1*4882a593Smuzhiyun // SPDX-License-Identifier: GPL-2.0-only
2*4882a593Smuzhiyun /*
3*4882a593Smuzhiyun * a.out loader for x86-64
4*4882a593Smuzhiyun *
5*4882a593Smuzhiyun * Copyright (C) 1991, 1992, 1996 Linus Torvalds
6*4882a593Smuzhiyun * Hacked together by Andi Kleen
7*4882a593Smuzhiyun */
8*4882a593Smuzhiyun
9*4882a593Smuzhiyun #include <linux/module.h>
10*4882a593Smuzhiyun
11*4882a593Smuzhiyun #include <linux/time.h>
12*4882a593Smuzhiyun #include <linux/kernel.h>
13*4882a593Smuzhiyun #include <linux/mm.h>
14*4882a593Smuzhiyun #include <linux/mman.h>
15*4882a593Smuzhiyun #include <linux/a.out.h>
16*4882a593Smuzhiyun #include <linux/errno.h>
17*4882a593Smuzhiyun #include <linux/signal.h>
18*4882a593Smuzhiyun #include <linux/string.h>
19*4882a593Smuzhiyun #include <linux/fs.h>
20*4882a593Smuzhiyun #include <linux/file.h>
21*4882a593Smuzhiyun #include <linux/stat.h>
22*4882a593Smuzhiyun #include <linux/fcntl.h>
23*4882a593Smuzhiyun #include <linux/ptrace.h>
24*4882a593Smuzhiyun #include <linux/user.h>
25*4882a593Smuzhiyun #include <linux/binfmts.h>
26*4882a593Smuzhiyun #include <linux/personality.h>
27*4882a593Smuzhiyun #include <linux/init.h>
28*4882a593Smuzhiyun #include <linux/jiffies.h>
29*4882a593Smuzhiyun #include <linux/perf_event.h>
30*4882a593Smuzhiyun #include <linux/sched/task_stack.h>
31*4882a593Smuzhiyun
32*4882a593Smuzhiyun #include <linux/uaccess.h>
33*4882a593Smuzhiyun #include <asm/cacheflush.h>
34*4882a593Smuzhiyun #include <asm/user32.h>
35*4882a593Smuzhiyun #include <asm/ia32.h>
36*4882a593Smuzhiyun
37*4882a593Smuzhiyun #undef WARN_OLD
38*4882a593Smuzhiyun
39*4882a593Smuzhiyun static int load_aout_binary(struct linux_binprm *);
40*4882a593Smuzhiyun static int load_aout_library(struct file *);
41*4882a593Smuzhiyun
42*4882a593Smuzhiyun static struct linux_binfmt aout_format = {
43*4882a593Smuzhiyun .module = THIS_MODULE,
44*4882a593Smuzhiyun .load_binary = load_aout_binary,
45*4882a593Smuzhiyun .load_shlib = load_aout_library,
46*4882a593Smuzhiyun };
47*4882a593Smuzhiyun
set_brk(unsigned long start,unsigned long end)48*4882a593Smuzhiyun static int set_brk(unsigned long start, unsigned long end)
49*4882a593Smuzhiyun {
50*4882a593Smuzhiyun start = PAGE_ALIGN(start);
51*4882a593Smuzhiyun end = PAGE_ALIGN(end);
52*4882a593Smuzhiyun if (end <= start)
53*4882a593Smuzhiyun return 0;
54*4882a593Smuzhiyun return vm_brk(start, end - start);
55*4882a593Smuzhiyun }
56*4882a593Smuzhiyun
57*4882a593Smuzhiyun
58*4882a593Smuzhiyun /*
59*4882a593Smuzhiyun * create_aout_tables() parses the env- and arg-strings in new user
60*4882a593Smuzhiyun * memory and creates the pointer tables from them, and puts their
61*4882a593Smuzhiyun * addresses on the "stack", returning the new stack pointer value.
