/* This is the Linux kernel elf-loading code, ported into user space */

#include "qemu/osdep.h"

#include <sys/param.h>

#include <sys/prctl.h>

#include <sys/resource.h>

#include <sys/shm.h>

#include "qemu.h"

#include "user/tswap-target.h"

#include "user/page-protection.h"

#include "exec/page-protection.h"

#include "exec/mmap-lock.h"

#include "exec/translation-block.h"

#include "exec/tswap.h"

#include "user/guest-base.h"

#include "user-internals.h"

#include "signal-common.h"

#include "loader.h"

#include "user-mmap.h"

#include "disas/disas.h"

#include "qemu/bitops.h"

#include "qemu/path.h"

#include "qemu/queue.h"

#include "qemu/guest-random.h"

#include "qemu/units.h"

#include "qemu/selfmap.h"

#include "qemu/lockable.h"

#include "qapi/error.h"

#include "qemu/error-report.h"

#include "target_elf.h"

#include "target_signal.h"

#include "tcg/debuginfo.h"

#ifdef TARGET_ARM

#include "target/arm/cpu-features.h"

#endif

#ifndef TARGET_ARCH_HAS_SIGTRAMP_PAGE

#define TARGET_ARCH_HAS_SIGTRAMP_PAGE 0

#endif

#define ELF_OSABI ELFOSABI_SYSV

/* from personality.h */

/*

* Flags for bug emulation.

*

* These occupy the top three bytes.

*/

enum {

ADDR_NO_RANDOMIZE = 0x0040000, /* disable randomization of VA space */

FDPIC_FUNCPTRS = 0x0080000, /* userspace function ptrs point to

descriptors (signal handling) */

MMAP_PAGE_ZERO = 0x0100000,

ADDR_COMPAT_LAYOUT = 0x0200000,

READ_IMPLIES_EXEC = 0x0400000,

ADDR_LIMIT_32BIT = 0x0800000,

SHORT_INODE = 0x1000000,

WHOLE_SECONDS = 0x2000000,

STICKY_TIMEOUTS = 0x4000000,

ADDR_LIMIT_3GB = 0x8000000,

};

/*

* Personality types.

*

* These go in the low byte. Avoid using the top bit, it will

* conflict with error returns.

*/

enum {

PER_LINUX = 0x0000,

PER_LINUX_32BIT = 0x0000 | ADDR_LIMIT_32BIT,

PER_LINUX_FDPIC = 0x0000 | FDPIC_FUNCPTRS,

PER_SVR4 = 0x0001 | STICKY_TIMEOUTS | MMAP_PAGE_ZERO,

PER_SVR3 = 0x0002 | STICKY_TIMEOUTS | SHORT_INODE,

PER_SCOSVR3 = 0x0003 | STICKY_TIMEOUTS | WHOLE_SECONDS | SHORT_INODE,

PER_OSR5 = 0x0003 | STICKY_TIMEOUTS | WHOLE_SECONDS,

PER_WYSEV386 = 0x0004 | STICKY_TIMEOUTS | SHORT_INODE,

PER_ISCR4 = 0x0005 | STICKY_TIMEOUTS,

PER_BSD = 0x0006,

PER_SUNOS = 0x0006 | STICKY_TIMEOUTS,

PER_XENIX = 0x0007 | STICKY_TIMEOUTS | SHORT_INODE,

PER_LINUX32 = 0x0008,

PER_LINUX32_3GB = 0x0008 | ADDR_LIMIT_3GB,

PER_IRIX32 = 0x0009 | STICKY_TIMEOUTS,/* IRIX5 32-bit */

PER_IRIXN32 = 0x000a | STICKY_TIMEOUTS,/* IRIX6 new 32-bit */

PER_IRIX64 = 0x000b | STICKY_TIMEOUTS,/* IRIX6 64-bit */

PER_RISCOS = 0x000c,

PER_SOLARIS = 0x000d | STICKY_TIMEOUTS,

PER_UW7 = 0x000e | STICKY_TIMEOUTS | MMAP_PAGE_ZERO,

PER_OSF4 = 0x000f, /* OSF/1 v4 */

PER_HPUX = 0x0010,

PER_MASK = 0x00ff,

};

/*

* Return the base personality without flags.

