xref: /freebsd/sys/kern/imgact_elf.c (revision c1462236787ec09d00d5e2d222edc3e34bce1e69)
1 /*-
2  * Copyright (c) 1995-1996 S�ren Schmidt
3  * Copyright (c) 1996 Peter Wemm
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer
11  *    in this position and unchanged.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. The name of the author may not be used to endorse or promote products
16  *    derived from this software withough specific prior written permission
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28  *
29  * $FreeBSD$
30  */
31 
32 #include "opt_rlimit.h"
33 
34 #include <sys/param.h>
35 #include <sys/exec.h>
36 #include <sys/fcntl.h>
37 #include <sys/imgact.h>
38 #include <sys/imgact_elf.h>
39 #include <sys/kernel.h>
40 #include <sys/malloc.h>
41 #include <sys/mman.h>
42 #include <sys/namei.h>
43 #include <sys/pioctl.h>
44 #include <sys/proc.h>
45 #include <sys/procfs.h>
46 #include <sys/resourcevar.h>
47 #include <sys/signalvar.h>
48 #include <sys/stat.h>
49 #include <sys/syscall.h>
50 #include <sys/sysctl.h>
51 #include <sys/sysent.h>
52 #include <sys/systm.h>
53 #include <sys/vnode.h>
54 
55 #include <vm/vm.h>
56 #include <vm/vm_kern.h>
57 #include <vm/vm_param.h>
58 #include <vm/pmap.h>
59 #include <sys/lock.h>
60 #include <vm/vm_map.h>
61 #include <vm/vm_object.h>
62 #include <vm/vm_extern.h>
63 
64 #include <machine/elf.h>
65 #include <machine/md_var.h>
66 
67 #define OLD_EI_BRAND	8
68 
69 __ElfType(Brandinfo);
70 __ElfType(Auxargs);
71 
72 static int elf_check_header __P((const Elf_Ehdr *hdr));
73 static int elf_freebsd_fixup __P((register_t **stack_base,
74     struct image_params *imgp));
75 static int elf_load_file __P((struct proc *p, const char *file, u_long *addr,
76     u_long *entry));
77 static int elf_load_section __P((struct proc *p,
78     struct vmspace *vmspace, struct vnode *vp,
79     vm_offset_t offset, caddr_t vmaddr, size_t memsz, size_t filsz,
80     vm_prot_t prot));
81 static int exec_elf_imgact __P((struct image_params *imgp));
82 
83 static int elf_trace = 0;
84 SYSCTL_INT(_debug, OID_AUTO, elf_trace, CTLFLAG_RW, &elf_trace, 0, "");
85 
86 static struct sysentvec elf_freebsd_sysvec = {
87         SYS_MAXSYSCALL,
88         sysent,
89         0,
90         0,
91         0,
92         0,
93         0,
94         0,
95         elf_freebsd_fixup,
96         sendsig,
97         sigcode,
98         &szsigcode,
99         0,
100 	"FreeBSD ELF",
101 	elf_coredump
102 };
103 
104 static Elf_Brandinfo freebsd_brand_info = {
105 						ELFOSABI_FREEBSD,
106 						"",
107 						"/usr/libexec/ld-elf.so.1",
108 						&elf_freebsd_sysvec
109 					  };
110 static Elf_Brandinfo *elf_brand_list[MAX_BRANDS] = {
111 							&freebsd_brand_info,
112 							NULL, NULL, NULL,
113 							NULL, NULL, NULL, NULL
114 						    };
115 
116 int
117 elf_insert_brand_entry(Elf_Brandinfo *entry)
118 {
119 	int i;
120 
121 	for (i=1; i<MAX_BRANDS; i++) {
122 		if (elf_brand_list[i] == NULL) {
123 			elf_brand_list[i] = entry;
124 			break;
125 		}
126 	}
127 	if (i == MAX_BRANDS)
128 		return -1;
129 	return 0;
130 }
131 
132 int
133 elf_remove_brand_entry(Elf_Brandinfo *entry)
134 {
135 	int i;
136 
137 	for (i=1; i<MAX_BRANDS; i++) {
138 		if (elf_brand_list[i] == entry) {
139 			elf_brand_list[i] = NULL;
140 			break;
141 		}
142 	}
143 	if (i == MAX_BRANDS)
144 		return -1;
145 	return 0;
146 }
147 
148 int
149 elf_brand_inuse(Elf_Brandinfo *entry)
150 {
151 	struct proc *p;
152 
153 	LIST_FOREACH(p, &allproc, p_list) {
154 		if (p->p_sysent == entry->sysvec)
155 			return TRUE;
156 	}
157 
158 	return FALSE;
159 }
160 
161 static int
162 elf_check_header(const Elf_Ehdr *hdr)
163 {
164 	if (!IS_ELF(*hdr) ||
165 	    hdr->e_ident[EI_CLASS] != ELF_TARG_CLASS ||
166 	    hdr->e_ident[EI_DATA] != ELF_TARG_DATA ||
167 	    hdr->e_ident[EI_VERSION] != EV_CURRENT)
168 		return ENOEXEC;
169 
170 	if (!ELF_MACHINE_OK(hdr->e_machine))
171 		return ENOEXEC;
172 
173 	if (hdr->e_version != ELF_TARG_VER)
174 		return ENOEXEC;
175 
176 	return 0;
177 }
178 
179 static int
180 elf_load_section(struct proc *p, struct vmspace *vmspace, struct vnode *vp, vm_offset_t offset, caddr_t vmaddr, size_t memsz, size_t filsz, vm_prot_t prot)
181 {
182 	size_t map_len;
183 	vm_offset_t map_addr;
184 	int error, rv;
185 	size_t copy_len;
186 	vm_object_t object;
187 	vm_offset_t file_addr;
188 	vm_offset_t data_buf = 0;
189 
190 	object = vp->v_object;
191 	error = 0;
192 
193 	/*
194 	 * It's necessary to fail if the filsz + offset taken from the
195 	 * header is greater than the actual file pager object's size.
