * Current version of ELF coredump doesn't support 2172 * dumping fp regs etc. 2173 */ 2174 elf_fpregset_t *fpu; 2175 elf_fpxregset_t *xfpu; 2176 int thread_status_size; 2177 #endif 2178 int notes_size; 2179 int numnote; 2180 }; 2181 2182 struct vm_area_struct { 2183 abi_ulong vma_start; /* start vaddr of memory region */ 2184 abi_ulong vma_end; /* end vaddr of memory region */ 2185 abi_ulong vma_flags; /* protection etc. flags for the region */ 2186 QTAILQ_ENTRY(vm_area_struct) vma_link; 2187 }; 2188 2189 struct mm_struct { 2190 QTAILQ_HEAD(, vm_area_struct) mm_mmap; 2191 int mm_count; /* number of mappings */ 2192 }; 2193 2194 static struct mm_struct *vma_init(void); 2195 static void vma_delete(struct mm_struct *); 2196 static int vma_add_mapping(struct mm_struct *, abi_ulong, 2197 abi_ulong, abi_ulong); 2198 static int vma_get_mapping_count(const struct mm_struct *); 2199 static struct vm_area_struct *vma_first(const struct mm_struct *); 2200 static struct vm_area_struct *vma_next(struct vm_area_struct *); 2201 static abi_ulong vma_dump_size(const struct vm_area_struct *); 2202 static int vma_walker(void *priv, abi_ulong start, abi_ulong end, 2203 unsigned long flags); 2204 2205 static void fill_elf_header(struct elfhdr *, int, uint16_t, uint32_t); 2206 static void fill_note(struct memelfnote *, const char *, int, 2207 unsigned int, void *); 2208 static void fill_prstatus(struct target_elf_prstatus *, const TaskState *, int); 2209 static int fill_psinfo(struct target_elf_prpsinfo *, const TaskState *); 2210 static void fill_auxv_note(struct memelfnote *, const TaskState *); 2211 static void fill_elf_note_phdr(struct elf_phdr *, int, off_t); 2212 static size_t note_size(const struct memelfnote *); 2213 static void free_note_info(struct elf_note_info *); 2214 static int fill_note_info(struct elf_note_info *, long, const CPUArchState *); 2215 static void fill_thread_info(struct elf_note_info *, const CPUArchState *); 2216 static int core_dump_filename(const TaskState *, char *, size_t); 2217 2218 static int dump_write(int, const void *, size_t); 2219 static int write_note(struct memelfnote *, int); 2220 static int write_note_info(struct elf_note_info *, int); 2221 2222 #ifdef BSWAP_NEEDED 2223 static void bswap_prstatus(struct target_elf_prstatus *prstatus) 2224 { 2225 prstatus->pr_info.si_signo = tswap32(prstatus->pr_info.si_signo); 2226 prstatus->pr_info.si_code = tswap32(prstatus->pr_info.si_code); 2227 prstatus->pr_info.si_errno = tswap32(prstatus->pr_info.si_errno); 2228 prstatus->pr_cursig = tswap16(prstatus->pr_cursig); 2229 prstatus->pr_sigpend = tswapal(prstatus->pr_sigpend); 2230 prstatus->pr_sighold = tswapal(prstatus->pr_sighold); 2231 prstatus->pr_pid = tswap32(prstatus->pr_pid); 2232 prstatus->pr_ppid = tswap32(prstatus->pr_ppid); 2233 prstatus->pr_pgrp = tswap32(prstatus->pr_pgrp); 2234 prstatus->pr_sid = tswap32(prstatus->pr_sid); 2235 /* cpu times are not filled, so we skip them */ 2236 /* regs should be in correct format already */ 2237 prstatus->pr_fpvalid = tswap32(prstatus->pr_fpvalid); 2238 } 2239 2240 static void bswap_psinfo(struct target_elf_prpsinfo *psinfo) 2241 { 2242 psinfo->pr_flag = tswapal(psinfo->pr_flag); 