*/

#define personality(pers) (pers & PER_MASK)

int info_is_fdpic(struct image_info *info)

{

return info->personality == PER_LINUX_FDPIC;

}

#if TARGET_BIG_ENDIAN

#define ELF_DATA ELFDATA2MSB

#else

#define ELF_DATA ELFDATA2LSB

#endif

#ifdef USE_UID16

typedef abi_ushort target_uid_t;

typedef abi_ushort target_gid_t;

#else

typedef abi_uint target_uid_t;

typedef abi_uint target_gid_t;

#endif

typedef abi_int target_pid_t;

#ifndef elf_check_machine

#define elf_check_machine(x) ((x) == ELF_MACHINE)

#endif

#ifndef elf_check_abi

#define elf_check_abi(x) (1)

#endif

#ifndef STACK_GROWS_DOWN

#define STACK_GROWS_DOWN 1

#endif

#ifndef STACK_ALIGNMENT

#define STACK_ALIGNMENT 16

#endif

#ifdef TARGET_ABI32

#undef ELF_CLASS

#define ELF_CLASS ELFCLASS32

#undef bswaptls

#define bswaptls(ptr) bswap32s(ptr)

#endif

#ifndef EXSTACK_DEFAULT

#define EXSTACK_DEFAULT false

#endif

/*

* Provide fallback definitions that the target may omit.

* One way or another, we'll get a link error if the setting of

* HAVE_* doesn't match the implementation.

*/

#ifndef HAVE_ELF_HWCAP

abi_ulong get_elf_hwcap(CPUState *cs) { return 0; }

#endif

#ifndef HAVE_ELF_HWCAP2

abi_ulong get_elf_hwcap2(CPUState *cs) { g_assert_not_reached(); }

#define HAVE_ELF_HWCAP2 0

#endif

#ifndef HAVE_ELF_PLATFORM

const char *get_elf_platform(CPUState *cs) { return NULL; }

#endif

#ifndef HAVE_ELF_BASE_PLATFORM

const char *get_elf_base_platform(CPUState *cs) { return NULL; }

#endif

#ifndef HAVE_ELF_GNU_PROPERTY

bool arch_parse_elf_property(uint32_t pr_type, uint32_t pr_datasz,

const uint32_t *data, struct image_info *info,

Error **errp)

{

g_assert_not_reached();

}

#define HAVE_ELF_GNU_PROPERTY 0

#endif

#include "elf.h"

#define DLINFO_ITEMS 16

static inline void memcpy_fromfs(void * to, const void * from, unsigned long n)

{

memcpy(to, from, n);

}

static void bswap_ehdr(struct elfhdr *ehdr)

{

if (!target_needs_bswap()) {

return;

}

bswap16s(&ehdr->e_type); /* Object file type */

bswap16s(&ehdr->e_machine); /* Architecture */

bswap32s(&ehdr->e_version); /* Object file version */

bswaptls(&ehdr->e_entry); /* Entry point virtual address */

bswaptls(&ehdr->e_phoff); /* Program header table file offset */

bswaptls(&ehdr->e_shoff); /* Section header table file offset */

bswap32s(&ehdr->e_flags); /* Processor-specific flags */

bswap16s(&ehdr->e_ehsize); /* ELF header size in bytes */

bswap16s(&ehdr->e_phentsize); /* Program header table entry size */

bswap16s(&ehdr->e_phnum); /* Program header table entry count */

bswap16s(&ehdr->e_shentsize); /* Section header table entry size */

bswap16s(&ehdr->e_shnum); /* Section header table entry count */

bswap16s(&ehdr->e_shstrndx); /* Section header string table index */

}

static void bswap_phdr(struct elf_phdr *phdr, int phnum)

{

if (!target_needs_bswap()) {

return;

}

for (int i = 0; i < phnum; ++i, ++phdr) {

bswap32s(&phdr->p_type); /* Segment type */

bswap32s(&phdr->p_flags); /* Segment flags */

bswaptls(&phdr->p_offset); /* Segment file offset */

bswaptls(&phdr->p_vaddr); /* Segment virtual address */

bswaptls(&phdr->p_paddr); /* Segment physical address */

bswaptls(&phdr->p_filesz); /* Segment size in file */

bswaptls(&phdr->p_memsz); /* Segment size in memory */

bswaptls(&phdr->p_align); /* Segment alignment */

}

}

static void bswap_shdr(struct elf_shdr *shdr, int shnum)

