2 * linux/fs/binfmt_elf.c
4 * These are the functions used to load ELF format executables as used
5 * on SVr4 machines. Information on the format may be found in the book
6 * "UNIX SYSTEM V RELEASE 4 Programmers Guide: Ansi C and Programming Support
9 * Copyright 1993, 1994: Eric Youngdale (ericy@cais.com).
12 #include <linux/module.h>
13 #include <linux/kernel.h>
16 #include <linux/mman.h>
17 #include <linux/errno.h>
18 #include <linux/signal.h>
19 #include <linux/binfmts.h>
20 #include <linux/string.h>
21 #include <linux/file.h>
22 #include <linux/slab.h>
23 #include <linux/personality.h>
24 #include <linux/elfcore.h>
25 #include <linux/init.h>
26 #include <linux/highuid.h>
27 #include <linux/compiler.h>
28 #include <linux/highmem.h>
29 #include <linux/pagemap.h>
30 #include <linux/security.h>
31 #include <linux/random.h>
32 #include <linux/elf.h>
33 #include <linux/utsname.h>
34 #include <linux/coredump.h>
35 #include <asm/uaccess.h>
36 #include <asm/param.h>
40 static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs);
41 static int load_elf_library(struct file *);
42 static unsigned long elf_map(struct file *, unsigned long, struct elf_phdr *,
43 int, int, unsigned long);
46 * If we don't support core dumping, then supply a NULL so we
49 #ifdef CONFIG_ELF_CORE
50 static int elf_core_dump(struct coredump_params *cprm);
52 #define elf_core_dump NULL
55 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
56 #define ELF_MIN_ALIGN ELF_EXEC_PAGESIZE
58 #define ELF_MIN_ALIGN PAGE_SIZE
61 #ifndef ELF_CORE_EFLAGS
62 #define ELF_CORE_EFLAGS 0
65 #define ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(ELF_MIN_ALIGN-1))
66 #define ELF_PAGEOFFSET(_v) ((_v) & (ELF_MIN_ALIGN-1))
67 #define ELF_PAGEALIGN(_v) (((_v) + ELF_MIN_ALIGN - 1) & ~(ELF_MIN_ALIGN - 1))
69 static struct linux_binfmt elf_format = {
70 .module = THIS_MODULE,
71 .load_binary = load_elf_binary,
72 .load_shlib = load_elf_library,
73 .core_dump = elf_core_dump,
74 .min_coredump = ELF_EXEC_PAGESIZE,
77 #define BAD_ADDR(x) ((unsigned long)(x) >= TASK_SIZE)
79 static int set_brk(unsigned long start, unsigned long end)
81 start = ELF_PAGEALIGN(start);
82 end = ELF_PAGEALIGN(end);
85 addr = vm_brk(start, end - start);
89 current->mm->start_brk = current->mm->brk = end;
93 /* We need to explicitly zero any fractional pages
94 after the data section (i.e. bss). This would
95 contain the junk from the file that should not
98 static int padzero(unsigned long elf_bss)
102 nbyte = ELF_PAGEOFFSET(elf_bss);
104 nbyte = ELF_MIN_ALIGN - nbyte;
105 if (clear_user((void __user *) elf_bss, nbyte))
111 /* Let's use some macros to make this stack manipulation a little clearer */
112 #ifdef CONFIG_STACK_GROWSUP
113 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) + (items))
114 #define STACK_ROUND(sp, items) \
115 ((15 + (unsigned long) ((sp) + (items))) &~ 15UL)
116 #define STACK_ALLOC(sp, len) ({ \
117 elf_addr_t __user *old_sp = (elf_addr_t __user *)sp; sp += len; \
120 #define STACK_ADD(sp, items) ((elf_addr_t __user *)(sp) - (items))
121 #define STACK_ROUND(sp, items) \
122 (((unsigned long) (sp - items)) &~ 15UL)
123 #define STACK_ALLOC(sp, len) ({ sp -= len ; sp; })
126 #ifndef ELF_BASE_PLATFORM
128 * AT_BASE_PLATFORM indicates the "real" hardware/microarchitecture.
129 * If the arch defines ELF_BASE_PLATFORM (in asm/elf.h), the value
130 * will be copied to the user stack in the same manner as AT_PLATFORM.
132 #define ELF_BASE_PLATFORM NULL
136 create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
137 unsigned long load_addr, unsigned long interp_load_addr)
139 unsigned long p = bprm->p;
140 int argc = bprm->argc;
141 int envc = bprm->envc;
142 elf_addr_t __user *argv;
143 elf_addr_t __user *envp;
144 elf_addr_t __user *sp;
145 elf_addr_t __user *u_platform;
146 elf_addr_t __user *u_base_platform;
147 elf_addr_t __user *u_rand_bytes;
148 const char *k_platform = ELF_PLATFORM;
149 const char *k_base_platform = ELF_BASE_PLATFORM;
150 unsigned char k_rand_bytes[16];
152 elf_addr_t *elf_info;
154 const struct cred *cred = current_cred();
155 struct vm_area_struct *vma;
158 * In some cases (e.g. Hyper-Threading), we want to avoid L1
159 * evictions by the processes running on the same package. One
160 * thing we can do is to shuffle the initial stack for them.
163 p = arch_align_stack(p);
166 * If this architecture has a platform capability string, copy it
167 * to userspace. In some cases (Sparc), this info is impossible
168 * for userspace to get any other way, in others (i386) it is
173 size_t len = strlen(k_platform) + 1;
175 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
176 if (__copy_to_user(u_platform, k_platform, len))
181 * If this architecture has a "base" platform capability
182 * string, copy it to userspace.
184 u_base_platform = NULL;
185 if (k_base_platform) {
186 size_t len = strlen(k_base_platform) + 1;
188 u_base_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);
189 if (__copy_to_user(u_base_platform, k_base_platform, len))
194 * Generate 16 random bytes for userspace PRNG seeding.
196 get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
197 u_rand_bytes = (elf_addr_t __user *)
198 STACK_ALLOC(p, sizeof(k_rand_bytes));
199 if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
202 /* Create the ELF interpreter info */
203 elf_info = (elf_addr_t *)current->mm->saved_auxv;
204 /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */
205 #define NEW_AUX_ENT(id, val) \
207 elf_info[ei_index++] = id; \
208 elf_info[ei_index++] = val; \
213 * ARCH_DLINFO must come first so PPC can do its special alignment of
215 * update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT() in
216 * ARCH_DLINFO changes
220 NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP);
221 NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE);
222 NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC);
223 NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff);
224 NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr));
225 NEW_AUX_ENT(AT_PHNUM, exec->e_phnum);
226 NEW_AUX_ENT(AT_BASE, interp_load_addr);
227 NEW_AUX_ENT(AT_FLAGS, 0);
228 NEW_AUX_ENT(AT_ENTRY, exec->e_entry);
229 NEW_AUX_ENT(AT_UID, from_kuid_munged(cred->user_ns, cred->uid));
230 NEW_AUX_ENT(AT_EUID, from_kuid_munged(cred->user_ns, cred->euid));
231 NEW_AUX_ENT(AT_GID, from_kgid_munged(cred->user_ns, cred->gid));
232 NEW_AUX_ENT(AT_EGID, from_kgid_munged(cred->user_ns, cred->egid));
233 NEW_AUX_ENT(AT_SECURE, security_bprm_secureexec(bprm));
234 NEW_AUX_ENT(AT_RANDOM, (elf_addr_t)(unsigned long)u_rand_bytes);
235 NEW_AUX_ENT(AT_EXECFN, bprm->exec);
237 NEW_AUX_ENT(AT_PLATFORM,
238 (elf_addr_t)(unsigned long)u_platform);
240 if (k_base_platform) {
241 NEW_AUX_ENT(AT_BASE_PLATFORM,
242 (elf_addr_t)(unsigned long)u_base_platform);
244 if (bprm->interp_flags & BINPRM_FLAGS_EXECFD) {
245 NEW_AUX_ENT(AT_EXECFD, bprm->interp_data);
248 /* AT_NULL is zero; clear the rest too */
249 memset(&elf_info[ei_index], 0,
250 sizeof current->mm->saved_auxv - ei_index * sizeof elf_info[0]);
252 /* And advance past the AT_NULL entry. */
255 sp = STACK_ADD(p, ei_index);
257 items = (argc + 1) + (envc + 1) + 1;
258 bprm->p = STACK_ROUND(sp, items);
260 /* Point sp at the lowest address on the stack */
261 #ifdef CONFIG_STACK_GROWSUP
262 sp = (elf_addr_t __user *)bprm->p - items - ei_index;
263 bprm->exec = (unsigned long)sp; /* XXX: PARISC HACK */
265 sp = (elf_addr_t __user *)bprm->p;
270 * Grow the stack manually; some architectures have a limit on how
271 * far ahead a user-space access may be in order to grow the stack.
