xref: /src/sys/compat/linux/common/linux_exec_elf32.c

/*	$NetBSD: linux_exec_elf32.c,v 1.102 2021/11/26 09:05:05 ryo Exp $	*/

/*-
 * Copyright (c) 1995, 1998, 2000, 2001 The NetBSD Foundation, Inc.
 * All rights reserved.
 *
 * This code is derived from software contributed to The NetBSD Foundation
 * by Christos Zoulas, Frank van der Linden, Eric Haszlakiewicz and
 * Emmanuel Dreyfus.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

/*
 * based on exec_aout.c, sunos_exec.c and svr4_exec.c
 */

#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: linux_exec_elf32.c,v 1.102 2021/11/26 09:05:05 ryo Exp $");

#ifndef ELFSIZE
/* XXX should die */
#define	ELFSIZE		32
#endif

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/kernel.h>
#include <sys/proc.h>
#include <sys/malloc.h>
#include <sys/namei.h>
#include <sys/vnode.h>
#include <sys/mount.h>
#include <sys/exec.h>
#include <sys/exec_elf.h>
#include <sys/stat.h>
#include <sys/kauth.h>
#include <sys/cprng.h>
#include <sys/compat_stub.h>

#include <sys/mman.h>
#include <sys/syscallargs.h>

#include <sys/cpu.h>
#include <machine/reg.h>

#include <compat/linux/common/linux_types.h>
#include <compat/linux/common/linux_signal.h>
#include <compat/linux/common/linux_util.h>
#include <compat/linux/common/linux_exec.h>
#include <compat/linux/common/linux_machdep.h>
#include <compat/linux/common/linux_ipc.h>
#include <compat/linux/common/linux_sem.h>

#include <compat/linux/linux_syscallargs.h>
#include <compat/linux/linux_syscall.h>

#ifdef DEBUG_LINUX
#define DPRINTF(a)	uprintf a
#else
#define DPRINTF(a)	do {} while (0)
#endif

#ifdef LINUX_ATEXIT_SIGNATURE
/*
 * On the PowerPC, statically linked Linux binaries are not recognized
 * by linux_signature nor by linux_gcc_signature. Fortunately, thoses
 * binaries features a __libc_atexit ELF section. We therefore assume we
 * have a Linux binary if we find this section.
 */
int
ELFNAME2(linux,atexit_signature)(
	struct lwp *l,
	struct exec_package *epp,
	Elf_Ehdr *eh)
{
	Elf_Shdr *sh;
	size_t shsize;
	u_int shstrndx;
	size_t i;
	static const char signature[] = "__libc_atexit";
	const size_t sigsz = sizeof(signature);
	char tbuf[sizeof(signature)];
	int error;

	/* Load the section header table. */
	shsize = eh->e_shnum * sizeof(Elf_Shdr);
	sh = (Elf_Shdr *) malloc(shsize, M_TEMP, M_WAITOK);
	error = exec_read(l, epp->ep_vp, eh->e_shoff, sh, shsize,
	    IO_NODELOCKED);
	if (error)
		goto out;

	/* Now let's find the string table. If it does not exist, give up. */
	shstrndx = eh->e_shstrndx;
	if (shstrndx == SHN_UNDEF || shstrndx >= eh->e_shnum) {
		error = ENOEXEC;
		goto out;
	}

	/* Check if any section has the name we're looking for. */
	const off_t stroff = sh[shstrndx].sh_offset;
	for (i = 0; i < eh->e_shnum; i++) {
		Elf_Shdr *s = &sh[i];

		if (s->sh_name + sigsz > sh[shstrndx].sh_size)
			continue;

		error = exec_read(l, epp->ep_vp, stroff + s->sh_name, tbuf,
		    sigsz, IO_NODELOCKED);
		if (error)
			goto out;
		if (!memcmp(tbuf, signature, sigsz)) {
			DPRINTF(("linux_atexit_sig=%s\n", tbuf));
			error = 0;
			goto out;
		}
	}
	error = ENOEXEC;

out:
	free(sh, M_TEMP);
	return (error);
}
#endif

#ifdef LINUX_GCC_SIGNATURE
/*
 * Take advantage of the fact that all the linux binaries are compiled
 * with gcc, and gcc sticks in the comment field a signature. Note that
 * on SVR4 binaries, the gcc signature will follow the OS name signature,
 * that will not be a problem. We don't bother to read in the string table,
 * but we check all the progbits headers.
 *
 * XXX This only works in the i386.  On the alpha (at least)
 * XXX we have the same gcc signature which incorrectly identifies
 * XXX NetBSD binaries as Linux.
 */
int
ELFNAME2(linux,gcc_signature)(
	struct lwp *l,
	struct exec_package *epp,
	Elf_Ehdr *eh)
{
	size_t shsize;
	size_t i;
	static const char signature[] = "\0GCC: (GNU) ";
	char tbuf[sizeof(signature) - 1];
	Elf_Shdr *sh;
	int error;

	shsize = eh->e_shnum * sizeof(Elf_Shdr);
	sh = (Elf_Shdr *) malloc(shsize, M_TEMP, M_WAITOK);
	error = exec_read(l, epp->ep_vp, eh->e_shoff, sh, shsize,
	    IO_NODELOCKED);
	if (error)
		goto out;

	for (i = 0; i < eh->e_shnum; i++) {
		Elf_Shdr *s = &sh[i];

