1/*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 1993, David Greenman
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29#include <sys/param.h>
30#include <sys/exec.h>
31#include <sys/imgact.h>
32#include <sys/imgact_aout.h>
33#include <sys/kernel.h>
34#include <sys/limits.h>
35#include <sys/lock.h>
36#include <sys/malloc.h>
37#include <sys/mutex.h>
38#include <sys/proc.h>
39#include <sys/racct.h>
40#include <sys/resourcevar.h>
41#include <sys/signalvar.h>
42#include <sys/syscall.h>
43#include <sys/sysent.h>
44#include <sys/systm.h>
45#include <sys/vnode.h>
46
47#include <machine/frame.h>
48#include <machine/md_var.h>
49
50#include <vm/vm.h>
51#include <vm/pmap.h>
52#include <vm/vm_map.h>
53#include <vm/vm_object.h>
54#include <vm/vm_param.h>
55
56#ifdef __amd64__
57#include <compat/freebsd32/freebsd32_signal.h>
58#include <compat/freebsd32/freebsd32_util.h>
59#include <compat/freebsd32/freebsd32_proto.h>
60#include <compat/freebsd32/freebsd32_syscall.h>
61#include <compat/ia32/ia32_signal.h>
62#endif
63
64static int	exec_aout_imgact(struct image_params *imgp);
65static int	aout_fixup(uintptr_t *stack_base, struct image_params *imgp);
66
67#define	AOUT32_USRSTACK		0xbfc00000
68
69#if defined(__i386__)
70
71#define	AOUT32_PS_STRINGS	(AOUT32_USRSTACK - sizeof(struct ps_strings))
72
73struct sysentvec aout_sysvec = {
74	.sv_size	= SYS_MAXSYSCALL,
75	.sv_table	= sysent,
76	.sv_fixup	= aout_fixup,
77	.sv_sendsig	= sendsig,
78	.sv_sigcode	= sigcode,
79	.sv_szsigcode	= &szsigcode,
80	.sv_name	= "FreeBSD a.out",
81	.sv_coredump	= NULL,
82	.sv_minsigstksz	= MINSIGSTKSZ,
83	.sv_minuser	= VM_MIN_ADDRESS,
84	.sv_maxuser	= AOUT32_USRSTACK,
85	.sv_usrstack	= AOUT32_USRSTACK,
86	.sv_psstrings	= AOUT32_PS_STRINGS,
87	.sv_psstringssz	= sizeof(struct ps_strings),
88	.sv_stackprot	= VM_PROT_ALL,
89	.sv_copyout_strings	= exec_copyout_strings,
90	.sv_setregs	= exec_setregs,
91	.sv_fixlimit	= NULL,
92	.sv_maxssiz	= NULL,
93	.sv_flags	= SV_ABI_FREEBSD | SV_AOUT | SV_IA32 | SV_ILP32 |
94			    SV_SIGSYS,
95	.sv_set_syscall_retval = cpu_set_syscall_retval,
96	.sv_fetch_syscall_args = cpu_fetch_syscall_args,
97	.sv_syscallnames = syscallnames,
98	.sv_schedtail	= NULL,
99	.sv_thread_detach = NULL,
100	.sv_trap	= NULL,
101	.sv_onexec_old = exec_onexec_old,
102	.sv_onexit =  exit_onexit,
103	.sv_set_fork_retval = x86_set_fork_retval,
104};
105
106#elif defined(__amd64__)
107
108#include "vdso_ia32_offsets.h"
109
110extern const char _binary_elf_vdso32_so_1_start[];
111extern const char _binary_elf_vdso32_so_1_end[];
112extern char _binary_elf_vdso32_so_1_size;
113
114#define	AOUT32_PS_STRINGS \
115    (AOUT32_USRSTACK - sizeof(struct freebsd32_ps_strings))
116#define	AOUT32_MINUSER		FREEBSD32_MINUSER
117
118extern const char *freebsd32_syscallnames[];
119extern u_long ia32_maxssiz;
120
121static int aout_szsigcode;
122
123struct sysentvec aout_sysvec = {
124	.sv_size	= FREEBSD32_SYS_MAXSYSCALL,
125	.sv_table	= freebsd32_sysent,
126	.sv_fixup	= aout_fixup,
127	.sv_sendsig	= ia32_sendsig,
128	.sv_sigcode	= _binary_elf_vdso32_so_1_start,
129	.sv_szsigcode	= &aout_szsigcode,
