/*      $NetBSD: linux_exec_elf32.c,v 1.102 2021/11/26 09:05:05 ryo Exp $       */

/*-
* Copyright (c) 1995, 1998, 2000, 2001 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This code is derived from software contributed to The NetBSD Foundation
* by Christos Zoulas, Frank van der Linden, Eric Haszlakiewicz and
* Emmanuel Dreyfus.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/

/*
* based on exec_aout.c, sunos_exec.c and svr4_exec.c
*/

#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: linux_exec_elf32.c,v 1.102 2021/11/26 09:05:05 ryo Exp $");

#ifndef ELFSIZE
/* XXX should die */
#define ELFSIZE         32
#endif

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/kernel.h>
#include <sys/proc.h>
#include <sys/malloc.h>
#include <sys/namei.h>
#include <sys/vnode.h>
#include <sys/mount.h>
#include <sys/exec.h>
#include <sys/exec_elf.h>
#include <sys/stat.h>
#include <sys/kauth.h>
#include <sys/cprng.h>
#include <sys/compat_stub.h>

#include <sys/mman.h>
#include <sys/syscallargs.h>

#include <sys/cpu.h>
#include <machine/reg.h>

#include <compat/linux/common/linux_types.h>
#include <compat/linux/common/linux_signal.h>
#include <compat/linux/common/linux_util.h>
#include <compat/linux/common/linux_exec.h>
#include <compat/linux/common/linux_machdep.h>
#include <compat/linux/common/linux_ipc.h>
#include <compat/linux/common/linux_sem.h>

#include <compat/linux/linux_syscallargs.h>
#include <compat/linux/linux_syscall.h>

#ifdef DEBUG_LINUX
#define DPRINTF(a)      uprintf a
#else
#define DPRINTF(a)      do {} while (0)
#endif

#ifdef LINUX_ATEXIT_SIGNATURE
/*
* On the PowerPC, statically linked Linux binaries are not recognized
* by linux_signature nor by linux_gcc_signature. Fortunately, thoses
* binaries features a __libc_atexit ELF section. We therefore assume we
* have a Linux binary if we find this section.
*/
int
ELFNAME2(linux,atexit_signature)(
       struct lwp *l,
       struct exec_package *epp,
       Elf_Ehdr *eh)
{
       Elf_Shdr *sh;
       size_t shsize;
       u_int shstrndx;
       size_t i;
       static const char signature[] = "__libc_atexit";
       const size_t sigsz = sizeof(signature);
       char tbuf[sizeof(signature)];
       int error;

       /* Load the section header table. */
       shsize = eh->e_shnum * sizeof(Elf_Shdr);
       sh = (Elf_Shdr *) malloc(shsize, M_TEMP, M_WAITOK);
       error = exec_read(l, epp->ep_vp, eh->e_shoff, sh, shsize,
           IO_NODELOCKED);
       if (error)
               goto out;

       /* Now let's find the string table. If it does not exist, give up. */
       shstrndx = eh->e_shstrndx;
       if (shstrndx == SHN_UNDEF || shstrndx >= eh->e_shnum) {
               error = ENOEXEC;
               goto out;
       }

       /* Check if any section has the name we're looking for. */
       const off_t stroff = sh[shstrndx].sh_offset;
       for (i = 0; i < eh->e_shnum; i++) {
               Elf_Shdr *s = &sh[i];

               if (s->sh_name + sigsz > sh[shstrndx].sh_size)
                       continue;

               error = exec_read(l, epp->ep_vp, stroff + s->sh_name, tbuf,
                   sigsz, IO_NODELOCKED);
               if (error)
                       goto out;
               if (!memcmp(tbuf, signature, sigsz)) {
                       DPRINTF(("linux_atexit_sig=%s\n", tbuf));
                       error = 0;
                       goto out;
               }
       }
       error = ENOEXEC;

out:
       free(sh, M_TEMP);
       return (error);
}
#endif

#ifdef LINUX_GCC_SIGNATURE
/*
* Take advantage of the fact that all the linux binaries are compiled
* with gcc, and gcc sticks in the comment field a signature. Note that
* on SVR4 binaries, the gcc signature will follow the OS name signature,
* that will not be a problem. We don't bother to read in the string table,
* but we check all the progbits headers.
*
* XXX This only works in the i386.  On the alpha (at least)
* XXX we have the same gcc signature which incorrectly identifies
* XXX NetBSD binaries as Linux.
*/
int
ELFNAME2(linux,gcc_signature)(
       struct lwp *l,
       struct exec_package *epp,
       Elf_Ehdr *eh)
{
       size_t shsize;
       size_t i;
       static const char signature[] = "\0GCC: (GNU) ";
       char tbuf[sizeof(signature) - 1];
       Elf_Shdr *sh;
       int error;