273 vma = find_extend_vma(current->mm, bprm->p);
277 /* Now, let's put argc (and argv, envp if appropriate) on the stack */
278 if (__put_user(argc, sp++))
281 envp = argv + argc + 1;
283 /* Populate argv and envp */
284 p = current->mm->arg_end = current->mm->arg_start;
287 if (__put_user((elf_addr_t)p, argv++))
289 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
290 if (!len || len > MAX_ARG_STRLEN)
294 if (__put_user(0, argv))
296 current->mm->arg_end = current->mm->env_start = p;
299 if (__put_user((elf_addr_t)p, envp++))
301 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
302 if (!len || len > MAX_ARG_STRLEN)
306 if (__put_user(0, envp))
308 current->mm->env_end = p;
310 /* Put the elf_info on the stack in the right place. */
311 sp = (elf_addr_t __user *)envp + 1;
312 if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
317 static unsigned long elf_map(struct file *filep, unsigned long addr,
318 struct elf_phdr *eppnt, int prot, int type,
319 unsigned long total_size)
321 unsigned long map_addr;
322 unsigned long size = eppnt->p_filesz + ELF_PAGEOFFSET(eppnt->p_vaddr);
323 unsigned long off = eppnt->p_offset - ELF_PAGEOFFSET(eppnt->p_vaddr);
324 addr = ELF_PAGESTART(addr);
325 size = ELF_PAGEALIGN(size);
327 /* mmap() will return -EINVAL if given a zero size, but a
328 * segment with zero filesize is perfectly valid */
333 * total_size is the size of the ELF (interpreter) image.
334 * The _first_ mmap needs to know the full size, otherwise
335 * randomization might put this image into an overlapping
336 * position with the ELF binary image. (since size < total_size)
337 * So we first map the 'big' image - and unmap the remainder at
338 * the end. (which unmap is needed for ELF images with holes.)
341 total_size = ELF_PAGEALIGN(total_size);
342 map_addr = vm_mmap(filep, addr, total_size, prot, type, off);
343 if (!BAD_ADDR(map_addr))
344 vm_munmap(map_addr+size, total_size-size);
346 map_addr = vm_mmap(filep, addr, size, prot, type, off);
351 static unsigned long total_mapping_size(struct elf_phdr *cmds, int nr)
353 int i, first_idx = -1, last_idx = -1;
355 for (i = 0; i < nr; i++) {
356 if (cmds[i].p_type == PT_LOAD) {
365 return cmds[last_idx].p_vaddr + cmds[last_idx].p_memsz -
366 ELF_PAGESTART(cmds[first_idx].p_vaddr);
370 /* This is much more generalized than the library routine read function,
371 so we keep this separate. Technically the library read function
372 is only provided so that we can read a.out libraries that have
375 static unsigned long load_elf_interp(struct elfhdr *interp_elf_ex,
376 struct file *interpreter, unsigned long *interp_map_addr,
377 unsigned long no_base)
379 struct elf_phdr *elf_phdata;
380 struct elf_phdr *eppnt;
381 unsigned long load_addr = 0;
382 int load_addr_set = 0;
383 unsigned long last_bss = 0, elf_bss = 0;
384 unsigned long error = ~0UL;
385 unsigned long total_size;
388 /* First of all, some simple consistency checks */
389 if (interp_elf_ex->e_type != ET_EXEC &&
390 interp_elf_ex->e_type != ET_DYN)
392 if (!elf_check_arch(interp_elf_ex))
394 if (!interpreter->f_op || !interpreter->f_op->mmap)
398 * If the size of this structure has changed, then punt, since
399 * we will be doing the wrong thing.
401 if (interp_elf_ex->e_phentsize != sizeof(struct elf_phdr))
403 if (interp_elf_ex->e_phnum < 1 ||
404 interp_elf_ex->e_phnum > 65536U / sizeof(struct elf_phdr))
407 /* Now read in all of the header information */
408 size = sizeof(struct elf_phdr) * interp_elf_ex->e_phnum;
409 if (size > ELF_MIN_ALIGN)
411 elf_phdata = kmalloc(size, GFP_KERNEL);
415 retval = kernel_read(interpreter, interp_elf_ex->e_phoff,
416 (char *)elf_phdata, size);
418 if (retval != size) {
424 total_size = total_mapping_size(elf_phdata, interp_elf_ex->e_phnum);
431 for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
432 if (eppnt->p_type == PT_LOAD) {
433 int elf_type = MAP_PRIVATE | MAP_DENYWRITE;
435 unsigned long vaddr = 0;
436 unsigned long k, map_addr;
438 if (eppnt->p_flags & PF_R)
439 elf_prot = PROT_READ;
440 if (eppnt->p_flags & PF_W)
441 elf_prot |= PROT_WRITE;
442 if (eppnt->p_flags & PF_X)
443 elf_prot |= PROT_EXEC;
444 vaddr = eppnt->p_vaddr;
445 if (interp_elf_ex->e_type == ET_EXEC || load_addr_set)
446 elf_type |= MAP_FIXED;
447 else if (no_base && interp_elf_ex->e_type == ET_DYN)
450 map_addr = elf_map(interpreter, load_addr + vaddr,
451 eppnt, elf_prot, elf_type, total_size);
453 if (!*interp_map_addr)
454 *interp_map_addr = map_addr;
456 if (BAD_ADDR(map_addr))
459 if (!load_addr_set &&
460 interp_elf_ex->e_type == ET_DYN) {
461 load_addr = map_addr - ELF_PAGESTART(vaddr);
466 * Check to see if the section's size will overflow the
467 * allowed task size. Note that p_filesz must always be
468 * <= p_memsize so it's only necessary to check p_memsz.
470 k = load_addr + eppnt->p_vaddr;
472 eppnt->p_filesz > eppnt->p_memsz ||
473 eppnt->p_memsz > TASK_SIZE ||
474 TASK_SIZE - eppnt->p_memsz < k) {
480 * Find the end of the file mapping for this phdr, and
481 * keep track of the largest address we see for this.
483 k = load_addr + eppnt->p_vaddr + eppnt->p_filesz;
488 * Do the same thing for the memory mapping - between
489 * elf_bss and last_bss is the bss section.