62*4882a593Smuzhiyun */
create_aout_tables(char __user * p,struct linux_binprm * bprm)63*4882a593Smuzhiyun static u32 __user *create_aout_tables(char __user *p, struct linux_binprm *bprm)
64*4882a593Smuzhiyun {
65*4882a593Smuzhiyun u32 __user *argv, *envp, *sp;
66*4882a593Smuzhiyun int argc = bprm->argc, envc = bprm->envc;
67*4882a593Smuzhiyun
68*4882a593Smuzhiyun sp = (u32 __user *) ((-(unsigned long)sizeof(u32)) & (unsigned long) p);
69*4882a593Smuzhiyun sp -= envc+1;
70*4882a593Smuzhiyun envp = sp;
71*4882a593Smuzhiyun sp -= argc+1;
72*4882a593Smuzhiyun argv = sp;
73*4882a593Smuzhiyun put_user((unsigned long) envp, --sp);
74*4882a593Smuzhiyun put_user((unsigned long) argv, --sp);
75*4882a593Smuzhiyun put_user(argc, --sp);
76*4882a593Smuzhiyun current->mm->arg_start = (unsigned long) p;
77*4882a593Smuzhiyun while (argc-- > 0) {
78*4882a593Smuzhiyun char c;
79*4882a593Smuzhiyun
80*4882a593Smuzhiyun put_user((u32)(unsigned long)p, argv++);
81*4882a593Smuzhiyun do {
82*4882a593Smuzhiyun get_user(c, p++);
83*4882a593Smuzhiyun } while (c);
84*4882a593Smuzhiyun }
85*4882a593Smuzhiyun put_user(0, argv);
86*4882a593Smuzhiyun current->mm->arg_end = current->mm->env_start = (unsigned long) p;
87*4882a593Smuzhiyun while (envc-- > 0) {
88*4882a593Smuzhiyun char c;
89*4882a593Smuzhiyun
90*4882a593Smuzhiyun put_user((u32)(unsigned long)p, envp++);
91*4882a593Smuzhiyun do {
92*4882a593Smuzhiyun get_user(c, p++);
93*4882a593Smuzhiyun } while (c);
94*4882a593Smuzhiyun }
95*4882a593Smuzhiyun put_user(0, envp);
96*4882a593Smuzhiyun current->mm->env_end = (unsigned long) p;
97*4882a593Smuzhiyun return sp;
98*4882a593Smuzhiyun }
99*4882a593Smuzhiyun
100*4882a593Smuzhiyun /*
101*4882a593Smuzhiyun * These are the functions used to load a.out style executables and shared
102*4882a593Smuzhiyun * libraries. There is no binary dependent code anywhere else.
103*4882a593Smuzhiyun */
load_aout_binary(struct linux_binprm * bprm)104*4882a593Smuzhiyun static int load_aout_binary(struct linux_binprm *bprm)
105*4882a593Smuzhiyun {
106*4882a593Smuzhiyun unsigned long error, fd_offset, rlim;
107*4882a593Smuzhiyun struct pt_regs *regs = current_pt_regs();
108*4882a593Smuzhiyun struct exec ex;
109*4882a593Smuzhiyun int retval;
110*4882a593Smuzhiyun
111*4882a593Smuzhiyun ex = *((struct exec *) bprm->buf); /* exec-header */
112*4882a593Smuzhiyun if ((N_MAGIC(ex) != ZMAGIC && N_MAGIC(ex) != OMAGIC &&
113*4882a593Smuzhiyun N_MAGIC(ex) != QMAGIC && N_MAGIC(ex) != NMAGIC) ||
114*4882a593Smuzhiyun N_TRSIZE(ex) || N_DRSIZE(ex) ||
115*4882a593Smuzhiyun i_size_read(file_inode(bprm->file)) <
116*4882a593Smuzhiyun ex.a_text+ex.a_data+N_SYMSIZE(ex)+N_TXTOFF(ex)) {
117*4882a593Smuzhiyun return -ENOEXEC;
118*4882a593Smuzhiyun }
119*4882a593Smuzhiyun
120*4882a593Smuzhiyun fd_offset = N_TXTOFF(ex);
121*4882a593Smuzhiyun
122*4882a593Smuzhiyun /* Check initial limits. This avoids letting people circumvent
123*4882a593Smuzhiyun * size limits imposed on them by creating programs with large
124*4882a593Smuzhiyun * arrays in the data or bss.