       shsize = eh->e_shnum * sizeof(Elf_Shdr);
       sh = (Elf_Shdr *) malloc(shsize, M_TEMP, M_WAITOK);
       error = exec_read(l, epp->ep_vp, eh->e_shoff, sh, shsize,
           IO_NODELOCKED);
       if (error)
               goto out;

       for (i = 0; i < eh->e_shnum; i++) {
               Elf_Shdr *s = &sh[i];

               /*
                * Identify candidates for the comment header;
                * Header cannot have a load address, or flags and
                * it must be large enough.
                */
               if (s->sh_type != SHT_PROGBITS ||
                   s->sh_addr != 0 ||
                   s->sh_flags != 0 ||
                   s->sh_size < sizeof(signature) - 1)
                       continue;

               error = exec_read(l, epp->ep_vp, s->sh_offset, tbuf,
                   sizeof(signature) - 1, IO_NODELOCKED);
               if (error)
                       continue;

               /*
                * error is 0, if the signatures match we are done.
                */
               DPRINTF(("linux_gcc_sig: sig=%s\n", tbuf));
               if (!memcmp(tbuf, signature, sizeof(signature) - 1)) {
                       error = 0;
                       goto out;
               }
       }
       error = ENOEXEC;

out:
       free(sh, M_TEMP);
       return (error);
}
#endif

#ifdef LINUX_DEBUGLINK_SIGNATURE
/*
* Look for a .gnu_debuglink, specific to x86_64 interpreter
*/
int
ELFNAME2(linux,debuglink_signature)(struct lwp *l, struct exec_package *epp, Elf_Ehdr *eh)
{
       Elf_Shdr *sh;
       size_t shsize;
       u_int shstrndx;
       size_t i;
       static const char signature[] = ".gnu_debuglink";
       const size_t sigsz = sizeof(signature);
       char tbuf[sizeof(signature)];
       int error;

       /* Load the section header table. */
       shsize = eh->e_shnum * sizeof(Elf_Shdr);
       sh = (Elf_Shdr *) malloc(shsize, M_TEMP, M_WAITOK);
       error = exec_read(l, epp->ep_vp, eh->e_shoff, sh, shsize,
           IO_NODELOCKED);
       if (error)
               goto out;

       /* Now let's find the string table. If it does not exist, give up. */
       shstrndx = eh->e_shstrndx;
       if (shstrndx == SHN_UNDEF || shstrndx >= eh->e_shnum) {
               error = ENOEXEC;
               goto out;
       }

       /* Check if any section has the name we're looking for. */
       const off_t stroff = sh[shstrndx].sh_offset;
       for (i = 0; i < eh->e_shnum; i++) {
               Elf_Shdr *s = &sh[i];

               if (s->sh_name + sigsz > sh[shstrndx].sh_size)
                       continue;

               error = exec_read(l, epp->ep_vp, stroff + s->sh_name, tbuf,
                   sigsz, IO_NODELOCKED);
               if (error)
                       goto out;
               if (!memcmp(tbuf, signature, sigsz)) {
                       DPRINTF(("linux_debuglink_sig=%s\n", tbuf));
                       error = 0;
                       goto out;
               }
       }
       error = ENOEXEC;

out:
       free(sh, M_TEMP);
       return (error);
}
#endif

#ifdef LINUX_GO_RT0_SIGNATURE
/*
* Look for a .gopclntab, specific to go binaries
* in it look for a symbol called _rt0_<cpu>_linux
*/
int
ELFNAME2(linux,go_rt0_signature)(struct lwp *l, struct exec_package *epp, Elf_Ehdr *eh)
{
       Elf_Shdr *sh;
       size_t shsize;
       u_int shstrndx;
       size_t i;
       static const char signature[] = ".gopclntab";
       const size_t sigsz = sizeof(signature);
       char tbuf[sizeof(signature)], *tmp = NULL;
       char mbuf[64];
       const char *m;
       int mlen;
       int error;

       /* Load the section header table. */
       shsize = eh->e_shnum * sizeof(Elf_Shdr);
       sh = malloc(shsize, M_TEMP, M_WAITOK);
       error = exec_read(l, epp->ep_vp, eh->e_shoff, sh, shsize,
           IO_NODELOCKED);
       if (error)
               goto out;