491 k = load_addr + eppnt->p_memsz + eppnt->p_vaddr;
497 if (last_bss > elf_bss) {
499 * Now fill out the bss section. First pad the last page up
500 * to the page boundary, and then perform a mmap to make sure
501 * that there are zero-mapped pages up to and including the
504 if (padzero(elf_bss)) {
509 /* What we have mapped so far */
510 elf_bss = ELF_PAGESTART(elf_bss + ELF_MIN_ALIGN - 1);
512 /* Map the last of the bss segment */
513 error = vm_brk(elf_bss, last_bss - elf_bss);
527 * These are the functions used to load ELF style executables and shared
528 * libraries. There is no binary dependent code anywhere else.
531 #define INTERPRETER_NONE 0
532 #define INTERPRETER_ELF 2
534 #ifndef STACK_RND_MASK
535 #define STACK_RND_MASK (0x7ff >> (PAGE_SHIFT - 12)) /* 8MB of VA */
538 static unsigned long randomize_stack_top(unsigned long stack_top)
540 unsigned int random_variable = 0;
542 if ((current->flags & PF_RANDOMIZE) &&
543 !(current->personality & ADDR_NO_RANDOMIZE)) {
544 random_variable = get_random_int() & STACK_RND_MASK;
545 random_variable <<= PAGE_SHIFT;
547 #ifdef CONFIG_STACK_GROWSUP
548 return PAGE_ALIGN(stack_top) + random_variable;
550 return PAGE_ALIGN(stack_top) - random_variable;
554 static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
556 struct file *interpreter = NULL; /* to shut gcc up */
557 unsigned long load_addr = 0, load_bias = 0;
558 int load_addr_set = 0;
559 char * elf_interpreter = NULL;
561 struct elf_phdr *elf_ppnt, *elf_phdata;
562 unsigned long elf_bss, elf_brk;
565 unsigned long elf_entry;
566 unsigned long interp_load_addr = 0;
567 unsigned long start_code, end_code, start_data, end_data;
568 unsigned long reloc_func_desc __maybe_unused = 0;
569 int executable_stack = EXSTACK_DEFAULT;
570 unsigned long def_flags = 0;
572 struct elfhdr elf_ex;
573 struct elfhdr interp_elf_ex;
576 loc = kmalloc(sizeof(*loc), GFP_KERNEL);
582 /* Get the exec-header */
583 loc->elf_ex = *((struct elfhdr *)bprm->buf);
586 /* First of all, some simple consistency checks */
587 if (memcmp(loc->elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
590 if (loc->elf_ex.e_type != ET_EXEC && loc->elf_ex.e_type != ET_DYN)
592 if (!elf_check_arch(&loc->elf_ex))
594 if (!bprm->file->f_op || !bprm->file->f_op->mmap)
597 /* Now read in all of the header information */
598 if (loc->elf_ex.e_phentsize != sizeof(struct elf_phdr))
600 if (loc->elf_ex.e_phnum < 1 ||
601 loc->elf_ex.e_phnum > 65536U / sizeof(struct elf_phdr))
603 size = loc->elf_ex.e_phnum * sizeof(struct elf_phdr);
605 elf_phdata = kmalloc(size, GFP_KERNEL);
609 retval = kernel_read(bprm->file, loc->elf_ex.e_phoff,
610 (char *)elf_phdata, size);
611 if (retval != size) {
617 elf_ppnt = elf_phdata;
626 for (i = 0; i < loc->elf_ex.e_phnum; i++) {
627 if (elf_ppnt->p_type == PT_INTERP) {
628 /* This is the program interpreter used for
629 * shared libraries - for now assume that this
630 * is an a.out format binary
633 if (elf_ppnt->p_filesz > PATH_MAX ||
634 elf_ppnt->p_filesz < 2)
638 elf_interpreter = kmalloc(elf_ppnt->p_filesz,
640 if (!elf_interpreter)
643 retval = kernel_read(bprm->file, elf_ppnt->p_offset,
646 if (retval != elf_ppnt->p_filesz) {
649 goto out_free_interp;
651 /* make sure path is NULL terminated */
653 if (elf_interpreter[elf_ppnt->p_filesz - 1] != '\0')
654 goto out_free_interp;
656 interpreter = open_exec(elf_interpreter);
657 retval = PTR_ERR(interpreter);
658 if (IS_ERR(interpreter))
659 goto out_free_interp;
662 * If the binary is not readable then enforce
663 * mm->dumpable = 0 regardless of the interpreter's
666 would_dump(bprm, interpreter);
668 retval = kernel_read(interpreter, 0, bprm->buf,
670 if (retval != BINPRM_BUF_SIZE) {
673 goto out_free_dentry;
676 /* Get the exec headers */
677 loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);
683 elf_ppnt = elf_phdata;
684 for (i = 0; i < loc->elf_ex.e_phnum; i++, elf_ppnt++)
685 if (elf_ppnt->p_type == PT_GNU_STACK) {
686 if (elf_ppnt->p_flags & PF_X)
687 executable_stack = EXSTACK_ENABLE_X;
689 executable_stack = EXSTACK_DISABLE_X;
693 /* Some simple consistency checks for the interpreter */
694 if (elf_interpreter) {
696 /* Not an ELF interpreter */
697 if (memcmp(loc->interp_elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
698 goto out_free_dentry;
699 /* Verify the interpreter has a valid arch */
700 if (!elf_check_arch(&loc->interp_elf_ex))
701 goto out_free_dentry;
704 /* Flush all traces of the currently running executable */
705 retval = flush_old_exec(bprm);
707 goto out_free_dentry;
709 /* OK, This is the point of no return */
710 current->mm->def_flags = def_flags;
712 /* Do this immediately, since STACK_TOP as used in setup_arg_pages
713 may depend on the personality. */
714 SET_PERSONALITY(loc->elf_ex);
715 if (elf_read_implies_exec(loc->elf_ex, executable_stack))
716 current->personality |= READ_IMPLIES_EXEC;
718 if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
719 current->flags |= PF_RANDOMIZE;
721 setup_new_exec(bprm);
723 /* Do this so that we can load the interpreter, if need be. We will
724 change some of these later */
725 current->mm->free_area_cache = current->mm->mmap_base;
726 current->mm->cached_hole_size = 0;
727 retval = setup_arg_pages(bprm, randomize_stack_top(STACK_TOP),
730 send_sig(SIGKILL, current, 0);
731 goto out_free_dentry;
734 current->mm->start_stack = bprm->p;
736 /* Now we do a little grungy work by mmapping the ELF image into
737 the correct location in memory. */
738 for(i = 0, elf_ppnt = elf_phdata;
739 i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
740 int elf_prot = 0, elf_flags;
741 unsigned long k, vaddr;
743 if (elf_ppnt->p_type != PT_LOAD)
746 if (unlikely (elf_brk > elf_bss)) {
749 /* There was a PT_LOAD segment with p_memsz > p_filesz
750 before this one. Map anonymous pages, if needed,
751 and clear the area. */
752 retval = set_brk(elf_bss + load_bias,
753 elf_brk + load_bias);
755 send_sig(SIGKILL, current, 0);
756 goto out_free_dentry;
758 nbyte = ELF_PAGEOFFSET(elf_bss);
760 nbyte = ELF_MIN_ALIGN - nbyte;
761 if (nbyte > elf_brk - elf_bss)
762 nbyte = elf_brk - elf_bss;
763 if (clear_user((void __user *)elf_bss +
766 * This bss-zeroing can fail if the ELF
767 * file specifies odd protections. So
768 * we don't check the return value
774 if (elf_ppnt->p_flags & PF_R)
775 elf_prot |= PROT_READ;
776 if (elf_ppnt->p_flags & PF_W)
777 elf_prot |= PROT_WRITE;
778 if (elf_ppnt->p_flags & PF_X)
779 elf_prot |= PROT_EXEC;
781 elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE;
783 vaddr = elf_ppnt->p_vaddr;
784 if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) {
785 elf_flags |= MAP_FIXED;
786 } else if (loc->elf_ex.e_type == ET_DYN) {
787 /* Try and get dynamic programs out of the way of the
788 * default mmap base, as well as whatever program they
789 * might try to exec. This is because the brk will
790 * follow the loader, and is not movable. */
791 #ifdef CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE
792 /* Memory randomization might have been switched off
793 * in runtime via sysctl.