196 	 * If we were to allow this, then the vm_map_find() below would
197 	 * walk right off the end of the file object and into the ether.
198 	 *
199 	 * While I'm here, might as well check for something else that
200 	 * is invalid: filsz cannot be greater than memsz.
201 	 */
202 	if ((off_t)filsz + offset > object->un_pager.vnp.vnp_size ||
203 	    filsz > memsz) {
204 		uprintf("elf_load_section: truncated ELF file\n");
205 		return (ENOEXEC);
206 	}
207 
208 	map_addr = trunc_page((vm_offset_t)vmaddr);
209 	file_addr = trunc_page(offset);
210 
211 	/*
212 	 * We have two choices.  We can either clear the data in the last page
213 	 * of an oversized mapping, or we can start the anon mapping a page
214 	 * early and copy the initialized data into that first page.  We
215 	 * choose the second..
216 	 */
217 	if (memsz > filsz)
218 		map_len = trunc_page(offset+filsz) - file_addr;
219 	else
220 		map_len = round_page(offset+filsz) - file_addr;
221 
222 	if (map_len != 0) {
223 		vm_object_reference(object);
224 		vm_map_lock(&vmspace->vm_map);
225 		rv = vm_map_insert(&vmspace->vm_map,
226 				      object,
227 				      file_addr,	/* file offset */
228 				      map_addr,		/* virtual start */
229 				      map_addr + map_len,/* virtual end */
230 				      prot,
231 				      VM_PROT_ALL,
232 				      MAP_COPY_ON_WRITE | MAP_PREFAULT);
233 		vm_map_unlock(&vmspace->vm_map);
234 		if (rv != KERN_SUCCESS) {
235 			vm_object_deallocate(object);
236 			return EINVAL;
237 		}
238 
239 		/* we can stop now if we've covered it all */
240 		if (memsz == filsz)
241 			return 0;
242 	}
243 
244 
245 	/*
246 	 * We have to get the remaining bit of the file into the first part
247 	 * of the oversized map segment.  This is normally because the .data
248 	 * segment in the file is extended to provide bss.  It's a neat idea
249 	 * to try and save a page, but it's a pain in the behind to implement.
250 	 */
251 	copy_len = (offset + filsz) - trunc_page(offset + filsz);
252 	map_addr = trunc_page((vm_offset_t)vmaddr + filsz);
253 	map_len = round_page((vm_offset_t)vmaddr + memsz) - map_addr;
254 
255 	/* This had damn well better be true! */
256         if (map_len != 0) {
257 		vm_map_lock(&vmspace->vm_map);
258 		rv = vm_map_insert(&vmspace->vm_map, NULL, 0,
259 					map_addr, map_addr + map_len,
260 					VM_PROT_ALL, VM_PROT_ALL, 0);
261 		vm_map_unlock(&vmspace->vm_map);
262 		if (rv != KERN_SUCCESS)
263 			return EINVAL;
264 	}
265 
266 	if (copy_len != 0) {
267 		vm_object_reference(object);
268 		rv = vm_map_find(exec_map,
269 				 object,
270 				 trunc_page(offset + filsz),
271 				 &data_buf,
272 				 PAGE_SIZE,
273 				 TRUE,
274 				 VM_PROT_READ,
275 				 VM_PROT_ALL,
276 				 MAP_COPY_ON_WRITE | MAP_PREFAULT_PARTIAL);
277 		if (rv != KERN_SUCCESS) {
278 			vm_object_deallocate(object);
279 			return EINVAL;
280 		}
281 
282 		/* send the page fragment to user space */
283 		error = copyout((caddr_t)data_buf, (caddr_t)map_addr, copy_len);
284 		vm_map_remove(exec_map, data_buf, data_buf + PAGE_SIZE);
285 		if (error)
286 			return (error);
287 	}
288 
289 	/*
290 	 * set it to the specified protection
291 	 */
292 	vm_map_protect(&vmspace->vm_map, map_addr, map_addr + map_len,  prot,
293 		       FALSE);
294 
295 	return error;
296 }
297 
298 /*
299  * Load the file "file" into memory.  It may be either a shared object
300  * or an executable.