2243 psinfo->pr_uid = tswap16(psinfo->pr_uid); 2244 psinfo->pr_gid = tswap16(psinfo->pr_gid); 2245 psinfo->pr_pid = tswap32(psinfo->pr_pid); 2246 psinfo->pr_ppid = tswap32(psinfo->pr_ppid); 2247 psinfo->pr_pgrp = tswap32(psinfo->pr_pgrp); 2248 psinfo->pr_sid = tswap32(psinfo->pr_sid); 2249 } 2250 2251 static void bswap_note(struct elf_note *en) 2252 { 2253 bswap32s(&en->n_namesz); 2254 bswap32s(&en->n_descsz); 2255 bswap32s(&en->n_type); 2256 } 2257 #else 2258 static inline void bswap_prstatus(struct target_elf_prstatus *p) { } 2259 static inline void bswap_psinfo(struct target_elf_prpsinfo *p) {} 2260 static inline void bswap_note(struct elf_note *en) { } 2261 #endif /* BSWAP_NEEDED */ 2262 2263 /* 2264 * Minimal support for linux memory regions. These are needed 2265 * when we are finding out what memory exactly belongs to 2266 * emulated process. No locks needed here, as long as 2267 * thread that received the signal is stopped. 2268 */ 2269 2270 static struct mm_struct *vma_init(void) 2271 { 2272 struct mm_struct *mm; 2273 2274 if ((mm = g_malloc(sizeof (*mm))) == NULL) 2275 return (NULL); 2276 2277 mm->mm_count = 0; 2278 QTAILQ_INIT(&mm->mm_mmap); 2279 2280 return (mm); 2281 } 2282 2283 static void vma_delete(struct mm_struct *mm) 2284 { 2285 struct vm_area_struct *vma; 2286 2287 while ((vma = vma_first(mm)) != NULL) { 2288 QTAILQ_REMOVE(&mm->mm_mmap, vma, vma_link); 2289 g_free(vma); 2290 } 2291 g_free(mm); 2292 } 2293 2294 static int vma_add_mapping(struct mm_struct *mm, abi_ulong start, 2295 abi_ulong end, abi_ulong flags) 2296 { 2297 struct vm_area_struct *vma; 2298 2299 if ((vma = g_malloc0(sizeof (*vma))) == NULL) 2300 return (-1); 2301 2302 vma->vma_start = start; 2303 vma->vma_end = end; 2304 vma->vma_flags = flags; 2305 2306 QTAILQ_INSERT_TAIL(&mm->mm_mmap, vma, vma_link); 2307 mm->mm_count++; 2308 2309 return (0); 2310 } 2311 2312 static struct vm_area_struct *vma_first(const struct mm_struct *mm) 2313 { 2314 return (QTAILQ_FIRST(&mm->mm_mmap)); 2315 } 2316 2317 static struct vm_area_struct *vma_next(struct vm_area_struct *vma) 2318 { 2319 return (QTAILQ_NEXT(vma, vma_link)); 2320 } 2321 2322 static int vma_get_mapping_count(const struct mm_struct *mm) 2323 { 2324 return (mm->mm_count); 2325 } 2326 2327 /* 2328 * Calculate file (dump) size of given memory region. 2329 */ 2330 static abi_ulong vma_dump_size(const struct vm_area_struct *vma) 2331 { 2332 /* if we cannot even read the first page, skip it */ 2333 if (!access_ok(VERIFY_READ, vma->vma_start, TARGET_PAGE_SIZE)) 2334 return (0); 2335 2336 /* 2337 * Usually we don't dump executable pages as they contain 2338 * non-writable code that debugger can read directly from 2339 * target library etc. However, thread stacks are marked 2340 * also executable so we read in first page of given region 2341 * and check whether it contains elf header. If there is 2342 * no elf header, we dump it. 2343 */ 2344 if (vma->vma_flags & PROT_EXEC) { 2345 char page[TARGET_PAGE_SIZE]; 2346 2347 copy_from_user(page, vma->vma_start, sizeof (page)); 2348 if ((page[EI_MAG0] == ELFMAG0) && 2349 (page[EI_MAG1] == ELFMAG1) && 2350 (page[EI_MAG2] == ELFMAG2) && 2351 (page[EI_MAG3] == ELFMAG3)) { 2352 /* 2353 * Mappings are possibly from ELF binary. Don't dump 2354 * them. 2355 */ 2356 return (0); 2357 } 2358 } 2359 2360 return (vma->vma_end - vma->vma_start); 2361 } 2362 2363 static int vma_walker(void *priv, abi_ulong start, abi_ulong end, 2364 unsigned long flags) 2365 { 2366 struct mm_struct *mm = (struct mm_struct *)priv; 2367 2368 vma_add_mapping(mm, start, end, flags); 2369 return (0); 2370 } 2371 2372 static void fill_note(struct memelfnote *note, const char *name, int type, 2373 unsigned int sz, void *data) 2374 { 2375 unsigned int namesz; 2376 2377 namesz = strlen(name) + 1; 2378 note->name = name; 2379 note->namesz = namesz; 2380 note->namesz_rounded = roundup(namesz, sizeof (int32_t)); 2381 note->type = type; 2382 note->datasz = sz; 2383 note->datasz_rounded = roundup(sz, sizeof (int32_t)); 2384 2385 note->data = data; 2386 2387 /* 2388 * We calculate rounded up note size here as specified by 2389 * ELF document. 2390 */ 2391 note->notesz = sizeof (struct elf_note) + 2392 note->namesz_rounded + note->datasz_rounded; 2393 } 2394 2395 static void fill_elf_header(struct elfhdr *elf, int segs, uint16_t machine, 2396 uint32_t flags) 2397 { 2398 (void) memset(elf, 0, sizeof(*elf)); 2399 2400 (void) memcpy(elf->e_ident, ELFMAG, SELFMAG); 2401 elf->e_ident[EI_CLASS] = ELF_CLASS; 2402 elf->e_ident[EI_DATA] = ELF_DATA; 2403 elf->e_ident[EI_VERSION] = EV_CURRENT; 2404 elf->e_ident[EI_OSABI] = ELF_OSABI; 2405 2406 elf->e_type = ET_CORE; 2407 elf->e_machine = machine; 2408 elf->e_version = EV_CURRENT; 2409 elf->e_phoff = sizeof(struct elfhdr); 2410 elf->e_flags = flags; 2411 elf->e_ehsize = sizeof(struct elfhdr); 2412 elf->e_phentsize = sizeof(struct elf_phdr); 2413 elf->e_phnum = segs; 2414 2415 bswap_ehdr(elf); 2416 } 2417 2418 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, off_t offset) 2419 { 2420 phdr->p_type = PT_NOTE; 2421 phdr->p_offset = offset; 2422 phdr->p_vaddr = 0; 2423 phdr->p_paddr = 0; 2424 phdr->p_filesz = sz; 2425 phdr->p_memsz = 0; 2426 phdr->p_flags = 0; 2427 phdr->p_align = 0; 2428 2429 bswap_phdr(phdr, 1); 2430 } 2431 2432 static size_t note_size(const struct memelfnote *note) 2433 { 2434 return (note->notesz); 2435 } 2436 2437 static void fill_prstatus(struct target_elf_prstatus *prstatus, 2438 const TaskState *ts, int signr) 2439 { 2440 (void) memset(prstatus, 0, sizeof (*prstatus)); 2441 prstatus->pr_info.si_signo = prstatus->pr_cursig = signr; 2442 prstatus->pr_pid = ts->ts_tid; 2443 prstatus->pr_ppid = getppid(); 2444 prstatus->pr_pgrp = getpgrp(); 2445 prstatus->pr_sid = getsid(0); 2446 2447 bswap_prstatus(prstatus); 2448 } 2449 2450 static int fill_psinfo(struct target_elf_prpsinfo *psinfo, const TaskState *ts) 2451 { 2452 char *base_filename; 2453 unsigned int i, len; 2454 2455 (void) memset(psinfo, 0, sizeof (*psinfo)); 2456 2457 len = ts->info->arg_end - ts->info->arg_start; 2458 if (len >= ELF_PRARGSZ) 2459 len = ELF_PRARGSZ - 1; 2460 if (copy_from_user(&psinfo->pr_psargs, ts->info->arg_start, len)) 2461 return -EFAULT; 2462 for (i = 0; i < len; i++) 2463 if (psinfo->pr_psargs[i] == 0) 2464 psinfo->pr_psargs[i] = ' '; 2465 psinfo->pr_psargs[len] = 0; 2466 2467 psinfo->pr_pid = getpid(); 2468 psinfo->pr_ppid = getppid(); 2469 psinfo->pr_pgrp = getpgrp(); 2470 psinfo->pr_sid = getsid(0); 2471 psinfo->pr_uid = getuid(); 2472 psinfo->pr_gid = getgid(); 2473 2474 base_filename = g_path_get_basename(ts->bprm->filename); 2475 /* 2476 * Using strncpy here is fine: at max-length, 2477 * this field is not NUL-terminated. 