{

if (!target_needs_bswap()) {

return;

}

for (int i = 0; i < shnum; ++i, ++shdr) {

bswap32s(&shdr->sh_name);

bswap32s(&shdr->sh_type);

bswaptls(&shdr->sh_flags);

bswaptls(&shdr->sh_addr);

bswaptls(&shdr->sh_offset);

bswaptls(&shdr->sh_size);

bswap32s(&shdr->sh_link);

bswap32s(&shdr->sh_info);

bswaptls(&shdr->sh_addralign);

bswaptls(&shdr->sh_entsize);

}

}

static void bswap_sym(struct elf_sym *sym)

{

if (!target_needs_bswap()) {

return;

}

bswap32s(&sym->st_name);

bswaptls(&sym->st_value);

bswaptls(&sym->st_size);

bswap16s(&sym->st_shndx);

}

#ifdef TARGET_MIPS

static void bswap_mips_abiflags(Mips_elf_abiflags_v0 *abiflags)

{

if (!target_needs_bswap()) {

return;

}

bswap16s(&abiflags->version);

bswap32s(&abiflags->ases);

bswap32s(&abiflags->isa_ext);

bswap32s(&abiflags->flags1);

bswap32s(&abiflags->flags2);

}

#endif

#ifdef HAVE_ELF_CORE_DUMP

static int elf_core_dump(int, const CPUArchState *);

#endif /* HAVE_ELF_CORE_DUMP */

static void load_symbols(struct elfhdr *hdr, const ImageSource *src,

abi_ulong load_bias);

/* Verify the portions of EHDR within E_IDENT for the target.

This can be performed before bswapping the entire header. */

static bool elf_check_ident(struct elfhdr *ehdr)

{

return (ehdr->e_ident[EI_MAG0] == ELFMAG0

&& ehdr->e_ident[EI_MAG1] == ELFMAG1

&& ehdr->e_ident[EI_MAG2] == ELFMAG2

&& ehdr->e_ident[EI_MAG3] == ELFMAG3

&& ehdr->e_ident[EI_CLASS] == ELF_CLASS

&& ehdr->e_ident[EI_DATA] == ELF_DATA

&& ehdr->e_ident[EI_VERSION] == EV_CURRENT);

}

/* Verify the portions of EHDR outside of E_IDENT for the target.

This has to wait until after bswapping the header. */

static bool elf_check_ehdr(struct elfhdr *ehdr)

{

return (elf_check_machine(ehdr->e_machine)

&& elf_check_abi(ehdr->e_flags)

&& ehdr->e_ehsize == sizeof(struct elfhdr)

&& ehdr->e_phentsize == sizeof(struct elf_phdr)

&& (ehdr->e_type == ET_EXEC || ehdr->e_type == ET_DYN));

}

/*

* 'copy_elf_strings()' copies argument/envelope strings from user

* memory to free pages in kernel mem. These are in a format ready

* to be put directly into the top of new user memory.

*

*/

static abi_ulong copy_elf_strings(int argc, char **argv, char *scratch,

abi_ulong p, abi_ulong stack_limit)

{

char *tmp;

int len, i;

abi_ulong top = p;

if (!p) {

return 0; /* bullet-proofing */

}

if (STACK_GROWS_DOWN) {

int offset = ((p - 1) % TARGET_PAGE_SIZE) + 1;

for (i = argc - 1; i >= 0; --i) {

tmp = argv[i];

if (!tmp) {

fprintf(stderr, "VFS: argc is wrong");

exit(-1);

}

len = strlen(tmp) + 1;

tmp += len;

if (len > (p - stack_limit)) {

return 0;

}

while (len) {

int bytes_to_copy = (len > offset) ? offset : len;

tmp -= bytes_to_copy;

p -= bytes_to_copy;

offset -= bytes_to_copy;

len -= bytes_to_copy;

memcpy_fromfs(scratch + offset, tmp, bytes_to_copy);

if (offset == 0) {

memcpy_to_target(p, scratch, top - p);

top = p;

offset = TARGET_PAGE_SIZE;