		/*
		 * Identify candidates for the comment header;
		 * Header cannot have a load address, or flags and
		 * it must be large enough.
		 */
		if (s->sh_type != SHT_PROGBITS ||
		    s->sh_addr != 0 ||
		    s->sh_flags != 0 ||
		    s->sh_size < sizeof(signature) - 1)
			continue;

		error = exec_read(l, epp->ep_vp, s->sh_offset, tbuf,
		    sizeof(signature) - 1, IO_NODELOCKED);
		if (error)
			continue;

		/*
		 * error is 0, if the signatures match we are done.
		 */
		DPRINTF(("linux_gcc_sig: sig=%s\n", tbuf));
		if (!memcmp(tbuf, signature, sizeof(signature) - 1)) {
			error = 0;
			goto out;
		}
	}
	error = ENOEXEC;

out:
	free(sh, M_TEMP);
	return (error);
}
#endif

#ifdef LINUX_DEBUGLINK_SIGNATURE
/*
 * Look for a .gnu_debuglink, specific to x86_64 interpreter
 */
int
ELFNAME2(linux,debuglink_signature)(struct lwp *l, struct exec_package *epp, Elf_Ehdr *eh)
{
	Elf_Shdr *sh;
	size_t shsize;
	u_int shstrndx;
	size_t i;
	static const char signature[] = ".gnu_debuglink";
	const size_t sigsz = sizeof(signature);
	char tbuf[sizeof(signature)];
	int error;

	/* Load the section header table. */
	shsize = eh->e_shnum * sizeof(Elf_Shdr);
	sh = (Elf_Shdr *) malloc(shsize, M_TEMP, M_WAITOK);
	error = exec_read(l, epp->ep_vp, eh->e_shoff, sh, shsize,
	    IO_NODELOCKED);
	if (error)
		goto out;

	/* Now let's find the string table. If it does not exist, give up. */
	shstrndx = eh->e_shstrndx;
	if (shstrndx == SHN_UNDEF || shstrndx >= eh->e_shnum) {
		error = ENOEXEC;
		goto out;
	}

	/* Check if any section has the name we're looking for. */
	const off_t stroff = sh[shstrndx].sh_offset;
	for (i = 0; i < eh->e_shnum; i++) {
		Elf_Shdr *s = &sh[i];

		if (s->sh_name + sigsz > sh[shstrndx].sh_size)
			continue;

		error = exec_read(l, epp->ep_vp, stroff + s->sh_name, tbuf,
		    sigsz, IO_NODELOCKED);
		if (error)
			goto out;
		if (!memcmp(tbuf, signature, sigsz)) {
			DPRINTF(("linux_debuglink_sig=%s\n", tbuf));
			error = 0;
			goto out;
		}
	}
	error = ENOEXEC;

out:
	free(sh, M_TEMP);
	return (error);
}
#endif

#ifdef LINUX_GO_RT0_SIGNATURE
/*
 * Look for a .gopclntab, specific to go binaries
 * in it look for a symbol called _rt0_<cpu>_linux
 */
int
ELFNAME2(linux,go_rt0_signature)(struct lwp *l, struct exec_package *epp, Elf_Ehdr *eh)
{
	Elf_Shdr *sh;
	size_t shsize;
	u_int shstrndx;
	size_t i;
	static const char signature[] = ".gopclntab";
	const size_t sigsz = sizeof(signature);
	char tbuf[sizeof(signature)], *tmp = NULL;
	char mbuf[64];
	const char *m;
	int mlen;
	int error;

	/* Load the section header table. */
	shsize = eh->e_shnum * sizeof(Elf_Shdr);
	sh = malloc(shsize, M_TEMP, M_WAITOK);
	error = exec_read(l, epp->ep_vp, eh->e_shoff, sh, shsize,
	    IO_NODELOCKED);
	if (error)
		goto out;

	/* Now let's find the string table. If it does not exist, give up. */
	shstrndx = eh->e_shstrndx;
	if (shstrndx == SHN_UNDEF || shstrndx >= eh->e_shnum) {
		error = ENOEXEC;
		goto out;
	}