2478 */ 2479 (void) strncpy(psinfo->pr_fname, base_filename, 2480 sizeof(psinfo->pr_fname)); 2481 2482 g_free(base_filename); 2483 bswap_psinfo(psinfo); 2484 return (0); 2485 } 2486 2487 static void fill_auxv_note(struct memelfnote *note, const TaskState *ts) 2488 { 2489 elf_addr_t auxv = (elf_addr_t)ts->info->saved_auxv; 2490 elf_addr_t orig_auxv = auxv; 2491 void *ptr; 2492 int len = ts->info->auxv_len; 2493 2494 /* 2495 * Auxiliary vector is stored in target process stack. It contains 2496 * {type, value} pairs that we need to dump into note. This is not 2497 * strictly necessary but we do it here for sake of completeness. 2498 */ 2499 2500 /* read in whole auxv vector and copy it to memelfnote */ 2501 ptr = lock_user(VERIFY_READ, orig_auxv, len, 0); 2502 if (ptr != NULL) { 2503 fill_note(note, "CORE", NT_AUXV, len, ptr); 2504 unlock_user(ptr, auxv, len); 2505 } 2506 } 2507 2508 /* 2509 * Constructs name of coredump file. We have following convention 2510 * for the name: 2511 * qemu_<basename-of-target-binary>_<date>-<time>_<pid>.core 2512 * 2513 * Returns 0 in case of success, -1 otherwise (errno is set). 2514 */ 2515 static int core_dump_filename(const TaskState *ts, char *buf, 2516 size_t bufsize) 2517 { 2518 char timestamp[64]; 2519 char *filename = NULL; 2520 char *base_filename = NULL; 2521 struct timeval tv; 2522 struct tm tm; 2523 2524 assert(bufsize >= PATH_MAX); 2525 2526 if (gettimeofday(&tv, NULL) < 0) { 2527 (void) fprintf(stderr, "unable to get current timestamp: %s", 2528 strerror(errno)); 2529 return (-1); 2530 } 2531 2532 filename = strdup(ts->bprm->filename); 2533 base_filename = strdup(basename(filename)); 2534 (void) strftime(timestamp, sizeof (timestamp), "%Y%m%d-%H%M%S", 2535 localtime_r(&tv.tv_sec, &tm)); 2536 (void) snprintf(buf, bufsize, "qemu_%s_%s_%d.core", 2537 base_filename, timestamp, (int)getpid()); 2538 free(base_filename); 2539 free(filename); 2540 2541 return (0); 2542 } 2543 2544 static int dump_write(int fd, const void *ptr, size_t size) 2545 { 2546 const char *bufp = (const char *)ptr; 2547 ssize_t bytes_written, bytes_left; 2548 struct rlimit dumpsize; 2549 off_t pos; 2550 2551 bytes_written = 0; 2552 getrlimit(RLIMIT_CORE, &dumpsize); 2553 if ((pos = lseek(fd, 0, SEEK_CUR))==-1) { 2554 if (errno == ESPIPE) { /* not a seekable stream */ 2555 bytes_left = size; 2556 } else { 2557 return pos; 2558 } 2559 } else { 2560 if (dumpsize.rlim_cur <= pos) { 2561 return -1; 2562 } else if (dumpsize.rlim_cur == RLIM_INFINITY) { 2563 bytes_left = size; 2564 } else { 2565 size_t limit_left=dumpsize.rlim_cur - pos; 2566 bytes_left = limit_left >= size ? size : limit_left ; 2567 } 2568 } 2569 2570 /* 2571 * In normal conditions, single write(2) should do but 2572 * in case of socket etc. this mechanism is more portable. 