}

}

}

if (p != top) {

memcpy_to_target(p, scratch + offset, top - p);

}

} else {

int remaining = TARGET_PAGE_SIZE - (p % TARGET_PAGE_SIZE);

for (i = 0; i < argc; ++i) {

tmp = argv[i];

if (!tmp) {

fprintf(stderr, "VFS: argc is wrong");

exit(-1);

}

len = strlen(tmp) + 1;

if (len > (stack_limit - p)) {

return 0;

}

while (len) {

int bytes_to_copy = (len > remaining) ? remaining : len;

memcpy_fromfs(scratch + (p - top), tmp, bytes_to_copy);

tmp += bytes_to_copy;

remaining -= bytes_to_copy;

p += bytes_to_copy;

len -= bytes_to_copy;

if (remaining == 0) {

memcpy_to_target(top, scratch, p - top);

top = p;

remaining = TARGET_PAGE_SIZE;

}

}

}

if (p != top) {

memcpy_to_target(top, scratch, p - top);

}

}

return p;

}

/* Older linux kernels provide up to MAX_ARG_PAGES (default: 32) of

* argument/environment space. Newer kernels (>2.6.33) allow more,

* dependent on stack size, but guarantee at least 32 pages for

* backwards compatibility.

*/

#define STACK_LOWER_LIMIT (32 * TARGET_PAGE_SIZE)

static abi_ulong setup_arg_pages(struct linux_binprm *bprm,

struct image_info *info)

{

abi_ulong size, error, guard;

int prot;

size = guest_stack_size;

if (size < STACK_LOWER_LIMIT) {

size = STACK_LOWER_LIMIT;

}

if (STACK_GROWS_DOWN) {

guard = TARGET_PAGE_SIZE;

if (guard < qemu_real_host_page_size()) {

guard = qemu_real_host_page_size();

}

} else {

/* no guard page for hppa target where stack grows upwards. */

guard = 0;

}

prot = PROT_READ | PROT_WRITE;

if (info->exec_stack) {

prot |= PROT_EXEC;

}

error = target_mmap(0, size + guard, prot,

MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);

if (error == -1) {

perror("mmap stack");

exit(-1);

}

/* We reserve one extra page at the top of the stack as guard. */

if (STACK_GROWS_DOWN) {

target_mprotect(error, guard, PROT_NONE);

info->stack_limit = error + guard;

return info->stack_limit + size - sizeof(void *);

} else {

info->stack_limit = error + size;

return error;

}

}

/**

* zero_bss:

*

* Map and zero the bss. We need to explicitly zero any fractional pages

* after the data section (i.e. bss). Return false on mapping failure.

*/

static bool zero_bss(abi_ulong start_bss, abi_ulong end_bss,

int prot, Error **errp)

{

abi_ulong align_bss;

align_bss = TARGET_PAGE_ALIGN(start_bss);

end_bss = TARGET_PAGE_ALIGN(end_bss);

if (start_bss < align_bss) {

int flags = page_get_flags(start_bss);

if (!(flags & PAGE_RWX)) {

/*

* The whole address space of the executable was reserved

* at the start, therefore all pages will be VALID.

* But assuming there are no PROT_NONE PT_LOAD segments,

* a PROT_NONE page means no data all bss, and we can

* simply extend the new anon mapping back to the start

* of the page of bss.

*/

align_bss -= TARGET_PAGE_SIZE;

} else {

abi_ulong start_page_aligned = start_bss & TARGET_PAGE_MASK;

/*

* The logical OR between flags and PAGE_WRITE works because

* in include/exec/page-protection.h they are defined as PROT_*

* values, matching mprotect().

* Temporarily enable write access to zero the fractional bss.

* target_mprotect() handles TB invalidation if needed.