794 * If that is the case, retain the original non-zero
795 * load_bias value in order to establish proper
796 * non-randomized mappings.
798 if (current->flags & PF_RANDOMIZE)
801 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
803 load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
807 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
808 elf_prot, elf_flags, 0);
809 if (BAD_ADDR(error)) {
810 send_sig(SIGKILL, current, 0);
811 retval = IS_ERR((void *)error) ?
812 PTR_ERR((void*)error) : -EINVAL;
813 goto out_free_dentry;
816 if (!load_addr_set) {
818 load_addr = (elf_ppnt->p_vaddr - elf_ppnt->p_offset);
819 if (loc->elf_ex.e_type == ET_DYN) {
821 ELF_PAGESTART(load_bias + vaddr);
822 load_addr += load_bias;
823 reloc_func_desc = load_bias;
826 k = elf_ppnt->p_vaddr;
833 * Check to see if the section's size will overflow the
834 * allowed task size. Note that p_filesz must always be
835 * <= p_memsz so it is only necessary to check p_memsz.
837 if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
838 elf_ppnt->p_memsz > TASK_SIZE ||
839 TASK_SIZE - elf_ppnt->p_memsz < k) {
840 /* set_brk can never work. Avoid overflows. */
841 send_sig(SIGKILL, current, 0);
843 goto out_free_dentry;
846 k = elf_ppnt->p_vaddr + elf_ppnt->p_filesz;
850 if ((elf_ppnt->p_flags & PF_X) && end_code < k)
854 k = elf_ppnt->p_vaddr + elf_ppnt->p_memsz;
859 loc->elf_ex.e_entry += load_bias;
860 elf_bss += load_bias;
861 elf_brk += load_bias;
862 start_code += load_bias;
863 end_code += load_bias;
864 start_data += load_bias;
865 end_data += load_bias;
867 /* Calling set_brk effectively mmaps the pages that we need
868 * for the bss and break sections. We must do this before
869 * mapping in the interpreter, to make sure it doesn't wind
870 * up getting placed where the bss needs to go.
872 retval = set_brk(elf_bss, elf_brk);
874 send_sig(SIGKILL, current, 0);
875 goto out_free_dentry;
877 if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
878 send_sig(SIGSEGV, current, 0);
879 retval = -EFAULT; /* Nobody gets to see this, but.. */
880 goto out_free_dentry;
883 if (elf_interpreter) {
884 unsigned long uninitialized_var(interp_map_addr);
886 elf_entry = load_elf_interp(&loc->interp_elf_ex,
890 if (!IS_ERR((void *)elf_entry)) {
892 * load_elf_interp() returns relocation
895 interp_load_addr = elf_entry;
896 elf_entry += loc->interp_elf_ex.e_entry;
898 if (BAD_ADDR(elf_entry)) {
899 force_sig(SIGSEGV, current);
900 retval = IS_ERR((void *)elf_entry) ?
901 (int)elf_entry : -EINVAL;
902 goto out_free_dentry;
904 reloc_func_desc = interp_load_addr;
906 allow_write_access(interpreter);
908 kfree(elf_interpreter);
910 elf_entry = loc->elf_ex.e_entry;
911 if (BAD_ADDR(elf_entry)) {
912 force_sig(SIGSEGV, current);
914 goto out_free_dentry;
920 set_binfmt(&elf_format);
922 #ifdef ARCH_HAS_SETUP_ADDITIONAL_PAGES
923 retval = arch_setup_additional_pages(bprm, !!elf_interpreter);
925 send_sig(SIGKILL, current, 0);
928 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
930 install_exec_creds(bprm);
931 retval = create_elf_tables(bprm, &loc->elf_ex,
932 load_addr, interp_load_addr);
934 send_sig(SIGKILL, current, 0);
937 /* N.B. passed_fileno might not be initialized? */
938 current->mm->end_code = end_code;
939 current->mm->start_code = start_code;
940 current->mm->start_data = start_data;
941 current->mm->end_data = end_data;
942 current->mm->start_stack = bprm->p;
944 #ifdef arch_randomize_brk
945 if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
946 current->mm->brk = current->mm->start_brk =
947 arch_randomize_brk(current->mm);
948 #ifdef CONFIG_COMPAT_BRK
949 current->brk_randomized = 1;
954 if (current->personality & MMAP_PAGE_ZERO) {
955 /* Why this, you ask??? Well SVr4 maps page 0 as read-only,
956 and some applications "depend" upon this behavior.
957 Since we do not have the power to recompile these, we
958 emulate the SVr4 behavior. Sigh. */
959 error = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_EXEC,
960 MAP_FIXED | MAP_PRIVATE, 0);
965 * The ABI may specify that certain registers be set up in special
966 * ways (on i386 %edx is the address of a DT_FINI function, for
967 * example. In addition, it may also specify (eg, PowerPC64 ELF)
968 * that the e_entry field is the address of the function descriptor
969 * for the startup routine, rather than the address of the startup
970 * routine itself. This macro performs whatever initialization to
971 * the regs structure is required as well as any relocations to the
972 * function descriptor entries when executing dynamically links apps.
974 ELF_PLAT_INIT(regs, reloc_func_desc);
977 start_thread(regs, elf_entry, bprm->p);
986 allow_write_access(interpreter);
990 kfree(elf_interpreter);
996 /* This is really simpleminded and specialized - we are loading an
997 a.out library that is given an ELF header. */
998 static int load_elf_library(struct file *file)
1000 struct elf_phdr *elf_phdata;
1001 struct elf_phdr *eppnt;
1002 unsigned long elf_bss, bss, len;
1003 int retval, error, i, j;
1004 struct elfhdr elf_ex;
1007 retval = kernel_read(file, 0, (char *)&elf_ex, sizeof(elf_ex));
1008 if (retval != sizeof(elf_ex))
1011 if (memcmp(elf_ex.e_ident, ELFMAG, SELFMAG) != 0)
1014 /* First of all, some simple consistency checks */
1015 if (elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
1016 !elf_check_arch(&elf_ex) || !file->f_op || !file->f_op->mmap)
1019 /* Now read in all of the header information */
1021 j = sizeof(struct elf_phdr) * elf_ex.e_phnum;
1022 /* j < ELF_MIN_ALIGN because elf_ex.e_phnum <= 2 */
1025 elf_phdata = kmalloc(j, GFP_KERNEL);
1031 retval = kernel_read(file, elf_ex.e_phoff, (char *)eppnt, j);
1035 for (j = 0, i = 0; i<elf_ex.e_phnum; i++)
1036 if ((eppnt + i)->p_type == PT_LOAD)
1041 while (eppnt->p_type != PT_LOAD)
1044 /* Now use mmap to map the library into memory. */
1045 error = vm_mmap(file,
1046 ELF_PAGESTART(eppnt->p_vaddr),
1048 ELF_PAGEOFFSET(eppnt->p_vaddr)),
1049 PROT_READ | PROT_WRITE | PROT_EXEC,
1050 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE,
1052 ELF_PAGEOFFSET(eppnt->p_vaddr)));
1053 if (error != ELF_PAGESTART(eppnt->p_vaddr))
1056 elf_bss = eppnt->p_vaddr + eppnt->p_filesz;
1057 if (padzero(elf_bss)) {
1062 len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr +
1064 bss = eppnt->p_memsz + eppnt->p_vaddr;
1066 vm_brk(len, bss - len);
1075 #ifdef CONFIG_ELF_CORE
1079 * Modelled on fs/exec.c:aout_core_dump()
1080 * Jeremy Fitzhardinge <jeremy@sw.oz.au>
1084 * The purpose of always_dump_vma() is to make sure that special kernel mappings
1085 * that are useful for post-mortem analysis are included in every core dump.