301  *
302  * The "addr" reference parameter is in/out.  On entry, it specifies
303  * the address where a shared object should be loaded.  If the file is
304  * an executable, this value is ignored.  On exit, "addr" specifies
305  * where the file was actually loaded.
306  *
307  * The "entry" reference parameter is out only.  On exit, it specifies
308  * the entry point for the loaded file.
309  */
310 static int
311 elf_load_file(struct proc *p, const char *file, u_long *addr, u_long *entry)
312 {
313 	const Elf_Ehdr *hdr = NULL;
314 	const Elf_Phdr *phdr = NULL;
315 	struct nameidata nd;
316 	struct vmspace *vmspace = p->p_vmspace;
317 	struct vattr attr;
318 	struct image_params image_params, *imgp;
319 	vm_prot_t prot;
320 	u_long rbase;
321 	u_long base_addr = 0;
322 	int error, i, numsegs;
323 
324 	imgp = &image_params;
325 	/*
326 	 * Initialize part of the common data
327 	 */
328 	imgp->proc = p;
329 	imgp->uap = NULL;
330 	imgp->attr = &attr;
331 	imgp->firstpage = NULL;
332 	imgp->image_header = (char *)kmem_alloc_wait(exec_map, PAGE_SIZE);
333 
334 	if (imgp->image_header == NULL) {
335 		nd.ni_vp = NULL;
336 		error = ENOMEM;
337 		goto fail;
338 	}
339 
340         NDINIT(&nd, LOOKUP, LOCKLEAF|FOLLOW, UIO_SYSSPACE, file, p);
341 
342 	if ((error = namei(&nd)) != 0) {
343 		nd.ni_vp = NULL;
344 		goto fail;
345 	}
346 	NDFREE(&nd, NDF_ONLY_PNBUF);
347 	imgp->vp = nd.ni_vp;
348 
349 	/*
350 	 * Check permissions, modes, uid, etc on the file, and "open" it.
351 	 */
352 	error = exec_check_permissions(imgp);
353 	if (error) {
354 		VOP_UNLOCK(nd.ni_vp, 0, p);
355 		goto fail;
356 	}
357 
358 	error = exec_map_first_page(imgp);
359 	/*
360 	 * Also make certain that the interpreter stays the same, so set
361 	 * its VTEXT flag, too.
362 	 */
363 	if (error == 0)
364 		nd.ni_vp->v_flag |= VTEXT;
365 	VOP_UNLOCK(nd.ni_vp, 0, p);
366 	if (error)
367                 goto fail;
368 
369 	hdr = (const Elf_Ehdr *)imgp->image_header;
370 	if ((error = elf_check_header(hdr)) != 0)
371 		goto fail;
372 	if (hdr->e_type == ET_DYN)
373 		rbase = *addr;
374 	else if (hdr->e_type == ET_EXEC)
375 		rbase = 0;
376 	else {
377 		error = ENOEXEC;
378 		goto fail;
379 	}
380 
381 	/* Only support headers that fit within first page for now */
382 	if ((hdr->e_phoff > PAGE_SIZE) ||
383 	    (hdr->e_phoff + hdr->e_phentsize * hdr->e_phnum) > PAGE_SIZE) {
384 		error = ENOEXEC;
385 		goto fail;
386 	}
387 
388 	phdr = (const Elf_Phdr *)(imgp->image_header + hdr->e_phoff);
389 
390 	for (i = 0, numsegs = 0; i < hdr->e_phnum; i++) {
391 		if (phdr[i].p_type == PT_LOAD) {	/* Loadable segment */
392 			prot = 0;
393 			if (phdr[i].p_flags & PF_X)
394   				prot |= VM_PROT_EXECUTE;
395 			if (phdr[i].p_flags & PF_W)
396   				prot |= VM_PROT_WRITE;
397 			if (phdr[i].p_flags & PF_R)
398   				prot |= VM_PROT_READ;
399 
400 			if ((error = elf_load_section(p, vmspace, nd.ni_vp,
401   						     phdr[i].p_offset,
402   						     (caddr_t)phdr[i].p_vaddr +
403 							rbase,
404   						     phdr[i].p_memsz,
405   						     phdr[i].p_filesz, prot)) != 0)
406 				goto fail;
407 			/*
408 			 * Establish the base address if this is the
409 			 * first segment.