*/

if (!(flags & PAGE_WRITE)) {

if (target_mprotect(start_page_aligned,

TARGET_PAGE_SIZE,

prot | PAGE_WRITE) == -1) {

error_setg_errno(errp, errno,

"Error enabling write access for bss");

return false;

}

}

/* The page is already mapped and now guaranteed writable. */

memset(g2h_untagged(start_bss), 0, align_bss - start_bss);

if (!(flags & PAGE_WRITE)) {

if (target_mprotect(start_page_aligned,

TARGET_PAGE_SIZE, prot) == -1) {

error_setg_errno(errp, errno,

"Error restoring bss first permissions");

return false;

}

}

}

}

if (align_bss < end_bss &&

target_mmap(align_bss, end_bss - align_bss, prot,

MAP_FIXED | MAP_PRIVATE | MAP_ANON, -1, 0) == -1) {

error_setg_errno(errp, errno, "Error mapping bss");

return false;

}

return true;

}

#if defined(TARGET_ARM)

static int elf_is_fdpic(struct elfhdr *exec)

{

return exec->e_ident[EI_OSABI] == ELFOSABI_ARM_FDPIC;

}

#elif defined(TARGET_XTENSA)

static int elf_is_fdpic(struct elfhdr *exec)

{

return exec->e_ident[EI_OSABI] == ELFOSABI_XTENSA_FDPIC;

}

#else

/* Default implementation, always false. */

static int elf_is_fdpic(struct elfhdr *exec)

{

return 0;

}

#endif

static abi_ulong loader_build_fdpic_loadmap(struct image_info *info, abi_ulong sp)

{

uint16_t n;

struct elf32_fdpic_loadseg *loadsegs = info->loadsegs;

/* elf32_fdpic_loadseg */

n = info->nsegs;

while (n--) {

sp -= 12;

put_user_u32(loadsegs[n].addr, sp+0);

put_user_u32(loadsegs[n].p_vaddr, sp+4);

put_user_u32(loadsegs[n].p_memsz, sp+8);

}

/* elf32_fdpic_loadmap */

sp -= 4;

put_user_u16(0, sp+0); /* version */

put_user_u16(info->nsegs, sp+2); /* nsegs */

info->personality = PER_LINUX_FDPIC;

info->loadmap_addr = sp;

return sp;

}

static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,

struct elfhdr *exec,

struct image_info *info,

struct image_info *interp_info,

struct image_info *vdso_info)

{

abi_ulong sp;

abi_ulong u_argc, u_argv, u_envp, u_auxv;

int size;

int i;

abi_ulong u_rand_bytes;

uint8_t k_rand_bytes[16];

abi_ulong u_platform, u_base_platform;

const char *k_platform, *k_base_platform;

const int n = sizeof(elf_addr_t);

sp = p;

/* Needs to be before we load the env/argc/... */

if (elf_is_fdpic(exec)) {

/* Need 4 byte alignment for these structs */

sp &= ~3;

sp = loader_build_fdpic_loadmap(info, sp);

info->other_info = interp_info;

if (interp_info) {

interp_info->other_info = info;

sp = loader_build_fdpic_loadmap(interp_info, sp);

info->interpreter_loadmap_addr = interp_info->loadmap_addr;

info->interpreter_pt_dynamic_addr = interp_info->pt_dynamic_addr;

} else {

info->interpreter_loadmap_addr = 0;

info->interpreter_pt_dynamic_addr = 0;

}

}

u_base_platform = 0;

k_base_platform = get_elf_base_platform(thread_cpu);

if (k_base_platform) {

size_t len = strlen(k_base_platform) + 1;

if (STACK_GROWS_DOWN) {

sp -= (len + n - 1) & ~(n - 1);

u_base_platform = sp;

/* FIXME - check return value of memcpy_to_target() for failure */

memcpy_to_target(sp, k_base_platform, len);

} else {

memcpy_to_target(sp, k_base_platform, len);

u_base_platform = sp;

sp += len + 1;

}

}

u_platform = 0;

k_platform = get_elf_platform(thread_cpu);

if (k_platform) {

size_t len = strlen(k_platform) + 1;

if (STACK_GROWS_DOWN) {

sp -= (len + n - 1) & ~(n - 1);

u_platform = sp;

/* FIXME - check return value of memcpy_to_target() for failure */

memcpy_to_target(sp, k_platform, len);

} else {

memcpy_to_target(sp, k_platform, len);

u_platform = sp;

sp += len + 1;

}

}

/* Provide 16 byte alignment for the PRNG, and basic alignment for

* the argv and envp pointers.

*/

if (STACK_GROWS_DOWN) {

sp = QEMU_ALIGN_DOWN(sp, 16);

} else {

sp = QEMU_ALIGN_UP(sp, 16);

}

/*

* Generate 16 random bytes for userspace PRNG seeding.