2573 */ 2574 do { 2575 bytes_written = write(fd, bufp, bytes_left); 2576 if (bytes_written < 0) { 2577 if (errno == EINTR) 2578 continue; 2579 return (-1); 2580 } else if (bytes_written == 0) { /* eof */ 2581 return (-1); 2582 } 2583 bufp += bytes_written; 2584 bytes_left -= bytes_written; 2585 } while (bytes_left > 0); 2586 2587 return (0); 2588 } 2589 2590 static int write_note(struct memelfnote *men, int fd) 2591 { 2592 struct elf_note en; 2593 2594 en.n_namesz = men->namesz; 2595 en.n_type = men->type; 2596 en.n_descsz = men->datasz; 2597 2598 bswap_note(&en); 2599 2600 if (dump_write(fd, &en, sizeof(en)) != 0) 2601 return (-1); 2602 if (dump_write(fd, men->name, men->namesz_rounded) != 0) 2603 return (-1); 2604 if (dump_write(fd, men->data, men->datasz_rounded) != 0) 2605 return (-1); 2606 2607 return (0); 2608 } 2609 2610 static void fill_thread_info(struct elf_note_info *info, const CPUArchState *env) 2611 { 2612 TaskState *ts = (TaskState *)env->opaque; 2613 struct elf_thread_status *ets; 2614 2615 ets = g_malloc0(sizeof (*ets)); 2616 ets->num_notes = 1; /* only prstatus is dumped */ 2617 fill_prstatus(&ets->prstatus, ts, 0); 2618 elf_core_copy_regs(&ets->prstatus.pr_reg, env); 2619 fill_note(&ets->notes[0], "CORE", NT_PRSTATUS, sizeof (ets->prstatus), 2620 &ets->prstatus); 2621 2622 QTAILQ_INSERT_TAIL(&info->thread_list, ets, ets_link); 2623 2624 info->notes_size += note_size(&ets->notes[0]); 2625 } 2626 2627 static int fill_note_info(struct elf_note_info *info, 2628 long signr, const CPUArchState *env) 2629 { 2630 #define NUMNOTES 3 2631 CPUArchState *cpu = NULL; 2632 TaskState *ts = (TaskState *)env->opaque; 2633 int i; 2634 2635 (void) memset(info, 0, sizeof (*info)); 2636 2637 QTAILQ_INIT(&info->thread_list); 2638 2639 info->notes = g_malloc0(NUMNOTES * sizeof (struct memelfnote)); 2640 if (info->notes == NULL) 2641 return (-ENOMEM); 2642 info->prstatus = g_malloc0(sizeof (*info->prstatus)); 2643 if (info->prstatus == NULL) 2644 return (-ENOMEM); 2645 info->psinfo = g_malloc0(sizeof (*info->psinfo)); 2646 if (info->prstatus == NULL) 2647 return (-ENOMEM); 2648 2649 /* 2650 * First fill in status (and registers) of current thread 2651 * including process info & aux vector. 2652 */ 2653 fill_prstatus(info->prstatus, ts, signr); 2654 elf_core_copy_regs(&info->prstatus->pr_reg, env); 2655 fill_note(&info->notes[0], "CORE", NT_PRSTATUS, 2656 sizeof (*info->prstatus), info->prstatus); 2657 fill_psinfo(info->psinfo, ts); 2658 fill_note(&info->notes[1], "CORE", NT_PRPSINFO, 2659 sizeof (*info->psinfo), info->psinfo); 2660 fill_auxv_note(&info->notes[2], ts); 2661 info->numnote = 3; 2662 2663 info->notes_size = 0; 2664 for (i = 0; i < info->numnote; i++) 2665 info->notes_size += note_size(&info->notes[i]); 2666 2667 /* read and fill status of all threads */ 2668 cpu_list_lock(); 2669 for (cpu = first_cpu; cpu != NULL; cpu = cpu->next_cpu) { 2670 if (cpu == thread_env) 2671 continue; 2672 fill_thread_info(info, cpu); 2673 } 2674 cpu_list_unlock(); 2675 2676 return (0); 2677 } 2678 2679 static void free_note_info(struct elf_note_info *info) 2680 { 2681 struct elf_thread_status *ets; 2682 2683 while (!QTAILQ_EMPTY(&info->thread_list)) { 2684 ets = QTAILQ_FIRST(&info->thread_list); 