	/* Check if any section has the name we're looking for. */
	const off_t stroff = sh[shstrndx].sh_offset;
	for (i = 0; i < eh->e_shnum; i++) {
		Elf_Shdr *s = &sh[i];

		if (s->sh_name + sigsz > sh[shstrndx].sh_size)
			continue;

		error = exec_read(l, epp->ep_vp, stroff + s->sh_name, tbuf,
		    sigsz, IO_NODELOCKED);
		if (error)
			goto out;
		if (!memcmp(tbuf, signature, sigsz)) {
			DPRINTF(("linux_goplcntab_sig=%s\n", tbuf));
			break;
		}
	}

	if (i == eh->e_shnum) {
		error = ENOEXEC;
		goto out;
	}

	// Don't scan more than 1MB
	if (sh[i].sh_size > 1024 * 1024)
		sh[i].sh_size = 1024 * 1024;

	tmp = malloc(sh[i].sh_size, M_TEMP, M_WAITOK);
	error = exec_read(l, epp->ep_vp, sh[i].sh_offset, tmp,
	    sh[i].sh_size, IO_NODELOCKED);
	if (error)
		goto out;

#if (ELFSIZE == 32)
#ifdef LINUX_GO_RT0_SIGNATURE_ARCH32
	m = LINUX_GO_RT0_SIGNATURE_ARCH32;
#else
	extern struct netbsd32_machine32_hook_t netbsd32_machine32_hook;
	MODULE_HOOK_CALL(netbsd32_machine32_hook, (), machine, m);
#endif
#else /* (ELFSIZE == 32) */
#ifdef LINUX_GO_RT0_SIGNATURE_ARCH64
	m = LINUX_GO_RT0_SIGNATURE_ARCH64;
#else
	m = machine;
#endif
#endif /* (ELFSIZE == 32) */
	mlen = snprintf(mbuf, sizeof(mbuf), "_rt0_%s_linux", m);
	if (memmem(tmp, sh[i].sh_size, mbuf, mlen) == NULL)
		error = ENOEXEC;
	else
		DPRINTF(("linux_rt0_sig=%s\n", mbuf));
out:
	if (tmp)
		free(tmp, M_TEMP);
	free(sh, M_TEMP);
	return error;
}
#endif

int
ELFNAME2(linux,signature)(struct lwp *l, struct exec_package *epp, Elf_Ehdr *eh, char *itp)
{
	size_t i;
	Elf_Phdr *ph;
	size_t phsize;
	int error;
	static const char linux[] = "Linux";

	if (eh->e_ident[EI_OSABI] == ELFOSABI_LINUX ||
	    memcmp(&eh->e_ident[EI_ABIVERSION], linux, sizeof(linux)) == 0)
		return 0;

	phsize = eh->e_phnum * sizeof(Elf_Phdr);
	ph = (Elf_Phdr *)malloc(phsize, M_TEMP, M_WAITOK);
	error = exec_read(l, epp->ep_vp, eh->e_phoff, ph, phsize,
	    IO_NODELOCKED);
	if (error)
		goto out;

	for (i = 0; i < eh->e_phnum; i++) {
		Elf_Phdr *ephp = &ph[i];
		Elf_Nhdr *np;
		u_int32_t *abi;

		if (ephp->p_type != PT_NOTE ||
		    ephp->p_filesz > 1024 ||
		    ephp->p_filesz < sizeof(Elf_Nhdr) + 20)
			continue;

		np = (Elf_Nhdr *)malloc(ephp->p_filesz, M_TEMP, M_WAITOK);
		error = exec_read(l, epp->ep_vp, ephp->p_offset, np,
		    ephp->p_filesz, IO_NODELOCKED);
		if (error)
			goto next;

		if (np->n_type != ELF_NOTE_TYPE_ABI_TAG ||
		    np->n_namesz != ELF_NOTE_ABI_NAMESZ ||
		    np->n_descsz != ELF_NOTE_ABI_DESCSZ ||
		    memcmp((void *)(np + 1), ELF_NOTE_ABI_NAME,
		    ELF_NOTE_ABI_NAMESZ))
			goto next;

		/* Make sure the OS is Linux. */
		abi = (u_int32_t *)((char *)np + sizeof(Elf_Nhdr) +
		    np->n_namesz);
		if (abi[0] == ELF_NOTE_ABI_OS_LINUX)
			error = 0;
		else
			error = ENOEXEC;
		free(np, M_TEMP);
		goto out;

	next:
		free(np, M_TEMP);
		continue;
	}

	/* Check for certain interpreter names. */
	if (itp) {
		if (!strncmp(itp, "/lib/ld-linux", 13) ||
#if (ELFSIZE == 64)
		    !strncmp(itp, "/lib64/ld-linux", 15) ||
#endif
		    !strncmp(itp, "/lib/ld.so.", 11))
			error = 0;
		else
			error = ENOEXEC;
		goto out;
	}