*/

qemu_guest_getrandom_nofail(k_rand_bytes, sizeof(k_rand_bytes));

if (STACK_GROWS_DOWN) {

sp -= 16;

u_rand_bytes = sp;

/* FIXME - check return value of memcpy_to_target() for failure */

memcpy_to_target(sp, k_rand_bytes, 16);

} else {

memcpy_to_target(sp, k_rand_bytes, 16);

u_rand_bytes = sp;

sp += 16;

}

size = (DLINFO_ITEMS + 1) * 2;

if (k_base_platform) {

size += 2;

}

if (k_platform) {

size += 2;

}

if (vdso_info) {

size += 2;

}

#ifdef DLINFO_ARCH_ITEMS

size += DLINFO_ARCH_ITEMS * 2;

#endif

if (HAVE_ELF_HWCAP2) {

size += 2;

}

info->auxv_len = size * n;

size += envc + argc + 2;

size += 1; /* argc itself */

size *= n;

/* Allocate space and finalize stack alignment for entry now. */

if (STACK_GROWS_DOWN) {

u_argc = QEMU_ALIGN_DOWN(sp - size, STACK_ALIGNMENT);

sp = u_argc;

} else {

u_argc = sp;

sp = QEMU_ALIGN_UP(sp + size, STACK_ALIGNMENT);

}

u_argv = u_argc + n;

u_envp = u_argv + (argc + 1) * n;

u_auxv = u_envp + (envc + 1) * n;

info->saved_auxv = u_auxv;

info->argc = argc;

info->envc = envc;

info->argv = u_argv;

info->envp = u_envp;

/* This is correct because Linux defines

* elf_addr_t as Elf32_Off / Elf64_Off

*/

#define NEW_AUX_ENT(id, val) do { \

put_user_ual(id, u_auxv); u_auxv += n; \

put_user_ual(val, u_auxv); u_auxv += n; \

} while(0)

#ifdef ARCH_DLINFO

/*

* ARCH_DLINFO must come first so platform specific code can enforce

* special alignment requirements on the AUXV if necessary (eg. PPC).

*/

ARCH_DLINFO;

#endif

/* There must be exactly DLINFO_ITEMS entries here, or the assert

* on info->auxv_len will trigger.

*/

NEW_AUX_ENT(AT_PHDR, (abi_ulong)(info->load_addr + exec->e_phoff));

NEW_AUX_ENT(AT_PHENT, (abi_ulong)(sizeof (struct elf_phdr)));

NEW_AUX_ENT(AT_PHNUM, (abi_ulong)(exec->e_phnum));

NEW_AUX_ENT(AT_PAGESZ, (abi_ulong)(TARGET_PAGE_SIZE));

NEW_AUX_ENT(AT_BASE, (abi_ulong)(interp_info ? interp_info->load_addr : 0));

NEW_AUX_ENT(AT_FLAGS, (abi_ulong)0);

NEW_AUX_ENT(AT_ENTRY, info->entry);

NEW_AUX_ENT(AT_UID, (abi_ulong) getuid());

NEW_AUX_ENT(AT_EUID, (abi_ulong) geteuid());

NEW_AUX_ENT(AT_GID, (abi_ulong) getgid());

NEW_AUX_ENT(AT_EGID, (abi_ulong) getegid());

NEW_AUX_ENT(AT_HWCAP, get_elf_hwcap(thread_cpu));

NEW_AUX_ENT(AT_CLKTCK, (abi_ulong) sysconf(_SC_CLK_TCK));

NEW_AUX_ENT(AT_RANDOM, (abi_ulong) u_rand_bytes);

NEW_AUX_ENT(AT_SECURE, (abi_ulong) qemu_getauxval(AT_SECURE));

NEW_AUX_ENT(AT_EXECFN, info->file_string);

if (HAVE_ELF_HWCAP2) {

NEW_AUX_ENT(AT_HWCAP2, get_elf_hwcap2(thread_cpu));

}

if (u_base_platform) {

NEW_AUX_ENT(AT_BASE_PLATFORM, u_base_platform);

}

if (u_platform) {

NEW_AUX_ENT(AT_PLATFORM, u_platform);

}

if (vdso_info) {

NEW_AUX_ENT(AT_SYSINFO_EHDR, vdso_info->load_addr);

}

NEW_AUX_ENT (AT_NULL, 0);

#undef NEW_AUX_ENT

/* Check that our initial calculation of the auxv length matches how much

* we actually put into it.