410 			 */
411 			if (numsegs == 0)
412   				base_addr = trunc_page(phdr[i].p_vaddr + rbase);
413 			numsegs++;
414 		}
415 	}
416 	*addr = base_addr;
417 	*entry=(unsigned long)hdr->e_entry + rbase;
418 
419 fail:
420 	if (imgp->firstpage)
421 		exec_unmap_first_page(imgp);
422 	if (imgp->image_header)
423 		kmem_free_wakeup(exec_map, (vm_offset_t)imgp->image_header,
424 			PAGE_SIZE);
425 	if (nd.ni_vp)
426 		vrele(nd.ni_vp);
427 
428 	return error;
429 }
430 
431 static int fallback_elf_brand = ELFOSABI_FREEBSD;
432 SYSCTL_INT(_kern, OID_AUTO, fallback_elf_brand, CTLFLAG_RW,
433 		&fallback_elf_brand, ELFOSABI_FREEBSD,
434 		"ELF brand of last resort");
435 
436 static int
437 exec_elf_imgact(struct image_params *imgp)
438 {
439 	const Elf_Ehdr *hdr = (const Elf_Ehdr *) imgp->image_header;
440 	const Elf_Phdr *phdr;
441 	Elf_Auxargs *elf_auxargs = NULL;
442 	struct vmspace *vmspace;
443 	vm_prot_t prot;
444 	u_long text_size = 0, data_size = 0;
445 	u_long text_addr = 0, data_addr = 0;
446 	u_long addr, entry = 0, proghdr = 0;
447 	int error, i;
448 	const char *interp = NULL;
449 	Elf_Brandinfo *brand_info;
450 	char path[MAXPATHLEN];
451 
452 	/*
453 	 * Do we have a valid ELF header ?
454 	 */
455 	if (elf_check_header(hdr) != 0 || hdr->e_type != ET_EXEC)
456 		return -1;
457 
458 	/*
459 	 * From here on down, we return an errno, not -1, as we've
460 	 * detected an ELF file.
461 	 */
462 
463 	if ((hdr->e_phoff > PAGE_SIZE) ||
464 	    (hdr->e_phoff + hdr->e_phentsize * hdr->e_phnum) > PAGE_SIZE) {
465 		/* Only support headers in first page for now */
466 		return ENOEXEC;
467 	}
468 	phdr = (const Elf_Phdr*)(imgp->image_header + hdr->e_phoff);
469 
470 	/*
471 	 * From this point on, we may have resources that need to be freed.
472 	 */
473 
474 	/*
475 	 * Yeah, I'm paranoid.  There is every reason in the world to get
476 	 * VTEXT now since from here on out, there are places we can have
477 	 * a context switch.  Better safe than sorry; I really don't want
478 	 * the file to change while it's being loaded.
479 	 */
480 	simple_lock(&imgp->vp->v_interlock);
481 	imgp->vp->v_flag |= VTEXT;
482 	simple_unlock(&imgp->vp->v_interlock);
483 
484 	if ((error = exec_extract_strings(imgp)) != 0)
485 		goto fail;
486 
487 	exec_new_vmspace(imgp);
488 
489 	vmspace = imgp->proc->p_vmspace;
490 
491 	for (i = 0; i < hdr->e_phnum; i++) {
492 		switch(phdr[i].p_type) {
493 
494 		case PT_LOAD:	/* Loadable segment */
495 			prot = 0;
496 			if (phdr[i].p_flags & PF_X)
497   				prot |= VM_PROT_EXECUTE;
498 			if (phdr[i].p_flags & PF_W)
499   				prot |= VM_PROT_WRITE;
500 			if (phdr[i].p_flags & PF_R)
501   				prot |= VM_PROT_READ;
502 
503 			if ((error = elf_load_section(imgp->proc,
504 						     vmspace, imgp->vp,
505   						     phdr[i].p_offset,
506   						     (caddr_t)phdr[i].p_vaddr,
507   						     phdr[i].p_memsz,
508   						     phdr[i].p_filesz, prot)) != 0)
509   				goto fail;
510 
511 			/*
512 			 * Is this .text or .data ??
513 			 *
514 			 * We only handle one each of those yet XXX
515 			 */
516 			if (hdr->e_entry >= phdr[i].p_vaddr &&
517 			hdr->e_entry <(phdr[i].p_vaddr+phdr[i].p_memsz)) {
518   				text_addr = trunc_page(phdr[i].p_vaddr);
519   				text_size = round_page(phdr[i].p_memsz +
520 						       phdr[i].p_vaddr -
521 						       text_addr);
522 				entry = (u_long)hdr->e_entry;
523 			} else {
524   				data_addr = trunc_page(phdr[i].p_vaddr);
525   				data_size = round_page(phdr[i].p_memsz +
526 						       phdr[i].p_vaddr -
527 						       data_addr);
528 			}
529 			break;
530 	  	case PT_INTERP:	/* Path to interpreter */
531 			if (phdr[i].p_filesz > MAXPATHLEN ||
532 			    phdr[i].p_offset + phdr[i].p_filesz > PAGE_SIZE) {
533 				error = ENOEXEC;
534 				goto fail;
535 			}
536 			interp = imgp->image_header + phdr[i].p_offset;
537 			break;
538 		case PT_PHDR: 	/* Program header table info */
539 			proghdr = phdr[i].p_vaddr;
540 			break;
541 		default:
542 			break;
543 		}
544 	}
545 
546 	vmspace->vm_tsize = text_size >> PAGE_SHIFT;
547 	vmspace->vm_taddr = (caddr_t)(uintptr_t)text_addr;
548 	vmspace->vm_dsize = data_size >> PAGE_SHIFT;
549 	vmspace->vm_daddr = (caddr_t)(uintptr_t)data_addr;
550 
551 	addr = ELF_RTLD_ADDR(vmspace);
552 
553 	imgp->entry_addr = entry;
554 
555 	brand_info = NULL;
556 
557 	/* XXX  For now we look for the magic "FreeBSD" that we used to put
558 	 * into the ELF header at the EI_ABIVERSION location.  If found use
559 	 * that information rather than figuring out the ABI from proper
560 	 * branding.  This should be removed for 5.0-RELEASE. The Linux caes
561 	 * can be figured out from the `interp_path' field.