2685 QTAILQ_REMOVE(&info->thread_list, ets, ets_link); 2686 g_free(ets); 2687 } 2688 2689 g_free(info->prstatus); 2690 g_free(info->psinfo); 2691 g_free(info->notes); 2692 } 2693 2694 static int write_note_info(struct elf_note_info *info, int fd) 2695 { 2696 struct elf_thread_status *ets; 2697 int i, error = 0; 2698 2699 /* write prstatus, psinfo and auxv for current thread */ 2700 for (i = 0; i < info->numnote; i++) 2701 if ((error = write_note(&info->notes[i], fd)) != 0) 2702 return (error); 2703 2704 /* write prstatus for each thread */ 2705 for (ets = info->thread_list.tqh_first; ets != NULL; 2706 ets = ets->ets_link.tqe_next) { 2707 if ((error = write_note(&ets->notes[0], fd)) != 0) 2708 return (error); 2709 } 2710 2711 return (0); 2712 } 2713 2714 /* 2715 * Write out ELF coredump. 2716 * 2717 * See documentation of ELF object file format in: 2718 * http://www.caldera.com/developers/devspecs/gabi41.pdf 2719 * 2720 * Coredump format in linux is following: 2721 * 2722 * 0 +----------------------+ \ 2723 * | ELF header | ET_CORE | 2724 * +----------------------+ | 2725 * | ELF program headers | |--- headers 2726 * | - NOTE section | | 2727 * | - PT_LOAD sections | | 2728 * +----------------------+ / 2729 * | NOTEs: | 2730 * | - NT_PRSTATUS | 2731 * | - NT_PRSINFO | 2732 * | - NT_AUXV | 2733 * +----------------------+ <-- aligned to target page 2734 * | Process memory dump | 2735 * : : 2736 * . . 2737 * : : 2738 * | | 2739 * +----------------------+ 2740 * 2741 * NT_PRSTATUS -> struct elf_prstatus (per thread) 2742 * NT_PRSINFO -> struct elf_prpsinfo 2743 * NT_AUXV is array of { type, value } pairs (see fill_auxv_note()). 2744 * 2745 * Format follows System V format as close as possible. Current 2746 * version limitations are as follows: 2747 * - no floating point registers are dumped 2748 * 2749 * Function returns 0 in case of success, negative errno otherwise. 2750 * 2751 * TODO: make this work also during runtime: it should be 2752 * possible to force coredump from running process and then 2753 * continue processing. For example qemu could set up SIGUSR2 2754 * handler (provided that target process haven't registered 2755 * handler for that) that does the dump when signal is received. 2756 */ 2757 static int elf_core_dump(int signr, const CPUArchState *env) 2758 { 2759 const TaskState *ts = (const TaskState *)env->opaque; 2760 struct vm_area_struct *vma = NULL; 2761 char corefile[PATH_MAX]; 2762 struct elf_note_info info; 2763 struct elfhdr elf; 2764 struct elf_phdr phdr; 2765 struct rlimit dumpsize; 2766 struct mm_struct *mm = NULL; 2767 off_t offset = 0, data_offset = 0; 2768 int segs = 0; 2769 int fd = -1; 2770 2771 errno = 0; 2772 getrlimit(RLIMIT_CORE, &dumpsize); 2773 if (dumpsize.rlim_cur == 0) 2774 return 0; 2775 2776 if (core_dump_filename(ts, corefile, sizeof (corefile)) < 0) 2777 return (-errno); 2778 2779 if ((fd = open(corefile, O_WRONLY | O_CREAT, 2780 S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH)) < 0) 2781 return (-errno); 2782 2783 /* 2784 * Walk through target process memory mappings and 2785 * set up structure containing this information. After 2786 * this point vma_xxx functions can be used. 2787 */ 2788 if ((mm = vma_init()) == NULL) 2789 goto out; 2790 2791 walk_memory_regions(mm, vma_walker); 2792 segs = vma_get_mapping_count(mm); 2793 2794 /* 2795 * Construct valid coredump ELF header. We also 2796 * add one more segment for notes. 