       /* Now let's find the string table. If it does not exist, give up. */
       shstrndx = eh->e_shstrndx;
       if (shstrndx == SHN_UNDEF || shstrndx >= eh->e_shnum) {
               error = ENOEXEC;
               goto out;
       }

       /* Check if any section has the name we're looking for. */
       const off_t stroff = sh[shstrndx].sh_offset;
       for (i = 0; i < eh->e_shnum; i++) {
               Elf_Shdr *s = &sh[i];

               if (s->sh_name + sigsz > sh[shstrndx].sh_size)
                       continue;

               error = exec_read(l, epp->ep_vp, stroff + s->sh_name, tbuf,
                   sigsz, IO_NODELOCKED);
               if (error)
                       goto out;
               if (!memcmp(tbuf, signature, sigsz)) {
                       DPRINTF(("linux_goplcntab_sig=%s\n", tbuf));
                       break;
               }
       }

       if (i == eh->e_shnum) {
               error = ENOEXEC;
               goto out;
       }

       // Don't scan more than 1MB
       if (sh[i].sh_size > 1024 * 1024)
               sh[i].sh_size = 1024 * 1024;

       tmp = malloc(sh[i].sh_size, M_TEMP, M_WAITOK);
       error = exec_read(l, epp->ep_vp, sh[i].sh_offset, tmp,
           sh[i].sh_size, IO_NODELOCKED);
       if (error)
               goto out;

#if (ELFSIZE == 32)
#ifdef LINUX_GO_RT0_SIGNATURE_ARCH32
       m = LINUX_GO_RT0_SIGNATURE_ARCH32;
#else
       extern struct netbsd32_machine32_hook_t netbsd32_machine32_hook;
       MODULE_HOOK_CALL(netbsd32_machine32_hook, (), machine, m);
#endif
#else /* (ELFSIZE == 32) */
#ifdef LINUX_GO_RT0_SIGNATURE_ARCH64
       m = LINUX_GO_RT0_SIGNATURE_ARCH64;
#else
       m = machine;
#endif
#endif /* (ELFSIZE == 32) */
       mlen = snprintf(mbuf, sizeof(mbuf), "_rt0_%s_linux", m);
       if (memmem(tmp, sh[i].sh_size, mbuf, mlen) == NULL)
               error = ENOEXEC;
       else
               DPRINTF(("linux_rt0_sig=%s\n", mbuf));
out:
       if (tmp)
               free(tmp, M_TEMP);
       free(sh, M_TEMP);
       return error;
}
#endif

int
ELFNAME2(linux,signature)(struct lwp *l, struct exec_package *epp, Elf_Ehdr *eh, char *itp)
{
       size_t i;
       Elf_Phdr *ph;
       size_t phsize;
       int error;
       static const char linux[] = "Linux";

       if (eh->e_ident[EI_OSABI] == ELFOSABI_LINUX ||
           memcmp(&eh->e_ident[EI_ABIVERSION], linux, sizeof(linux)) == 0)
               return 0;

       phsize = eh->e_phnum * sizeof(Elf_Phdr);
       ph = (Elf_Phdr *)malloc(phsize, M_TEMP, M_WAITOK);
       error = exec_read(l, epp->ep_vp, eh->e_phoff, ph, phsize,
           IO_NODELOCKED);
       if (error)
               goto out;

       for (i = 0; i < eh->e_phnum; i++) {
               Elf_Phdr *ephp = &ph[i];
               Elf_Nhdr *np;
               u_int32_t *abi;

               if (ephp->p_type != PT_NOTE ||
                   ephp->p_filesz > 1024 ||
                   ephp->p_filesz < sizeof(Elf_Nhdr) + 20)
                       continue;

               np = (Elf_Nhdr *)malloc(ephp->p_filesz, M_TEMP, M_WAITOK);
               error = exec_read(l, epp->ep_vp, ephp->p_offset, np,
                   ephp->p_filesz, IO_NODELOCKED);
               if (error)
                       goto next;

               if (np->n_type != ELF_NOTE_TYPE_ABI_TAG ||
                   np->n_namesz != ELF_NOTE_ABI_NAMESZ ||
                   np->n_descsz != ELF_NOTE_ABI_DESCSZ ||
                   memcmp((void *)(np + 1), ELF_NOTE_ABI_NAME,
                   ELF_NOTE_ABI_NAMESZ))
                       goto next;