1086 * In that way we ensure that the core dump is fully interpretable later
1087 * without matching up the same kernel and hardware config to see what PC values
1088 * meant. These special mappings include - vDSO, vsyscall, and other
1089 * architecture specific mappings
1091 static bool always_dump_vma(struct vm_area_struct *vma)
1093 /* Any vsyscall mappings? */
1094 if (vma == get_gate_vma(vma->vm_mm))
1097 * arch_vma_name() returns non-NULL for special architecture mappings,
1098 * such as vDSO sections.
1100 if (arch_vma_name(vma))
1107 * Decide what to dump of a segment, part, all or none.
1109 static unsigned long vma_dump_size(struct vm_area_struct *vma,
1110 unsigned long mm_flags)
1112 #define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
1114 /* always dump the vdso and vsyscall sections */
1115 if (always_dump_vma(vma))
1118 if (vma->vm_flags & VM_NODUMP)
1121 /* Hugetlb memory check */
1122 if (vma->vm_flags & VM_HUGETLB) {
1123 if ((vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_SHARED))
1125 if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE))
1129 /* Do not dump I/O mapped devices or special mappings */
1130 if (vma->vm_flags & (VM_IO | VM_RESERVED))
1133 /* By default, dump shared memory if mapped from an anonymous file. */
1134 if (vma->vm_flags & VM_SHARED) {
1135 if (vma->vm_file->f_path.dentry->d_inode->i_nlink == 0 ?
1136 FILTER(ANON_SHARED) : FILTER(MAPPED_SHARED))
1141 /* Dump segments that have been written to. */
1142 if (vma->anon_vma && FILTER(ANON_PRIVATE))
1144 if (vma->vm_file == NULL)
1147 if (FILTER(MAPPED_PRIVATE))
1151 * If this looks like the beginning of a DSO or executable mapping,
1152 * check for an ELF header. If we find one, dump the first page to
1153 * aid in determining what was mapped here.
1155 if (FILTER(ELF_HEADERS) &&
1156 vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
1157 u32 __user *header = (u32 __user *) vma->vm_start;
1159 mm_segment_t fs = get_fs();
1161 * Doing it this way gets the constant folded by GCC.
1165 char elfmag[SELFMAG];
1167 BUILD_BUG_ON(SELFMAG != sizeof word);
1168 magic.elfmag[EI_MAG0] = ELFMAG0;
1169 magic.elfmag[EI_MAG1] = ELFMAG1;
1170 magic.elfmag[EI_MAG2] = ELFMAG2;
1171 magic.elfmag[EI_MAG3] = ELFMAG3;
1173 * Switch to the user "segment" for get_user(),
1174 * then put back what elf_core_dump() had in place.
1177 if (unlikely(get_user(word, header)))
1180 if (word == magic.cmp)
1189 return vma->vm_end - vma->vm_start;
1192 /* An ELF note in memory */
1197 unsigned int datasz;
1201 static int notesize(struct memelfnote *en)
1205 sz = sizeof(struct elf_note);
1206 sz += roundup(strlen(en->name) + 1, 4);
1207 sz += roundup(en->datasz, 4);
1212 #define DUMP_WRITE(addr, nr, foffset) \
1213 do { if (!dump_write(file, (addr), (nr))) return 0; *foffset += (nr); } while(0)
1215 static int alignfile(struct file *file, loff_t *foffset)
1217 static const char buf[4] = { 0, };
1218 DUMP_WRITE(buf, roundup(*foffset, 4) - *foffset, foffset);
1222 static int writenote(struct memelfnote *men, struct file *file,
1226 en.n_namesz = strlen(men->name) + 1;
1227 en.n_descsz = men->datasz;
1228 en.n_type = men->type;
1230 DUMP_WRITE(&en, sizeof(en), foffset);
1231 DUMP_WRITE(men->name, en.n_namesz, foffset);
1232 if (!alignfile(file, foffset))
1234 DUMP_WRITE(men->data, men->datasz, foffset);
1235 if (!alignfile(file, foffset))
1242 static void fill_elf_header(struct elfhdr *elf, int segs,
1243 u16 machine, u32 flags, u8 osabi)
1245 memset(elf, 0, sizeof(*elf));
1247 memcpy(elf->e_ident, ELFMAG, SELFMAG);
1248 elf->e_ident[EI_CLASS] = ELF_CLASS;
1249 elf->e_ident[EI_DATA] = ELF_DATA;
1250 elf->e_ident[EI_VERSION] = EV_CURRENT;
1251 elf->e_ident[EI_OSABI] = ELF_OSABI;
1253 elf->e_type = ET_CORE;
1254 elf->e_machine = machine;
1255 elf->e_version = EV_CURRENT;
1256 elf->e_phoff = sizeof(struct elfhdr);
1257 elf->e_flags = flags;
1258 elf->e_ehsize = sizeof(struct elfhdr);
1259 elf->e_phentsize = sizeof(struct elf_phdr);
1260 elf->e_phnum = segs;
1265 static void fill_elf_note_phdr(struct elf_phdr *phdr, int sz, loff_t offset)
1267 phdr->p_type = PT_NOTE;
1268 phdr->p_offset = offset;
1271 phdr->p_filesz = sz;
1278 static void fill_note(struct memelfnote *note, const char *name, int type,
1279 unsigned int sz, void *data)
1289 * fill up all the fields in prstatus from the given task struct, except
1290 * registers which need to be filled up separately.
1292 static void fill_prstatus(struct elf_prstatus *prstatus,
1293 struct task_struct *p, long signr)
1295 prstatus->pr_info.si_signo = prstatus->pr_cursig = signr;
1296 prstatus->pr_sigpend = p->pending.signal.sig[0];
1297 prstatus->pr_sighold = p->blocked.sig[0];
1299 prstatus->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1301 prstatus->pr_pid = task_pid_vnr(p);
1302 prstatus->pr_pgrp = task_pgrp_vnr(p);
1303 prstatus->pr_sid = task_session_vnr(p);
1304 if (thread_group_leader(p)) {
1305 struct task_cputime cputime;
1308 * This is the record for the group leader. It shows the
1309 * group-wide total, not its individual thread total.