562 	 */
563 	if (strcmp("FreeBSD", (const char *)&hdr->e_ident[OLD_EI_BRAND]) == 0)
564 		brand_info = &freebsd_brand_info;
565 
566 	/* If the executable has a brand, search for it in the brand list. */
567 	if (brand_info == NULL) {
568 		for (i = 0;  i < MAX_BRANDS;  i++) {
569 			Elf_Brandinfo *bi = elf_brand_list[i];
570 
571 			if (bi != NULL && hdr->e_ident[EI_OSABI] == bi->brand) {
572 				brand_info = bi;
573 				break;
574 			}
575 		}
576 	}
577 
578 	/* Lacking a known brand, search for a recognized interpreter. */
579 	if (brand_info == NULL && interp != NULL) {
580 		for (i = 0;  i < MAX_BRANDS;  i++) {
581 			Elf_Brandinfo *bi = elf_brand_list[i];
582 
583 			if (bi != NULL &&
584 			    strcmp(interp, bi->interp_path) == 0) {
585 				brand_info = bi;
586 				break;
587 			}
588 		}
589 	}
590 
591 	/* Lacking a recognized interpreter, try the default brand */
592 	if (brand_info == NULL) {
593 		for (i = 0; i < MAX_BRANDS; i++) {
594 			Elf_Brandinfo *bi = elf_brand_list[i];
595 
596 			if (bi != NULL && fallback_elf_brand == bi->brand) {
597 				brand_info = bi;
598 				break;
599 			}
600 		}
601 	}
602 
603 	/* XXX - Assume FreeBSD after the branding method change. */
604 	if (brand_info == NULL)
605 		brand_info = &freebsd_brand_info;
606 
607 	if (brand_info == NULL) {
608 		uprintf("ELF binary type \"%u\" not known.\n",
609 		    hdr->e_ident[EI_OSABI]);
610 		error = ENOEXEC;
611 		goto fail;
612 	}
613 
614 	imgp->proc->p_sysent = brand_info->sysvec;
615 	if (interp != NULL) {
616 	        snprintf(path, sizeof(path), "%s%s",
617 			 brand_info->emul_path, interp);
618 		if ((error = elf_load_file(imgp->proc, path, &addr,
619 					   &imgp->entry_addr)) != 0) {
620 		        if ((error = elf_load_file(imgp->proc, interp, &addr,
621 						   &imgp->entry_addr)) != 0) {
622 			        uprintf("ELF interpreter %s not found\n", path);
623 				goto fail;
624 			}
625                 }
626 	}
627 
628 	/*
629 	 * Construct auxargs table (used by the fixup routine)
630 	 */
631 	elf_auxargs = malloc(sizeof(Elf_Auxargs), M_TEMP, M_WAITOK);
632 	elf_auxargs->execfd = -1;
633 	elf_auxargs->phdr = proghdr;
634 	elf_auxargs->phent = hdr->e_phentsize;
635 	elf_auxargs->phnum = hdr->e_phnum;
636 	elf_auxargs->pagesz = PAGE_SIZE;
637 	elf_auxargs->base = addr;
638 	elf_auxargs->flags = 0;
639 	elf_auxargs->entry = entry;
640 	elf_auxargs->trace = elf_trace;
641 
642 	imgp->auxargs = elf_auxargs;
643 	imgp->interpreted = 0;
644 
645 fail:
646 	return error;
647 }
648 
649 static int
650 elf_freebsd_fixup(register_t **stack_base, struct image_params *imgp)
651 {
652 	Elf_Auxargs *args = (Elf_Auxargs *)imgp->auxargs;
653 	register_t *pos;
654 
655 	pos = *stack_base + (imgp->argc + imgp->envc + 2);
656 
657 	if (args->trace) {
658 		AUXARGS_ENTRY(pos, AT_DEBUG, 1);
659 	}
660 	if (args->execfd != -1) {
661 		AUXARGS_ENTRY(pos, AT_EXECFD, args->execfd);
662 	}
663 	AUXARGS_ENTRY(pos, AT_PHDR, args->phdr);
664 	AUXARGS_ENTRY(pos, AT_PHENT, args->phent);
665 	AUXARGS_ENTRY(pos, AT_PHNUM, args->phnum);
666 	AUXARGS_ENTRY(pos, AT_PAGESZ, args->pagesz);
667 	AUXARGS_ENTRY(pos, AT_FLAGS, args->flags);
668 	AUXARGS_ENTRY(pos, AT_ENTRY, args->entry);
669 	AUXARGS_ENTRY(pos, AT_BASE, args->base);
670 	AUXARGS_ENTRY(pos, AT_NULL, 0);
671 
672 	free(imgp->auxargs, M_TEMP);
673 	imgp->auxargs = NULL;
674 
675 	(*stack_base)--;
676 	suword(*stack_base, (long) imgp->argc);
677 	return 0;
678 }
679 
680 /*
681  * Code for generating ELF core dumps.