*/

assert(info->auxv_len == u_auxv - info->saved_auxv);

put_user_ual(argc, u_argc);

p = info->arg_strings;

for (i = 0; i < argc; ++i) {

put_user_ual(p, u_argv);

u_argv += n;

p += target_strlen(p) + 1;

}

put_user_ual(0, u_argv);

p = info->env_strings;

for (i = 0; i < envc; ++i) {

put_user_ual(p, u_envp);

u_envp += n;

p += target_strlen(p) + 1;

}

put_user_ual(0, u_envp);

return sp;

}

#if defined(HI_COMMPAGE)

#define LO_COMMPAGE -1

#elif defined(LO_COMMPAGE)

#define HI_COMMPAGE 0

#else

#define HI_COMMPAGE 0

#define LO_COMMPAGE -1

#ifndef HAVE_GUEST_COMMPAGE

bool init_guest_commpage(void) { return true; }

#endif

#endif

/**

* pgb_try_mmap:

* @addr: host start address

* @addr_last: host last address

* @keep: do not unmap the probe region

*

* Return 1 if [@addr, @addr_last] is not mapped in the host,

* return 0 if it is not available to map, and -1 on mmap error.

* If @keep, the region is left mapped on success, otherwise unmapped.

*/

static int pgb_try_mmap(uintptr_t addr, uintptr_t addr_last, bool keep)

{

size_t size = addr_last - addr + 1;

void *p = mmap((void *)addr, size, PROT_NONE,

MAP_ANONYMOUS | MAP_PRIVATE |

MAP_NORESERVE | MAP_FIXED_NOREPLACE, -1, 0);

int ret;

if (p == MAP_FAILED) {

return errno == EEXIST ? 0 : -1;

}

ret = p == (void *)addr;

if (!keep || !ret) {

munmap(p, size);

}

return ret;

}

/**

* pgb_try_mmap_skip_brk(uintptr_t addr, uintptr_t size, uintptr_t brk)

* @addr: host address

* @addr_last: host last address

* @brk: host brk

*

* Like pgb_try_mmap, but additionally reserve some memory following brk.

*/

static int pgb_try_mmap_skip_brk(uintptr_t addr, uintptr_t addr_last,

uintptr_t brk, bool keep)

{

uintptr_t brk_last = brk + 16 * MiB - 1;

/* Do not map anything close to the host brk. */

if (addr <= brk_last && brk <= addr_last) {

return 0;

}

return pgb_try_mmap(addr, addr_last, keep);

}

/**

* pgb_try_mmap_set:

* @ga: set of guest addrs

* @base: guest_base

* @brk: host brk

*

* Return true if all @ga can be mapped by the host at @base.

* On success, retain the mapping at index 0 for reserved_va.

*/

typedef struct PGBAddrs {

uintptr_t bounds[3][2]; /* start/last pairs */

int nbounds;

} PGBAddrs;

static bool pgb_try_mmap_set(const PGBAddrs *ga, uintptr_t base, uintptr_t brk)

{

for (int i = ga->nbounds - 1; i >= 0; --i) {

if (pgb_try_mmap_skip_brk(ga->bounds[i][0] + base,

ga->bounds[i][1] + base,

brk, i == 0 && reserved_va) <= 0) {

return false;

}

}

return true;

}

/**

* pgb_addr_set:

* @ga: output set of guest addrs

* @guest_loaddr: guest image low address

* @guest_loaddr: guest image high address

* @identity: create for identity mapping

*

* Fill in @ga with the image, COMMPAGE and NULL page.

*/

static bool pgb_addr_set(PGBAddrs *ga, abi_ulong guest_loaddr,

abi_ulong guest_hiaddr, bool try_identity)

{

int n;

/*

* With a low commpage, or a guest mapped very low,

* we may not be able to use the identity map.