1311 thread_group_cputime(p, &cputime);
1312 cputime_to_timeval(cputime.utime, &prstatus->pr_utime);
1313 cputime_to_timeval(cputime.stime, &prstatus->pr_stime);
1315 cputime_to_timeval(p->utime, &prstatus->pr_utime);
1316 cputime_to_timeval(p->stime, &prstatus->pr_stime);
1318 cputime_to_timeval(p->signal->cutime, &prstatus->pr_cutime);
1319 cputime_to_timeval(p->signal->cstime, &prstatus->pr_cstime);
1322 static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p,
1323 struct mm_struct *mm)
1325 const struct cred *cred;
1326 unsigned int i, len;
1328 /* first copy the parameters from user space */
1329 memset(psinfo, 0, sizeof(struct elf_prpsinfo));
1331 len = mm->arg_end - mm->arg_start;
1332 if (len >= ELF_PRARGSZ)
1333 len = ELF_PRARGSZ-1;
1334 if (copy_from_user(&psinfo->pr_psargs,
1335 (const char __user *)mm->arg_start, len))
1337 for(i = 0; i < len; i++)
1338 if (psinfo->pr_psargs[i] == 0)
1339 psinfo->pr_psargs[i] = ' ';
1340 psinfo->pr_psargs[len] = 0;
1343 psinfo->pr_ppid = task_pid_vnr(rcu_dereference(p->real_parent));
1345 psinfo->pr_pid = task_pid_vnr(p);
1346 psinfo->pr_pgrp = task_pgrp_vnr(p);
1347 psinfo->pr_sid = task_session_vnr(p);
1349 i = p->state ? ffz(~p->state) + 1 : 0;
1350 psinfo->pr_state = i;
1351 psinfo->pr_sname = (i > 5) ? '.' : "RSDTZW"[i];
1352 psinfo->pr_zomb = psinfo->pr_sname == 'Z';
1353 psinfo->pr_nice = task_nice(p);
1354 psinfo->pr_flag = p->flags;
1356 cred = __task_cred(p);
1357 SET_UID(psinfo->pr_uid, from_kuid_munged(cred->user_ns, cred->uid));
1358 SET_GID(psinfo->pr_gid, from_kgid_munged(cred->user_ns, cred->gid));
1360 strncpy(psinfo->pr_fname, p->comm, sizeof(psinfo->pr_fname));
1365 static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
1367 elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
1371 while (auxv[i - 2] != AT_NULL);
1372 fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
1375 #ifdef CORE_DUMP_USE_REGSET
1376 #include <linux/regset.h>
1378 struct elf_thread_core_info {
1379 struct elf_thread_core_info *next;
1380 struct task_struct *task;
1381 struct elf_prstatus prstatus;
1382 struct memelfnote notes[0];
1385 struct elf_note_info {
1386 struct elf_thread_core_info *thread;
1387 struct memelfnote psinfo;
1388 struct memelfnote auxv;
1394 * When a regset has a writeback hook, we call it on each thread before
1395 * dumping user memory. On register window machines, this makes sure the
1396 * user memory backing the register data is up to date before we read it.
1398 static void do_thread_regset_writeback(struct task_struct *task,
1399 const struct user_regset *regset)
1401 if (regset->writeback)
1402 regset->writeback(task, regset, 1);
1406 #define PR_REG_SIZE(S) sizeof(S)
1409 #ifndef PRSTATUS_SIZE
1410 #define PRSTATUS_SIZE(S) sizeof(S)
1414 #define PR_REG_PTR(S) (&((S)->pr_reg))
1417 #ifndef SET_PR_FPVALID
1418 #define SET_PR_FPVALID(S, V) ((S)->pr_fpvalid = (V))
1421 static int fill_thread_core_info(struct elf_thread_core_info *t,
1422 const struct user_regset_view *view,
1423 long signr, size_t *total)
1428 * NT_PRSTATUS is the one special case, because the regset data
1429 * goes into the pr_reg field inside the note contents, rather
1430 * than being the whole note contents. We fill the reset in here.
1431 * We assume that regset 0 is NT_PRSTATUS.
1433 fill_prstatus(&t->prstatus, t->task, signr);
1434 (void) view->regsets[0].get(t->task, &view->regsets[0],
1435 0, PR_REG_SIZE(t->prstatus.pr_reg),
1436 PR_REG_PTR(&t->prstatus), NULL);
1438 fill_note(&t->notes[0], "CORE", NT_PRSTATUS,
1439 PRSTATUS_SIZE(t->prstatus), &t->prstatus);
1440 *total += notesize(&t->notes[0]);
1442 do_thread_regset_writeback(t->task, &view->regsets[0]);
1445 * Each other regset might generate a note too. For each regset
1446 * that has no core_note_type or is inactive, we leave t->notes[i]
1447 * all zero and we'll know to skip writing it later.
1449 for (i = 1; i < view->n; ++i) {
1450 const struct user_regset *regset = &view->regsets[i];
1451 do_thread_regset_writeback(t->task, regset);
1452 if (regset->core_note_type && regset->get &&
1453 (!regset->active || regset->active(t->task, regset))) {
1455 size_t size = regset->n * regset->size;
1456 void *data = kmalloc(size, GFP_KERNEL);
1457 if (unlikely(!data))
1459 ret = regset->get(t->task, regset,
1460 0, size, data, NULL);
1464 if (regset->core_note_type != NT_PRFPREG)
1465 fill_note(&t->notes[i], "LINUX",
1466 regset->core_note_type,
1469 SET_PR_FPVALID(&t->prstatus, 1);
1470 fill_note(&t->notes[i], "CORE",
1471 NT_PRFPREG, size, data);
1473 *total += notesize(&t->notes[i]);
1481 static int fill_note_info(struct elfhdr *elf, int phdrs,
1482 struct elf_note_info *info,
1483 long signr, struct pt_regs *regs)
1485 struct task_struct *dump_task = current;
1486 const struct user_regset_view *view = task_user_regset_view(dump_task);
1487 struct elf_thread_core_info *t;
1488 struct elf_prpsinfo *psinfo;
1489 struct core_thread *ct;
1493 info->thread = NULL;
1495 psinfo = kmalloc(sizeof(*psinfo), GFP_KERNEL);
1499 fill_note(&info->psinfo, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo);
1502 * Figure out how many notes we're going to need for each thread.
1504 info->thread_notes = 0;
1505 for (i = 0; i < view->n; ++i)
1506 if (view->regsets[i].core_note_type != 0)
1507 ++info->thread_notes;
1510 * Sanity check. We rely on regset 0 being in NT_PRSTATUS,
1511 * since it is our one special case.
1513 if (unlikely(info->thread_notes == 0) ||
1514 unlikely(view->regsets[0].core_note_type != NT_PRSTATUS)) {
1520 * Initialize the ELF file header.
1522 fill_elf_header(elf, phdrs,
1523 view->e_machine, view->e_flags, view->ei_osabi);
1526 * Allocate a structure for each thread.
1528 for (ct = &dump_task->mm->core_state->dumper; ct; ct = ct->next) {
1529 t = kzalloc(offsetof(struct elf_thread_core_info,
1530 notes[info->thread_notes]),
1536 if (ct->task == dump_task || !info->thread) {
1537 t->next = info->thread;
1541 * Make sure to keep the original task at
1542 * the head of the list.
1544 t->next = info->thread->next;
1545 info->thread->next = t;
1550 * Now fill in each thread's information.
1552 for (t = info->thread; t != NULL; t = t->next)
1553 if (!fill_thread_core_info(t, view, signr, &info->size))
1557 * Fill in the two process-wide notes.