130	.sv_name	= "FreeBSD a.out",
131	.sv_coredump	= NULL,
132	.sv_minsigstksz	= MINSIGSTKSZ,
133	.sv_minuser	= AOUT32_MINUSER,
134	.sv_maxuser	= AOUT32_USRSTACK,
135	.sv_usrstack	= AOUT32_USRSTACK,
136	.sv_psstrings	= AOUT32_PS_STRINGS,
137	.sv_psstringssz	= sizeof(struct freebsd32_ps_strings),
138	.sv_stackprot	= VM_PROT_ALL,
139	.sv_copyout_strings	= freebsd32_copyout_strings,
140	.sv_setregs	= ia32_setregs,
141	.sv_fixlimit	= ia32_fixlimit,
142	.sv_maxssiz	= &ia32_maxssiz,
143	.sv_flags	= SV_ABI_FREEBSD | SV_AOUT | SV_IA32 | SV_ILP32 |
144			    SV_SIGSYS,
145	.sv_set_syscall_retval = ia32_set_syscall_retval,
146	.sv_fetch_syscall_args = ia32_fetch_syscall_args,
147	.sv_syscallnames = freebsd32_syscallnames,
148	.sv_onexec_old	= exec_onexec_old,
149	.sv_onexit	= exit_onexit,
150	.sv_set_fork_retval = x86_set_fork_retval,
151};
152
153static void
154aout_sysent(void *arg __unused)
155{
156	aout_szsigcode = (int)(uintptr_t)&_binary_elf_vdso32_so_1_size;
157}
158SYSINIT(aout_sysent, SI_SUB_EXEC, SI_ORDER_ANY, aout_sysent, NULL);
159#else
160#error "Only ia32 arch is supported"
161#endif
162
163static int
164aout_fixup(uintptr_t *stack_base, struct image_params *imgp)
165{
166
167	*stack_base -= sizeof(uint32_t);
168	if (suword32((void *)*stack_base, imgp->args->argc) != 0)
169		return (EFAULT);
170	return (0);
171}
172
173static int
174exec_aout_imgact(struct image_params *imgp)
175{
176	const struct exec *a_out;
177	struct vmspace *vmspace;
178	vm_map_t map;
179	vm_object_t object;
180	vm_offset_t text_end, data_end;
181	unsigned long virtual_offset;
182	unsigned long file_offset;
183	unsigned long bss_size;
184	int error;
185
186	a_out = (const struct exec *)imgp->image_header;
187
188	/*
189	 * Linux and *BSD binaries look very much alike,
190	 * only the machine id is different:
191	 * 0x64 for Linux, 0x86 for *BSD, 0x00 for BSDI.
192	 * NetBSD is in network byte order.. ugh.
193	 */
194	if (((a_out->a_midmag >> 16) & 0xff) != 0x86 &&
195	    ((a_out->a_midmag >> 16) & 0xff) != 0 &&
196	    ((((int)ntohl(a_out->a_midmag)) >> 16) & 0xff) != 0x86)
197                return (-1);
198
199	/*
200	 * Set file/virtual offset based on a.out variant.
201	 *	We do two cases: host byte order and network byte order
202	 *	(for NetBSD compatibility)
203	 */
204	switch ((int)(a_out->a_midmag & 0xffff)) {
205	case ZMAGIC:
206		virtual_offset = 0;
207		if (a_out->a_text) {
208			file_offset = PAGE_SIZE;
209		} else {
210			/* Bill's "screwball mode" */
211			file_offset = 0;
212		}
213		break;
214	case QMAGIC:
215		virtual_offset = PAGE_SIZE;
216		file_offset = 0;
217		/* Pass PS_STRINGS for BSD/OS binaries only. */
218		if (N_GETMID(*a_out) == MID_ZERO)
219			imgp->ps_strings = (void *)aout_sysvec.sv_psstrings;
220		break;
221	default:
222		/* NetBSD compatibility */
223		switch ((int)(ntohl(a_out->a_midmag) & 0xffff)) {
224		case ZMAGIC:
225		case QMAGIC:
226			virtual_offset = PAGE_SIZE;
227			file_offset = 0;
228			break;
229		default:
230			return (-1);
231		}
232	}
233
234	bss_size = roundup(a_out->a_bss, PAGE_SIZE);
235
236	/*
237	 * Check various fields in header for validity/bounds.