*/

if (try_identity) {

if (LO_COMMPAGE != -1 && LO_COMMPAGE < mmap_min_addr) {

return false;

}

if (guest_loaddr != 0 && guest_loaddr < mmap_min_addr) {

return false;

}

}

memset(ga, 0, sizeof(*ga));

n = 0;

if (reserved_va) {

ga->bounds[n][0] = try_identity ? mmap_min_addr : 0;

ga->bounds[n][1] = reserved_va;

n++;

/* LO_COMMPAGE and NULL handled by reserving from 0. */

} else {

/* Add any LO_COMMPAGE or NULL page. */

if (LO_COMMPAGE != -1) {

ga->bounds[n][0] = 0;

ga->bounds[n][1] = LO_COMMPAGE + TARGET_PAGE_SIZE - 1;

n++;

} else if (!try_identity) {

ga->bounds[n][0] = 0;

ga->bounds[n][1] = TARGET_PAGE_SIZE - 1;

n++;

}

/* Add the guest image for ET_EXEC. */

if (guest_loaddr) {

ga->bounds[n][0] = guest_loaddr;

ga->bounds[n][1] = guest_hiaddr;

n++;

}

}

/*

* Temporarily disable

* "comparison is always false due to limited range of data type"

* due to comparison between unsigned and (possible) 0.

*/

#pragma GCC diagnostic push

#pragma GCC diagnostic ignored "-Wtype-limits"

/* Add any HI_COMMPAGE not covered by reserved_va. */

if (reserved_va < HI_COMMPAGE) {

ga->bounds[n][0] = HI_COMMPAGE & qemu_real_host_page_mask();

ga->bounds[n][1] = HI_COMMPAGE + TARGET_PAGE_SIZE - 1;

n++;

}

#pragma GCC diagnostic pop

ga->nbounds = n;

return true;

}

static void pgb_fail_in_use(const char *image_name)

{

error_report("%s: requires virtual address space that is in use "

"(omit the -B option or choose a different value)",

image_name);

exit(EXIT_FAILURE);

}

static void pgb_fixed(const char *image_name, uintptr_t guest_loaddr,

uintptr_t guest_hiaddr, uintptr_t align)

{

PGBAddrs ga;

uintptr_t brk = (uintptr_t)sbrk(0);

if (!QEMU_IS_ALIGNED(guest_base, align)) {

fprintf(stderr, "Requested guest base %p does not satisfy "

"host minimum alignment (0x%" PRIxPTR ")\n",

(void *)guest_base, align);

exit(EXIT_FAILURE);

}

if (!pgb_addr_set(&ga, guest_loaddr, guest_hiaddr, !guest_base)

|| !pgb_try_mmap_set(&ga, guest_base, brk)) {

pgb_fail_in_use(image_name);

}

}

/**

* pgb_find_fallback:

*

* This is a fallback method for finding holes in the host address space

* if we don't have the benefit of being able to access /proc/self/map.

* It can potentially take a very long time as we can only dumbly iterate

* up the host address space seeing if the allocation would work.

*/

static uintptr_t pgb_find_fallback(const PGBAddrs *ga, uintptr_t align,

uintptr_t brk)

{

/* TODO: come up with a better estimate of how much to skip. */

uintptr_t skip = sizeof(uintptr_t) == 4 ? MiB : GiB;

for (uintptr_t base = skip; ; base += skip) {

base = ROUND_UP(base, align);

if (pgb_try_mmap_set(ga, base, brk)) {

return base;

}

if (base >= -skip) {

return -1;

}

}

}

static uintptr_t pgb_try_itree(const PGBAddrs *ga, uintptr_t base,

IntervalTreeRoot *root)

{

for (int i = ga->nbounds - 1; i >= 0; --i) {

uintptr_t s = base + ga->bounds[i][0];

uintptr_t l = base + ga->bounds[i][1];

IntervalTreeNode *n;

if (l < s) {

/* Wraparound. Skip to advance S to mmap_min_addr. */

return mmap_min_addr - s;

}

n = interval_tree_iter_first(root, s, l);

if (n != NULL) {

/* Conflict. Skip to advance S to LAST + 1. */

return n->last - s + 1;

}

}

return 0; /* success */

}

static uintptr_t pgb_find_itree(const PGBAddrs *ga, IntervalTreeRoot *root,

uintptr_t align, uintptr_t brk)

{

uintptr_t last = sizeof(uintptr_t) == 4 ? MiB : GiB;