1559 fill_psinfo(psinfo, dump_task->group_leader, dump_task->mm);
1560 info->size += notesize(&info->psinfo);
1562 fill_auxv_note(&info->auxv, current->mm);
1563 info->size += notesize(&info->auxv);
1568 static size_t get_note_info_size(struct elf_note_info *info)
1574 * Write all the notes for each thread. When writing the first thread, the
1575 * process-wide notes are interleaved after the first thread-specific note.
1577 static int write_note_info(struct elf_note_info *info,
1578 struct file *file, loff_t *foffset)
1581 struct elf_thread_core_info *t = info->thread;
1586 if (!writenote(&t->notes[0], file, foffset))
1589 if (first && !writenote(&info->psinfo, file, foffset))
1591 if (first && !writenote(&info->auxv, file, foffset))
1594 for (i = 1; i < info->thread_notes; ++i)
1595 if (t->notes[i].data &&
1596 !writenote(&t->notes[i], file, foffset))
1606 static void free_note_info(struct elf_note_info *info)
1608 struct elf_thread_core_info *threads = info->thread;
1611 struct elf_thread_core_info *t = threads;
1613 WARN_ON(t->notes[0].data && t->notes[0].data != &t->prstatus);
1614 for (i = 1; i < info->thread_notes; ++i)
1615 kfree(t->notes[i].data);
1618 kfree(info->psinfo.data);
1623 /* Here is the structure in which status of each thread is captured. */
1624 struct elf_thread_status
1626 struct list_head list;
1627 struct elf_prstatus prstatus; /* NT_PRSTATUS */
1628 elf_fpregset_t fpu; /* NT_PRFPREG */
1629 struct task_struct *thread;
1630 #ifdef ELF_CORE_COPY_XFPREGS
1631 elf_fpxregset_t xfpu; /* ELF_CORE_XFPREG_TYPE */
1633 struct memelfnote notes[3];
1638 * In order to add the specific thread information for the elf file format,
1639 * we need to keep a linked list of every threads pr_status and then create
1640 * a single section for them in the final core file.
1642 static int elf_dump_thread_status(long signr, struct elf_thread_status *t)
1645 struct task_struct *p = t->thread;
1648 fill_prstatus(&t->prstatus, p, signr);
1649 elf_core_copy_task_regs(p, &t->prstatus.pr_reg);
1651 fill_note(&t->notes[0], "CORE", NT_PRSTATUS, sizeof(t->prstatus),
1654 sz += notesize(&t->notes[0]);
1656 if ((t->prstatus.pr_fpvalid = elf_core_copy_task_fpregs(p, NULL,
1658 fill_note(&t->notes[1], "CORE", NT_PRFPREG, sizeof(t->fpu),
1661 sz += notesize(&t->notes[1]);
1664 #ifdef ELF_CORE_COPY_XFPREGS
1665 if (elf_core_copy_task_xfpregs(p, &t->xfpu)) {
1666 fill_note(&t->notes[2], "LINUX", ELF_CORE_XFPREG_TYPE,
1667 sizeof(t->xfpu), &t->xfpu);
1669 sz += notesize(&t->notes[2]);
1675 struct elf_note_info {
1676 struct memelfnote *notes;
1677 struct elf_prstatus *prstatus; /* NT_PRSTATUS */
1678 struct elf_prpsinfo *psinfo; /* NT_PRPSINFO */
1679 struct list_head thread_list;
1680 elf_fpregset_t *fpu;
1681 #ifdef ELF_CORE_COPY_XFPREGS
1682 elf_fpxregset_t *xfpu;
1684 int thread_status_size;
1688 static int elf_note_info_init(struct elf_note_info *info)
1690 memset(info, 0, sizeof(*info));
1691 INIT_LIST_HEAD(&info->thread_list);
1693 /* Allocate space for six ELF notes */
1694 info->notes = kmalloc(6 * sizeof(struct memelfnote), GFP_KERNEL);
1697 info->psinfo = kmalloc(sizeof(*info->psinfo), GFP_KERNEL);
1700 info->prstatus = kmalloc(sizeof(*info->prstatus), GFP_KERNEL);
1701 if (!info->prstatus)
1703 info->fpu = kmalloc(sizeof(*info->fpu), GFP_KERNEL);
1706 #ifdef ELF_CORE_COPY_XFPREGS
1707 info->xfpu = kmalloc(sizeof(*info->xfpu), GFP_KERNEL);
1712 #ifdef ELF_CORE_COPY_XFPREGS
1717 kfree(info->prstatus);
1719 kfree(info->psinfo);
1725 static int fill_note_info(struct elfhdr *elf, int phdrs,
1726 struct elf_note_info *info,
1727 long signr, struct pt_regs *regs)
1729 struct list_head *t;
1731 if (!elf_note_info_init(info))
1735 struct core_thread *ct;
1736 struct elf_thread_status *ets;
1738 for (ct = current->mm->core_state->dumper.next;
1739 ct; ct = ct->next) {
1740 ets = kzalloc(sizeof(*ets), GFP_KERNEL);
1744 ets->thread = ct->task;
1745 list_add(&ets->list, &info->thread_list);
1748 list_for_each(t, &info->thread_list) {
1751 ets = list_entry(t, struct elf_thread_status, list);
1752 sz = elf_dump_thread_status(signr, ets);
1753 info->thread_status_size += sz;
1756 /* now collect the dump for the current */
1757 memset(info->prstatus, 0, sizeof(*info->prstatus));
1758 fill_prstatus(info->prstatus, current, signr);
1759 elf_core_copy_regs(&info->prstatus->pr_reg, regs);
1762 fill_elf_header(elf, phdrs, ELF_ARCH, ELF_CORE_EFLAGS, ELF_OSABI);
1765 * Set up the notes in similar form to SVR4 core dumps made
1766 * with info from their /proc.
1769 fill_note(info->notes + 0, "CORE", NT_PRSTATUS,
1770 sizeof(*info->prstatus), info->prstatus);
1771 fill_psinfo(info->psinfo, current->group_leader, current->mm);
1772 fill_note(info->notes + 1, "CORE", NT_PRPSINFO,
1773 sizeof(*info->psinfo), info->psinfo);
1777 fill_auxv_note(&info->notes[info->numnote++], current->mm);
1779 /* Try to dump the FPU. */
1780 info->prstatus->pr_fpvalid = elf_core_copy_task_fpregs(current, regs,
1782 if (info->prstatus->pr_fpvalid)
1783 fill_note(info->notes + info->numnote++,
1784 "CORE", NT_PRFPREG, sizeof(*info->fpu), info->fpu);
1785 #ifdef ELF_CORE_COPY_XFPREGS
1786 if (elf_core_copy_task_xfpregs(current, info->xfpu))
1787 fill_note(info->notes + info->numnote++,
1788 "LINUX", ELF_CORE_XFPREG_TYPE,
1789 sizeof(*info->xfpu), info->xfpu);
1795 static size_t get_note_info_size(struct elf_note_info *info)
1800 for (i = 0; i < info->numnote; i++)
1801 sz += notesize(info->notes + i);
1803 sz += info->thread_status_size;
1808 static int write_note_info(struct elf_note_info *info,
1809 struct file *file, loff_t *foffset)
1812 struct list_head *t;
1814 for (i = 0; i < info->numnote; i++)
1815 if (!writenote(info->notes + i, file, foffset))
1818 /* write out the thread status notes section */
1819 list_for_each(t, &info->thread_list) {
1820 struct elf_thread_status *tmp =
1821 list_entry(t, struct elf_thread_status, list);
1823 for (i = 0; i < tmp->num_notes; i++)
1824 if (!writenote(&tmp->notes[i], file, foffset))
1831 static void free_note_info(struct elf_note_info *info)
1833 while (!list_empty(&info->thread_list)) {
1834 struct list_head *tmp = info->thread_list.next;
1836 kfree(list_entry(tmp, struct elf_thread_status, list));
1839 kfree(info->prstatus);
1840 kfree(info->psinfo);
1843 #ifdef ELF_CORE_COPY_XFPREGS
1850 static struct vm_area_struct *first_vma(struct task_struct *tsk,
1851 struct vm_area_struct *gate_vma)
1853 struct vm_area_struct *ret = tsk->mm->mmap;
1860 * Helper function for iterating across a vma list. It ensures that the caller
1861 * will visit `gate_vma' prior to terminating the search.