2797 */ 2798 fill_elf_header(&elf, segs + 1, ELF_MACHINE, 0); 2799 if (dump_write(fd, &elf, sizeof (elf)) != 0) 2800 goto out; 2801 2802 /* fill in in-memory version of notes */ 2803 if (fill_note_info(&info, signr, env) < 0) 2804 goto out; 2805 2806 offset += sizeof (elf); /* elf header */ 2807 offset += (segs + 1) * sizeof (struct elf_phdr); /* program headers */ 2808 2809 /* write out notes program header */ 2810 fill_elf_note_phdr(&phdr, info.notes_size, offset); 2811 2812 offset += info.notes_size; 2813 if (dump_write(fd, &phdr, sizeof (phdr)) != 0) 2814 goto out; 2815 2816 /* 2817 * ELF specification wants data to start at page boundary so 2818 * we align it here. 2819 */ 2820 data_offset = offset = roundup(offset, ELF_EXEC_PAGESIZE); 2821 2822 /* 2823 * Write program headers for memory regions mapped in 2824 * the target process. 2825 */ 2826 for (vma = vma_first(mm); vma != NULL; vma = vma_next(vma)) { 2827 (void) memset(&phdr, 0, sizeof (phdr)); 2828 2829 phdr.p_type = PT_LOAD; 2830 phdr.p_offset = offset; 2831 phdr.p_vaddr = vma->vma_start; 2832 phdr.p_paddr = 0; 2833 phdr.p_filesz = vma_dump_size(vma); 2834 offset += phdr.p_filesz; 2835 phdr.p_memsz = vma->vma_end - vma->vma_start; 2836 phdr.p_flags = vma->vma_flags & PROT_READ ? PF_R : 0; 2837 if (vma->vma_flags & PROT_WRITE) 2838 phdr.p_flags |= PF_W; 2839 if (vma->vma_flags & PROT_EXEC) 2840 phdr.p_flags |= PF_X; 2841 phdr.p_align = ELF_EXEC_PAGESIZE; 2842 2843 bswap_phdr(&phdr, 1); 2844 dump_write(fd, &phdr, sizeof (phdr)); 2845 } 2846 2847 /* 2848 * Next we write notes just after program headers. No 2849 * alignment needed here. 2850 */ 2851 if (write_note_info(&info, fd) < 0) 2852 goto out; 2853 2854 /* align data to page boundary */ 2855 if (lseek(fd, data_offset, SEEK_SET) != data_offset) 2856 goto out; 2857 2858 /* 2859 * Finally we can dump process memory into corefile as well. 2860 */ 2861 for (vma = vma_first(mm); vma != NULL; vma = vma_next(vma)) { 2862 abi_ulong addr; 2863 abi_ulong end; 2864 2865 end = vma->vma_start + vma_dump_size(vma); 2866 2867 for (addr = vma->vma_start; addr < end; 2868 addr += TARGET_PAGE_SIZE) { 2869 char page[TARGET_PAGE_SIZE]; 2870 int error; 2871 2872 /* 2873 * Read in page from target process memory and 2874 * write it to coredump file. 2875 */ 2876 error = copy_from_user(page, addr, sizeof (page)); 2877 if (error != 0) { 2878 (void) fprintf(stderr, "unable to dump " TARGET_ABI_FMT_lx "\n", 2879 addr); 2880 errno = -error; 2881 goto out; 2882 } 2883 if (dump_write(fd, page, TARGET_PAGE_SIZE) < 0) 2884 goto out; 2885 } 2886 } 2887 2888 out: 2889 free_note_info(&info); 2890 if (mm != NULL) 2891 vma_delete(mm); 2892 (void) close(fd); 2893 2894 if (errno != 0) 2895 return (-errno); 2896 return (0); 2897 } 2898 #endif /* USE_ELF_CORE_DUMP */ 2899 2900 void do_init_thread(struct target_pt_regs *regs, struct image_info *infop) 2901 { 2902 init_thread(regs, infop); 2903 } 2904