	error = ENOEXEC;
out:
	free(ph, M_TEMP);
	return (error);
}

int
ELFNAME2(linux,probe)(struct lwp *l, struct exec_package *epp, void *eh,
    char *itp, vaddr_t *pos)
{
	int error;

	if (((error = ELFNAME2(linux,signature)(l, epp, eh, itp)) != 0) &&
#ifdef LINUX_GCC_SIGNATURE
	    ((error = ELFNAME2(linux,gcc_signature)(l, epp, eh)) != 0) &&
#endif
#ifdef LINUX_ATEXIT_SIGNATURE
	    ((error = ELFNAME2(linux,atexit_signature)(l, epp, eh)) != 0) &&
#endif
#ifdef LINUX_DEBUGLINK_SIGNATURE
	    ((error = ELFNAME2(linux,debuglink_signature)(l, epp, eh)) != 0) &&
#endif
#ifdef LINUX_GO_RT0_SIGNATURE
	    ((error = ELFNAME2(linux,go_rt0_signature)(l, epp, eh)) != 0) &&
#endif
	    1) {
			DPRINTF(("linux_probe: returning %d\n", error));
			return error;
	}

	if (itp) {
		if ((error = emul_find_interp(l, epp, itp)))
			return (error);
	}
	epp->ep_flags |= EXEC_FORCEAUX;
	DPRINTF(("linux_probe: returning 0\n"));
	return 0;
}

#ifndef LINUX_MACHDEP_ELF_COPYARGS
/*
 * Copy arguments onto the stack in the normal way, but add some
 * extra information in case of dynamic binding.
 */
int
ELFNAME2(linux,copyargs)(struct lwp *l, struct exec_package *pack,
    struct ps_strings *arginfo, char **stackp, void *argp)
{
	size_t len;
	AuxInfo ai[LINUX_ELF_AUX_ENTRIES], *a;
	struct elf_args *ap;
	int error;
	struct vattr *vap;
	uint32_t randbytes[4];

	if ((error = copyargs(l, pack, arginfo, stackp, argp)) != 0)
		return error;

	a = ai;

	memset(ai, 0, sizeof(ai));

	/*
	 * Push extra arguments used by glibc on the stack.
	 */

	a->a_type = AT_PAGESZ;
	a->a_v = PAGE_SIZE;
	a++;

	if ((ap = (struct elf_args *)pack->ep_emul_arg)) {

		a->a_type = AT_PHDR;
		a->a_v = ap->arg_phaddr;
		a++;

		a->a_type = AT_PHENT;
		a->a_v = ap->arg_phentsize;
		a++;

		a->a_type = AT_PHNUM;
		a->a_v = ap->arg_phnum;
		a++;

		a->a_type = AT_BASE;
		a->a_v = ap->arg_interp;
		a++;

		a->a_type = AT_FLAGS;
		a->a_v = 0;
		a++;

		a->a_type = AT_ENTRY;
		a->a_v = ap->arg_entry;
		a++;

		exec_free_emul_arg(pack);
	}

	/* Linux-specific items */
	a->a_type = LINUX_AT_CLKTCK;
	a->a_v = hz;
	a++;

	vap = pack->ep_vap;

	a->a_type = LINUX_AT_UID;
	a->a_v = kauth_cred_getuid(l->l_cred);
	a++;

	a->a_type = LINUX_AT_EUID;
	if (vap->va_mode & S_ISUID)
		a->a_v = vap->va_uid;
	else
		a->a_v = kauth_cred_geteuid(l->l_cred);
	a++;

	a->a_type = LINUX_AT_GID;
	a->a_v = kauth_cred_getgid(l->l_cred);
	a++;

	a->a_type = LINUX_AT_EGID;
	if (vap->va_mode & S_ISGID)
		a->a_v = vap->va_gid;
	else
		a->a_v = kauth_cred_getegid(l->l_cred);
	a++;

	a->a_type = LINUX_AT_RANDOM;
	a->a_v = (Elf_Addr)(uintptr_t)*stackp;
	a++;

	a->a_type = AT_NULL;
	a->a_v = 0;
	a++;

	randbytes[0] = cprng_strong32();
	randbytes[1] = cprng_strong32();
	randbytes[2] = cprng_strong32();
	randbytes[3] = cprng_strong32();

	len = sizeof(randbytes);
	if ((error = copyout(randbytes, *stackp, len)) != 0)
		return error;
	*stackp += len;

	len = (a - ai) * sizeof(AuxInfo);
	KASSERT(len <= LINUX_ELF_AUX_ENTRIES * sizeof(AuxInfo));
	if ((error = copyout(ai, *stackp, len)) != 0)
		return error;
	*stackp += len;

	return 0;
}
#endif /* !LINUX_MACHDEP_ELF_COPYARGS */