1863 static struct vm_area_struct *next_vma(struct vm_area_struct *this_vma,
1864 struct vm_area_struct *gate_vma)
1866 struct vm_area_struct *ret;
1868 ret = this_vma->vm_next;
1871 if (this_vma == gate_vma)
1876 static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
1877 elf_addr_t e_shoff, int segs)
1879 elf->e_shoff = e_shoff;
1880 elf->e_shentsize = sizeof(*shdr4extnum);
1882 elf->e_shstrndx = SHN_UNDEF;
1884 memset(shdr4extnum, 0, sizeof(*shdr4extnum));
1886 shdr4extnum->sh_type = SHT_NULL;
1887 shdr4extnum->sh_size = elf->e_shnum;
1888 shdr4extnum->sh_link = elf->e_shstrndx;
1889 shdr4extnum->sh_info = segs;
1892 static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
1893 unsigned long mm_flags)
1895 struct vm_area_struct *vma;
1898 for (vma = first_vma(current, gate_vma); vma != NULL;
1899 vma = next_vma(vma, gate_vma))
1900 size += vma_dump_size(vma, mm_flags);
1907 * This is a two-pass process; first we find the offsets of the bits,
1908 * and then they are actually written out. If we run out of core limit
1911 static int elf_core_dump(struct coredump_params *cprm)
1917 struct vm_area_struct *vma, *gate_vma;
1918 struct elfhdr *elf = NULL;
1919 loff_t offset = 0, dataoff, foffset;
1920 struct elf_note_info info;
1921 struct elf_phdr *phdr4note = NULL;
1922 struct elf_shdr *shdr4extnum = NULL;
1927 * We no longer stop all VM operations.
1929 * This is because those proceses that could possibly change map_count
1930 * or the mmap / vma pages are now blocked in do_exit on current
1931 * finishing this core dump.
1933 * Only ptrace can touch these memory addresses, but it doesn't change
1934 * the map_count or the pages allocated. So no possibility of crashing
1935 * exists while dumping the mm->vm_next areas to the core file.
1938 /* alloc memory for large data structures: too large to be on stack */
1939 elf = kmalloc(sizeof(*elf), GFP_KERNEL);
1943 * The number of segs are recored into ELF header as 16bit value.
1944 * Please check DEFAULT_MAX_MAP_COUNT definition when you modify here.
1946 segs = current->mm->map_count;
1947 segs += elf_core_extra_phdrs();
1949 gate_vma = get_gate_vma(current->mm);
1950 if (gate_vma != NULL)
1953 /* for notes section */
1956 /* If segs > PN_XNUM(0xffff), then e_phnum overflows. To avoid
1957 * this, kernel supports extended numbering. Have a look at
1958 * include/linux/elf.h for further information. */
1959 e_phnum = segs > PN_XNUM ? PN_XNUM : segs;
1962 * Collect all the non-memory information about the process for the
1963 * notes. This also sets up the file header.
1965 if (!fill_note_info(elf, e_phnum, &info, cprm->signr, cprm->regs))
1969 current->flags |= PF_DUMPCORE;
1974 offset += sizeof(*elf); /* Elf header */
1975 offset += segs * sizeof(struct elf_phdr); /* Program headers */
1978 /* Write notes phdr entry */
1980 size_t sz = get_note_info_size(&info);
1982 sz += elf_coredump_extra_notes_size();
1984 phdr4note = kmalloc(sizeof(*phdr4note), GFP_KERNEL);
1988 fill_elf_note_phdr(phdr4note, sz, offset);
1992 dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
1994 offset += elf_core_vma_data_size(gate_vma, cprm->mm_flags);
1995 offset += elf_core_extra_data_size();
1998 if (e_phnum == PN_XNUM) {
1999 shdr4extnum = kmalloc(sizeof(*shdr4extnum), GFP_KERNEL);
2002 fill_extnum_info(elf, shdr4extnum, e_shoff, segs);
2007 size += sizeof(*elf);
2008 if (size > cprm->limit || !dump_write(cprm->file, elf, sizeof(*elf)))
2011 size += sizeof(*phdr4note);
2012 if (size > cprm->limit
2013 || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
2016 /* Write program headers for segments dump */
2017 for (vma = first_vma(current, gate_vma); vma != NULL;
2018 vma = next_vma(vma, gate_vma)) {
2019 struct elf_phdr phdr;
2021 phdr.p_type = PT_LOAD;
2022 phdr.p_offset = offset;
2023 phdr.p_vaddr = vma->vm_start;
2025 phdr.p_filesz = vma_dump_size(vma, cprm->mm_flags);
2026 phdr.p_memsz = vma->vm_end - vma->vm_start;
2027 offset += phdr.p_filesz;
2028 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
2029 if (vma->vm_flags & VM_WRITE)
2030 phdr.p_flags |= PF_W;
2031 if (vma->vm_flags & VM_EXEC)
2032 phdr.p_flags |= PF_X;
2033 phdr.p_align = ELF_EXEC_PAGESIZE;
2035 size += sizeof(phdr);
2036 if (size > cprm->limit
2037 || !dump_write(cprm->file, &phdr, sizeof(phdr)))
2041 if (!elf_core_write_extra_phdrs(cprm->file, offset, &size, cprm->limit))
2044 /* write out the notes section */
2045 if (!write_note_info(&info, cprm->file, &foffset))
2048 if (elf_coredump_extra_notes_write(cprm->file, &foffset))
2052 if (!dump_seek(cprm->file, dataoff - foffset))
2055 for (vma = first_vma(current, gate_vma); vma != NULL;
2056 vma = next_vma(vma, gate_vma)) {
2060 end = vma->vm_start + vma_dump_size(vma, cprm->mm_flags);
2062 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
2066 page = get_dump_page(addr);
2068 void *kaddr = kmap(page);
2069 stop = ((size += PAGE_SIZE) > cprm->limit) ||
2070 !dump_write(cprm->file, kaddr,
2073 page_cache_release(page);
2075 stop = !dump_seek(cprm->file, PAGE_SIZE);
2081 if (!elf_core_write_extra_data(cprm->file, &size, cprm->limit))
2084 if (e_phnum == PN_XNUM) {
2085 size += sizeof(*shdr4extnum);
2086 if (size > cprm->limit
2087 || !dump_write(cprm->file, shdr4extnum,
2088 sizeof(*shdr4extnum)))
2096 free_note_info(&info);
2104 #endif /* CONFIG_ELF_CORE */
2106 static int __init init_elf_binfmt(void)
2108 register_binfmt(&elf_format);
2112 static void __exit exit_elf_binfmt(void)
2114 /* Remove the COFF and ELF loaders. */
2115 unregister_binfmt(&elf_format);
2118 core_initcall(init_elf_binfmt);
2119 module_exit(exit_elf_binfmt);
2120 MODULE_LICENSE("GPL");