238	 */
239	if (/* entry point must lay with text region */
240	    a_out->a_entry < virtual_offset ||
241	    a_out->a_entry >= virtual_offset + a_out->a_text ||
242
243	    /* text and data size must each be page rounded */
244	    a_out->a_text & PAGE_MASK || a_out->a_data & PAGE_MASK
245
246#ifdef __amd64__
247	    ||
248	    /* overflows */
249	    virtual_offset + a_out->a_text + a_out->a_data + bss_size > UINT_MAX
250#endif
251	    )
252		return (-1);
253
254	/* text + data can't exceed file size */
255	if (a_out->a_data + a_out->a_text > imgp->attr->va_size)
256		return (EFAULT);
257
258	/*
259	 * text/data/bss must not exceed limits
260	 */
261	PROC_LOCK(imgp->proc);
262	if (/* text can't exceed maximum text size */
263	    a_out->a_text > maxtsiz ||
264
265	    /* data + bss can't exceed rlimit */
266	    a_out->a_data + bss_size > lim_cur_proc(imgp->proc, RLIMIT_DATA) ||
267	    racct_set(imgp->proc, RACCT_DATA, a_out->a_data + bss_size) != 0) {
268		PROC_UNLOCK(imgp->proc);
269		return (ENOMEM);
270	}
271	PROC_UNLOCK(imgp->proc);
272
273	/*
274	 * Avoid a possible deadlock if the current address space is destroyed
275	 * and that address space maps the locked vnode.  In the common case,
276	 * the locked vnode's v_usecount is decremented but remains greater
277	 * than zero.  Consequently, the vnode lock is not needed by vrele().
278	 * However, in cases where the vnode lock is external, such as nullfs,
279	 * v_usecount may become zero.
280	 */
281	VOP_UNLOCK(imgp->vp);
282
283	/*
284	 * Destroy old process VM and create a new one (with a new stack)
285	 */
286	error = exec_new_vmspace(imgp, &aout_sysvec);
287
288	vn_lock(imgp->vp, LK_SHARED | LK_RETRY);
289	if (error)
290		return (error);
291
292	/*
293	 * The vm space can be changed by exec_new_vmspace
294	 */
295	vmspace = imgp->proc->p_vmspace;
296
297	object = imgp->object;
298	map = &vmspace->vm_map;
299	vm_map_lock(map);
300	vm_object_reference(object);
301
302	text_end = virtual_offset + a_out->a_text;
303	error = vm_map_insert(map, object,
304		file_offset,
305		virtual_offset, text_end,
306		VM_PROT_READ | VM_PROT_EXECUTE, VM_PROT_ALL,
307		MAP_COPY_ON_WRITE | MAP_PREFAULT | MAP_VN_EXEC);
308	if (error) {
309		vm_map_unlock(map);
310		vm_object_deallocate(object);
311		return (error);
312	}
313	VOP_SET_TEXT_CHECKED(imgp->vp);
314	data_end = text_end + a_out->a_data;
315	if (a_out->a_data) {
316		vm_object_reference(object);
317		error = vm_map_insert(map, object,
318			file_offset + a_out->a_text,
319			text_end, data_end,
320			VM_PROT_ALL, VM_PROT_ALL,
321			MAP_COPY_ON_WRITE | MAP_PREFAULT | MAP_VN_EXEC);
322		if (error) {
323			vm_map_unlock(map);
324			vm_object_deallocate(object);
325			return (error);
326		}
327		VOP_SET_TEXT_CHECKED(imgp->vp);
328	}
329
330	if (bss_size) {
331		error = vm_map_insert(map, NULL, 0,
332			data_end, data_end + bss_size,
333			VM_PROT_ALL, VM_PROT_ALL, 0);
334		if (error) {
335			vm_map_unlock(map);
336			return (error);
337		}
338	}
339	vm_map_unlock(map);
340
341	/* Fill in process VM information */
342	vmspace->vm_tsize = a_out->a_text >> PAGE_SHIFT;
343	vmspace->vm_dsize = (a_out->a_data + bss_size) >> PAGE_SHIFT;
344	vmspace->vm_taddr = (caddr_t) (uintptr_t) virtual_offset;
345	vmspace->vm_daddr = (caddr_t) (uintptr_t)
346			    (virtual_offset + a_out->a_text);
347
348	error = exec_map_stack(imgp);
349	if (error != 0)
350		return (error);
351
352	/* Fill in image_params */
353	imgp->interpreted = 0;
354	imgp->entry_addr = a_out->a_entry;
355
356	imgp->proc->p_sysent = &aout_sysvec;
357
358	return (0);
359}
360
361/*
362 * Tell kern_execve.c about it, with a little help from the linker.
363 */
364static struct execsw aout_execsw = {
365	.ex_imgact = exec_aout_imgact,
366	.ex_name = "a.out"
367};
368EXEC_SET(aout, aout_execsw);
369