125*4882a593Smuzhiyun */
126*4882a593Smuzhiyun rlim = rlimit(RLIMIT_DATA);
127*4882a593Smuzhiyun if (rlim >= RLIM_INFINITY)
128*4882a593Smuzhiyun rlim = ~0;
129*4882a593Smuzhiyun if (ex.a_data + ex.a_bss > rlim)
130*4882a593Smuzhiyun return -ENOMEM;
131*4882a593Smuzhiyun
132*4882a593Smuzhiyun /* Flush all traces of the currently running executable */
133*4882a593Smuzhiyun retval = begin_new_exec(bprm);
134*4882a593Smuzhiyun if (retval)
135*4882a593Smuzhiyun return retval;
136*4882a593Smuzhiyun
137*4882a593Smuzhiyun /* OK, This is the point of no return */
138*4882a593Smuzhiyun set_personality(PER_LINUX);
139*4882a593Smuzhiyun set_personality_ia32(false);
140*4882a593Smuzhiyun
141*4882a593Smuzhiyun setup_new_exec(bprm);
142*4882a593Smuzhiyun
143*4882a593Smuzhiyun regs->cs = __USER32_CS;
144*4882a593Smuzhiyun regs->r8 = regs->r9 = regs->r10 = regs->r11 = regs->r12 =
145*4882a593Smuzhiyun regs->r13 = regs->r14 = regs->r15 = 0;
146*4882a593Smuzhiyun
147*4882a593Smuzhiyun current->mm->end_code = ex.a_text +
148*4882a593Smuzhiyun (current->mm->start_code = N_TXTADDR(ex));
149*4882a593Smuzhiyun current->mm->end_data = ex.a_data +
150*4882a593Smuzhiyun (current->mm->start_data = N_DATADDR(ex));
151*4882a593Smuzhiyun current->mm->brk = ex.a_bss +
152*4882a593Smuzhiyun (current->mm->start_brk = N_BSSADDR(ex));
153*4882a593Smuzhiyun
154*4882a593Smuzhiyun retval = setup_arg_pages(bprm, IA32_STACK_TOP, EXSTACK_DEFAULT);
155*4882a593Smuzhiyun if (retval < 0)
156*4882a593Smuzhiyun return retval;
157*4882a593Smuzhiyun
158*4882a593Smuzhiyun if (N_MAGIC(ex) == OMAGIC) {
159*4882a593Smuzhiyun unsigned long text_addr, map_size;
160*4882a593Smuzhiyun
161*4882a593Smuzhiyun text_addr = N_TXTADDR(ex);
162*4882a593Smuzhiyun map_size = ex.a_text+ex.a_data;
163*4882a593Smuzhiyun
164*4882a593Smuzhiyun error = vm_brk(text_addr & PAGE_MASK, map_size);
165*4882a593Smuzhiyun
166*4882a593Smuzhiyun if (error)
167*4882a593Smuzhiyun return error;
168*4882a593Smuzhiyun
169*4882a593Smuzhiyun error = read_code(bprm->file, text_addr, 32,
170*4882a593Smuzhiyun ex.a_text + ex.a_data);
171*4882a593Smuzhiyun if ((signed long)error < 0)
172*4882a593Smuzhiyun return error;
173*4882a593Smuzhiyun } else {
174*4882a593Smuzhiyun #ifdef WARN_OLD
175*4882a593Smuzhiyun static unsigned long error_time, error_time2;
176*4882a593Smuzhiyun if ((ex.a_text & 0xfff || ex.a_data & 0xfff) &&
177*4882a593Smuzhiyun (N_MAGIC(ex) != NMAGIC) &&
178*4882a593Smuzhiyun time_after(jiffies, error_time2 + 5*HZ)) {
179*4882a593Smuzhiyun printk(KERN_NOTICE "executable not page aligned\n");
180*4882a593Smuzhiyun error_time2 = jiffies;
181*4882a593Smuzhiyun }
182*4882a593Smuzhiyun
183*4882a593Smuzhiyun if ((fd_offset & ~PAGE_MASK) != 0 &&
184*4882a593Smuzhiyun time_after(jiffies, error_time + 5*HZ)) {
185*4882a593Smuzhiyun printk(KERN_WARNING
186*4882a593Smuzhiyun "fd_offset is not page aligned. Please convert "
187*4882a593Smuzhiyun "program: %pD\n",
188*4882a593Smuzhiyun bprm->file);
189*4882a593Smuzhiyun error_time = jiffies;
190*4882a593Smuzhiyun }
191*4882a593Smuzhiyun #endif
192*4882a593Smuzhiyun