682  */
683 
684 typedef void (*segment_callback) __P((vm_map_entry_t, void *));
685 
686 /* Closure for cb_put_phdr(). */
687 struct phdr_closure {
688 	Elf_Phdr *phdr;		/* Program header to fill in */
689 	Elf_Off offset;		/* Offset of segment in core file */
690 };
691 
692 /* Closure for cb_size_segment(). */
693 struct sseg_closure {
694 	int count;		/* Count of writable segments. */
695 	size_t size;		/* Total size of all writable segments. */
696 };
697 
698 static void cb_put_phdr __P((vm_map_entry_t, void *));
699 static void cb_size_segment __P((vm_map_entry_t, void *));
700 static void each_writable_segment __P((struct proc *, segment_callback,
701     void *));
702 static int elf_corehdr __P((struct proc *, struct vnode *, struct ucred *,
703     int, void *, size_t));
704 static void elf_puthdr __P((struct proc *, void *, size_t *,
705     const prstatus_t *, const prfpregset_t *, const prpsinfo_t *, int));
706 static void elf_putnote __P((void *, size_t *, const char *, int,
707     const void *, size_t));
708 
709 extern int osreldate;
710 
711 int
712 elf_coredump(p, vp, limit)
713 	register struct proc *p;
714 	register struct vnode *vp;
715 	off_t limit;
716 {
717 	register struct ucred *cred = p->p_ucred;
718 	int error = 0;
719 	struct sseg_closure seginfo;
720 	void *hdr;
721 	size_t hdrsize;
722 
723 	/* Size the program segments. */
724 	seginfo.count = 0;
725 	seginfo.size = 0;
726 	each_writable_segment(p, cb_size_segment, &seginfo);
727 
728 	/*
729 	 * Calculate the size of the core file header area by making
730 	 * a dry run of generating it.  Nothing is written, but the
731 	 * size is calculated.
732 	 */
733 	hdrsize = 0;
734 	elf_puthdr((struct proc *)NULL, (void *)NULL, &hdrsize,
735 	    (const prstatus_t *)NULL, (const prfpregset_t *)NULL,
736 	    (const prpsinfo_t *)NULL, seginfo.count);
737 
738 	if (hdrsize + seginfo.size >= limit)
739 		return (EFAULT);
740 
741 	/*
742 	 * Allocate memory for building the header, fill it up,
743 	 * and write it out.
744 	 */
745 	hdr = malloc(hdrsize, M_TEMP, M_WAITOK);
746 	if (hdr == NULL) {
747 		return EINVAL;
748 	}
749 	error = elf_corehdr(p, vp, cred, seginfo.count, hdr, hdrsize);
750 
751 	/* Write the contents of all of the writable segments. */
752 	if (error == 0) {
753 		Elf_Phdr *php;
754 		off_t offset;
755 		int i;
756 
757 		php = (Elf_Phdr *)((char *)hdr + sizeof(Elf_Ehdr)) + 1;
758 		offset = hdrsize;
759 		for (i = 0;  i < seginfo.count;  i++) {
760 			error = vn_rdwr(UIO_WRITE, vp, (caddr_t)php->p_vaddr,
761 			    php->p_filesz, offset, UIO_USERSPACE,
762 			    IO_NODELOCKED|IO_UNIT, cred, (int *)NULL, p);
763 			if (error != 0)
764 				break;
765 			offset += php->p_filesz;
766 			php++;
767 		}
768 	}
769 	free(hdr, M_TEMP);
770 
771 	return error;
772 }
773 
774 /*
775  * A callback for each_writable_segment() to write out the segment's
776  * program header entry.
777  */
778 static void
779 cb_put_phdr(entry, closure)
780 	vm_map_entry_t entry;
781 	void *closure;
782 {
783 	struct phdr_closure *phc = (struct phdr_closure *)closure;
784 	Elf_Phdr *phdr = phc->phdr;
785 
786 	phc->offset = round_page(phc->offset);
787 
788 	phdr->p_type = PT_LOAD;
789 	phdr->p_offset = phc->offset;
790 	phdr->p_vaddr = entry->start;
791 	phdr->p_paddr = 0;
792 	phdr->p_filesz = phdr->p_memsz = entry->end - entry->start;
793 	phdr->p_align = PAGE_SIZE;
794 	phdr->p_flags = 0;
795 	if (entry->protection & VM_PROT_READ)
796 		phdr->p_flags |= PF_R;
797 	if (entry->protection & VM_PROT_WRITE)
798 		phdr->p_flags |= PF_W;
799 	if (entry->protection & VM_PROT_EXECUTE)
800 		phdr->p_flags |= PF_X;
801 
802 	phc->offset += phdr->p_filesz;
803 	phc->phdr++;
804 }
805 
806 /*
807  * A callback for each_writable_segment() to gather information about
808  * the number of segments and their total size.
809  */
810 static void
811 cb_size_segment(entry, closure)
812 	vm_map_entry_t entry;
813 	void *closure;
814 {
815 	struct sseg_closure *ssc = (struct sseg_closure *)closure;
816 
817 	ssc->count++;
818 	ssc->size += entry->end - entry->start;
819 }
820 
821 /*
822  * For each writable segment in the process's memory map, call the given
823  * function with a pointer to the map entry and some arbitrary
824  * caller-supplied data.
825  */
826 static void
827 each_writable_segment(p, func, closure)
828 	struct proc *p;
829 	segment_callback func;
830 	void *closure;
831 {
832 	vm_map_t map = &p->p_vmspace->vm_map;
833 	vm_map_entry_t entry;
834 
835 	for (entry = map->header.next;  entry != &map->header;
836 	    entry = entry->next) {
837 		vm_object_t obj;
838 
839 		if ((entry->eflags & MAP_ENTRY_IS_SUB_MAP) ||
840 		    (entry->protection & (VM_PROT_READ|VM_PROT_WRITE)) !=
841 		    (VM_PROT_READ|VM_PROT_WRITE))
842 			continue;
843 
844 		/*
845 		** Dont include memory segment in the coredump if
846 		** MAP_NOCORE is set in mmap(2) or MADV_NOCORE in
847 		** madvise(2).
848 		*/
849 		if (entry->eflags & MAP_ENTRY_NOCOREDUMP)
850 			continue;
851 
852 		if ((obj = entry->object.vm_object) == NULL)
853 			continue;
854 
855 		/* Find the deepest backing object. */
856 		while (obj->backing_object != NULL)
857 			obj = obj->backing_object;
858 
859 		/* Ignore memory-mapped devices and such things. */
860 		if (obj->type != OBJT_DEFAULT &&
861 		    obj->type != OBJT_SWAP &&
862 		    obj->type != OBJT_VNODE)
863 			continue;
864 
865 		(*func)(entry, closure);
866 	}
867 }
868 
869 /*
870  * Write the core file header to the file, including padding up to
871  * the page boundary.
872  */
873 static int
874 elf_corehdr(p, vp, cred, numsegs, hdr, hdrsize)
875 	struct proc *p;
876 	struct vnode *vp;
877 	struct ucred *cred;
878 	int numsegs;
879 	size_t hdrsize;
880 	void *hdr;
881 {
882 	size_t off;
883 	prstatus_t status;
884 	prfpregset_t fpregset;
885 	prpsinfo_t psinfo;
886 
887 	/* Gather the information for the header. */
888 	bzero(&status, sizeof status);
889 	status.pr_version = PRSTATUS_VERSION;
890 	status.pr_statussz = sizeof(prstatus_t);
891 	status.pr_gregsetsz = sizeof(gregset_t);
892 	status.pr_fpregsetsz = sizeof(fpregset_t);
893 	status.pr_osreldate = osreldate;
894 	status.pr_cursig = p->p_sig;
895 	status.pr_pid = p->p_pid;
896 	fill_regs(p, &status.pr_reg);
897 
898 	fill_fpregs(p, &fpregset);
899 
900 	bzero(&psinfo, sizeof psinfo);
901 	psinfo.pr_version = PRPSINFO_VERSION;
902 	psinfo.pr_psinfosz = sizeof(prpsinfo_t);
903 	strncpy(psinfo.pr_fname, p->p_comm, MAXCOMLEN);
904 	/* XXX - We don't fill in the command line arguments properly yet. */
905 	strncpy(psinfo.pr_psargs, p->p_comm, PRARGSZ);
906 
907 	/* Fill in the header. */
908 	bzero(hdr, hdrsize);
909 	off = 0;
910 	elf_puthdr(p, hdr, &off, &status, &fpregset, &psinfo, numsegs);
911 
912 	/* Write it to the core file. */
913 	return vn_rdwr(UIO_WRITE, vp, hdr, hdrsize, (off_t)0,
914 	    UIO_SYSSPACE, IO_NODELOCKED|IO_UNIT, cred, NULL, p);
915 }
916 
917 static void
918 elf_puthdr(struct proc *p, void *dst, size_t *off, const prstatus_t *status,
919     const prfpregset_t *fpregset, const prpsinfo_t *psinfo, int numsegs)
920 {
921 	size_t ehoff;
922 	size_t phoff;
923 	size_t noteoff;
924 	size_t notesz;
925 
926 	ehoff = *off;
927 	*off += sizeof(Elf_Ehdr);
928 
929 	phoff = *off;
930 	*off += (numsegs + 1) * sizeof(Elf_Phdr);
931 
932 	noteoff = *off;
933 	elf_putnote(dst, off, "FreeBSD", NT_PRSTATUS, status,
934 	    sizeof *status);
935 	elf_putnote(dst, off, "FreeBSD", NT_FPREGSET, fpregset,
936 	    sizeof *fpregset);
937 	elf_putnote(dst, off, "FreeBSD", NT_PRPSINFO, psinfo,
938 	    sizeof *psinfo);
939 	notesz = *off - noteoff;
940 
941 	/* Align up to a page boundary for the program segments. */
942 	*off = round_page(*off);
943 
944 	if (dst != NULL) {
945 		Elf_Ehdr *ehdr;
946 		Elf_Phdr *phdr;
947 		struct phdr_closure phc;
948 
949 		/*
950 		 * Fill in the ELF header.