193*4882a593Smuzhiyun if (!bprm->file->f_op->mmap || (fd_offset & ~PAGE_MASK) != 0) {
194*4882a593Smuzhiyun error = vm_brk(N_TXTADDR(ex), ex.a_text+ex.a_data);
195*4882a593Smuzhiyun if (error)
196*4882a593Smuzhiyun return error;
197*4882a593Smuzhiyun
198*4882a593Smuzhiyun read_code(bprm->file, N_TXTADDR(ex), fd_offset,
199*4882a593Smuzhiyun ex.a_text+ex.a_data);
200*4882a593Smuzhiyun goto beyond_if;
201*4882a593Smuzhiyun }
202*4882a593Smuzhiyun
203*4882a593Smuzhiyun error = vm_mmap(bprm->file, N_TXTADDR(ex), ex.a_text,
204*4882a593Smuzhiyun PROT_READ | PROT_EXEC,
205*4882a593Smuzhiyun MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE |
206*4882a593Smuzhiyun MAP_EXECUTABLE | MAP_32BIT,
207*4882a593Smuzhiyun fd_offset);
208*4882a593Smuzhiyun
209*4882a593Smuzhiyun if (error != N_TXTADDR(ex))
210*4882a593Smuzhiyun return error;
211*4882a593Smuzhiyun
212*4882a593Smuzhiyun error = vm_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
213*4882a593Smuzhiyun PROT_READ | PROT_WRITE | PROT_EXEC,
214*4882a593Smuzhiyun MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE |
215*4882a593Smuzhiyun MAP_EXECUTABLE | MAP_32BIT,
216*4882a593Smuzhiyun fd_offset + ex.a_text);
217*4882a593Smuzhiyun if (error != N_DATADDR(ex))
218*4882a593Smuzhiyun return error;
219*4882a593Smuzhiyun }
220*4882a593Smuzhiyun
221*4882a593Smuzhiyun beyond_if:
222*4882a593Smuzhiyun error = set_brk(current->mm->start_brk, current->mm->brk);
223*4882a593Smuzhiyun if (error)
224*4882a593Smuzhiyun return error;
225*4882a593Smuzhiyun
226*4882a593Smuzhiyun set_binfmt(&aout_format);
227*4882a593Smuzhiyun
228*4882a593Smuzhiyun current->mm->start_stack =
229*4882a593Smuzhiyun (unsigned long)create_aout_tables((char __user *)bprm->p, bprm);
230*4882a593Smuzhiyun /* start thread */
231*4882a593Smuzhiyun loadsegment(fs, 0);
232*4882a593Smuzhiyun loadsegment(ds, __USER32_DS);
233*4882a593Smuzhiyun loadsegment(es, __USER32_DS);
234*4882a593Smuzhiyun load_gs_index(0);
235*4882a593Smuzhiyun (regs)->ip = ex.a_entry;
236*4882a593Smuzhiyun (regs)->sp = current->mm->start_stack;
237*4882a593Smuzhiyun (regs)->flags = 0x200;
238*4882a593Smuzhiyun (regs)->cs = __USER32_CS;
239*4882a593Smuzhiyun (regs)->ss = __USER32_DS;
240*4882a593Smuzhiyun regs->r8 = regs->r9 = regs->r10 = regs->r11 =
241*4882a593Smuzhiyun regs->r12 = regs->r13 = regs->r14 = regs->r15 = 0;
242*4882a593Smuzhiyun return 0;
243*4882a593Smuzhiyun }
244*4882a593Smuzhiyun
load_aout_library(struct file * file)245*4882a593Smuzhiyun static int load_aout_library(struct file *file)
246*4882a593Smuzhiyun {
247*4882a593Smuzhiyun unsigned long bss, start_addr, len, error;
248*4882a593Smuzhiyun int retval;
249*4882a593Smuzhiyun struct exec ex;
250*4882a593Smuzhiyun loff_t pos = 0;
251*4882a593Smuzhiyun
252*4882a593Smuzhiyun retval = -ENOEXEC;
253*4882a593Smuzhiyun error = kernel_read(file, &ex, sizeof(ex), &pos);
254*4882a593Smuzhiyun if (error != sizeof(ex))
255*4882a593Smuzhiyun goto out;
256*4882a593Smuzhiyun
257*4882a593Smuzhiyun /* We come in here for the regular a.out style of shared libraries */
258*4882a593Smuzhiyun if ((N_MAGIC(ex) != ZMAGIC && N_MAGIC(ex) != QMAGIC) || N_TRSIZE(ex) ||