951 		 */
952 		ehdr = (Elf_Ehdr *)((char *)dst + ehoff);
953 		ehdr->e_ident[EI_MAG0] = ELFMAG0;
954 		ehdr->e_ident[EI_MAG1] = ELFMAG1;
955 		ehdr->e_ident[EI_MAG2] = ELFMAG2;
956 		ehdr->e_ident[EI_MAG3] = ELFMAG3;
957 		ehdr->e_ident[EI_CLASS] = ELF_CLASS;
958 		ehdr->e_ident[EI_DATA] = ELF_DATA;
959 		ehdr->e_ident[EI_VERSION] = EV_CURRENT;
960 		ehdr->e_ident[EI_OSABI] = ELFOSABI_FREEBSD;
961 		ehdr->e_ident[EI_ABIVERSION] = 0;
962 		ehdr->e_ident[EI_PAD] = 0;
963 		ehdr->e_type = ET_CORE;
964 		ehdr->e_machine = ELF_ARCH;
965 		ehdr->e_version = EV_CURRENT;
966 		ehdr->e_entry = 0;
967 		ehdr->e_phoff = phoff;
968 		ehdr->e_flags = 0;
969 		ehdr->e_ehsize = sizeof(Elf_Ehdr);
970 		ehdr->e_phentsize = sizeof(Elf_Phdr);
971 		ehdr->e_phnum = numsegs + 1;
972 		ehdr->e_shentsize = sizeof(Elf_Shdr);
973 		ehdr->e_shnum = 0;
974 		ehdr->e_shstrndx = SHN_UNDEF;
975 
976 		/*
977 		 * Fill in the program header entries.
978 		 */
979 		phdr = (Elf_Phdr *)((char *)dst + phoff);
980 
981 		/* The note segement. */
982 		phdr->p_type = PT_NOTE;
983 		phdr->p_offset = noteoff;
984 		phdr->p_vaddr = 0;
985 		phdr->p_paddr = 0;
986 		phdr->p_filesz = notesz;
987 		phdr->p_memsz = 0;
988 		phdr->p_flags = 0;
989 		phdr->p_align = 0;
990 		phdr++;
991 
992 		/* All the writable segments from the program. */
993 		phc.phdr = phdr;
994 		phc.offset = *off;
995 		each_writable_segment(p, cb_put_phdr, &phc);
996 	}
997 }
998 
999 static void
1000 elf_putnote(void *dst, size_t *off, const char *name, int type,
1001     const void *desc, size_t descsz)
1002 {
1003 	Elf_Note note;
1004 
1005 	note.n_namesz = strlen(name) + 1;
1006 	note.n_descsz = descsz;
1007 	note.n_type = type;
1008 	if (dst != NULL)
1009 		bcopy(&note, (char *)dst + *off, sizeof note);
1010 	*off += sizeof note;
1011 	if (dst != NULL)
1012 		bcopy(name, (char *)dst + *off, note.n_namesz);
1013 	*off += roundup2(note.n_namesz, sizeof(Elf_Size));
1014 	if (dst != NULL)
1015 		bcopy(desc, (char *)dst + *off, note.n_descsz);
1016 	*off += roundup2(note.n_descsz, sizeof(Elf_Size));
1017 }
1018 
1019 /*
1020  * Tell kern_execve.c about it, with a little help from the linker.
1021  */
1022 static struct execsw elf_execsw = {exec_elf_imgact, "ELF"};
1023 EXEC_SET(elf, elf_execsw);
1024