259*4882a593Smuzhiyun N_DRSIZE(ex) || ((ex.a_entry & 0xfff) && N_MAGIC(ex) == ZMAGIC) ||
260*4882a593Smuzhiyun i_size_read(file_inode(file)) <
261*4882a593Smuzhiyun ex.a_text+ex.a_data+N_SYMSIZE(ex)+N_TXTOFF(ex)) {
262*4882a593Smuzhiyun goto out;
263*4882a593Smuzhiyun }
264*4882a593Smuzhiyun
265*4882a593Smuzhiyun if (N_FLAGS(ex))
266*4882a593Smuzhiyun goto out;
267*4882a593Smuzhiyun
268*4882a593Smuzhiyun /* For QMAGIC, the starting address is 0x20 into the page. We mask
269*4882a593Smuzhiyun this off to get the starting address for the page */
270*4882a593Smuzhiyun
271*4882a593Smuzhiyun start_addr = ex.a_entry & 0xfffff000;
272*4882a593Smuzhiyun
273*4882a593Smuzhiyun if ((N_TXTOFF(ex) & ~PAGE_MASK) != 0) {
274*4882a593Smuzhiyun #ifdef WARN_OLD
275*4882a593Smuzhiyun static unsigned long error_time;
276*4882a593Smuzhiyun if (time_after(jiffies, error_time + 5*HZ)) {
277*4882a593Smuzhiyun printk(KERN_WARNING
278*4882a593Smuzhiyun "N_TXTOFF is not page aligned. Please convert "
279*4882a593Smuzhiyun "library: %pD\n",
280*4882a593Smuzhiyun file);
281*4882a593Smuzhiyun error_time = jiffies;
282*4882a593Smuzhiyun }
283*4882a593Smuzhiyun #endif
284*4882a593Smuzhiyun retval = vm_brk(start_addr, ex.a_text + ex.a_data + ex.a_bss);
285*4882a593Smuzhiyun if (retval)
286*4882a593Smuzhiyun goto out;
287*4882a593Smuzhiyun
288*4882a593Smuzhiyun read_code(file, start_addr, N_TXTOFF(ex),
289*4882a593Smuzhiyun ex.a_text + ex.a_data);
290*4882a593Smuzhiyun retval = 0;
291*4882a593Smuzhiyun goto out;
292*4882a593Smuzhiyun }
293*4882a593Smuzhiyun /* Now use mmap to map the library into memory. */
294*4882a593Smuzhiyun error = vm_mmap(file, start_addr, ex.a_text + ex.a_data,
295*4882a593Smuzhiyun PROT_READ | PROT_WRITE | PROT_EXEC,
296*4882a593Smuzhiyun MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_32BIT,
297*4882a593Smuzhiyun N_TXTOFF(ex));
298*4882a593Smuzhiyun retval = error;
299*4882a593Smuzhiyun if (error != start_addr)
300*4882a593Smuzhiyun goto out;
301*4882a593Smuzhiyun
302*4882a593Smuzhiyun len = PAGE_ALIGN(ex.a_text + ex.a_data);
303*4882a593Smuzhiyun bss = ex.a_text + ex.a_data + ex.a_bss;
304*4882a593Smuzhiyun if (bss > len) {
305*4882a593Smuzhiyun retval = vm_brk(start_addr + len, bss - len);
306*4882a593Smuzhiyun if (retval)
307*4882a593Smuzhiyun goto out;
308*4882a593Smuzhiyun }
309*4882a593Smuzhiyun retval = 0;
310*4882a593Smuzhiyun out:
311*4882a593Smuzhiyun return retval;
312*4882a593Smuzhiyun }
313*4882a593Smuzhiyun
init_aout_binfmt(void)314*4882a593Smuzhiyun static int __init init_aout_binfmt(void)
315*4882a593Smuzhiyun {
316*4882a593Smuzhiyun register_binfmt(&aout_format);
317*4882a593Smuzhiyun return 0;
318*4882a593Smuzhiyun }
319*4882a593Smuzhiyun
exit_aout_binfmt(void)320*4882a593Smuzhiyun static void __exit exit_aout_binfmt(void)
321*4882a593Smuzhiyun {
322*4882a593Smuzhiyun unregister_binfmt(&aout_format);
323*4882a593Smuzhiyun }
324*4882a593Smuzhiyun
325*4882a593Smuzhiyun module_init(init_aout_binfmt);
326*4882a593Smuzhiyun module_exit(exit_aout_binfmt);
327*4882a593Smuzhiyun MODULE_LICENSE("GPL");
328