               /* Make sure the OS is Linux. */
               abi = (u_int32_t *)((char *)np + sizeof(Elf_Nhdr) +
                   np->n_namesz);
               if (abi[0] == ELF_NOTE_ABI_OS_LINUX)
                       error = 0;
               else
                       error = ENOEXEC;
               free(np, M_TEMP);
               goto out;

       next:
               free(np, M_TEMP);
               continue;
       }

       /* Check for certain interpreter names. */
       if (itp) {
               if (!strncmp(itp, "/lib/ld-linux", 13) ||
#if (ELFSIZE == 64)
                   !strncmp(itp, "/lib64/ld-linux", 15) ||
#endif
                   !strncmp(itp, "/lib/ld.so.", 11))
                       error = 0;
               else
                       error = ENOEXEC;
               goto out;
       }

       error = ENOEXEC;
out:
       free(ph, M_TEMP);
       return (error);
}

int
ELFNAME2(linux,probe)(struct lwp *l, struct exec_package *epp, void *eh,
   char *itp, vaddr_t *pos)
{
       int error;

       if (((error = ELFNAME2(linux,signature)(l, epp, eh, itp)) != 0) &&
#ifdef LINUX_GCC_SIGNATURE
           ((error = ELFNAME2(linux,gcc_signature)(l, epp, eh)) != 0) &&
#endif
#ifdef LINUX_ATEXIT_SIGNATURE
           ((error = ELFNAME2(linux,atexit_signature)(l, epp, eh)) != 0) &&
#endif
#ifdef LINUX_DEBUGLINK_SIGNATURE
           ((error = ELFNAME2(linux,debuglink_signature)(l, epp, eh)) != 0) &&
#endif
#ifdef LINUX_GO_RT0_SIGNATURE
           ((error = ELFNAME2(linux,go_rt0_signature)(l, epp, eh)) != 0) &&
#endif
           1) {
                       DPRINTF(("linux_probe: returning %d\n", error));
                       return error;
       }

       if (itp) {
               if ((error = emul_find_interp(l, epp, itp)))
                       return (error);
       }
       epp->ep_flags |= EXEC_FORCEAUX;
       DPRINTF(("linux_probe: returning 0\n"));
       return 0;
}

#ifndef LINUX_MACHDEP_ELF_COPYARGS
/*
* Copy arguments onto the stack in the normal way, but add some
* extra information in case of dynamic binding.
*/
int
ELFNAME2(linux,copyargs)(struct lwp *l, struct exec_package *pack,
   struct ps_strings *arginfo, char **stackp, void *argp)
{
       size_t len;
       AuxInfo ai[LINUX_ELF_AUX_ENTRIES], *a;
       struct elf_args *ap;
       int error;
       struct vattr *vap;
       uint32_t randbytes[4];

       if ((error = copyargs(l, pack, arginfo, stackp, argp)) != 0)
               return error;

       a = ai;

       memset(ai, 0, sizeof(ai));

       /*
        * Push extra arguments used by glibc on the stack.
        */

       a->a_type = AT_PAGESZ;
       a->a_v = PAGE_SIZE;
       a++;

       if ((ap = (struct elf_args *)pack->ep_emul_arg)) {

               a->a_type = AT_PHDR;
               a->a_v = ap->arg_phaddr;
               a++;

               a->a_type = AT_PHENT;
               a->a_v = ap->arg_phentsize;
               a++;

               a->a_type = AT_PHNUM;
               a->a_v = ap->arg_phnum;
               a++;

               a->a_type = AT_BASE;
               a->a_v = ap->arg_interp;
               a++;

               a->a_type = AT_FLAGS;
               a->a_v = 0;
               a++;

               a->a_type = AT_ENTRY;
               a->a_v = ap->arg_entry;
               a++;

               exec_free_emul_arg(pack);
       }

       /* Linux-specific items */
       a->a_type = LINUX_AT_CLKTCK;
       a->a_v = hz;
       a++;

       vap = pack->ep_vap;

       a->a_type = LINUX_AT_UID;
       a->a_v = kauth_cred_getuid(l->l_cred);
       a++;

       a->a_type = LINUX_AT_EUID;
       if (vap->va_mode & S_ISUID)
               a->a_v = vap->va_uid;
       else
               a->a_v = kauth_cred_geteuid(l->l_cred);
       a++;

       a->a_type = LINUX_AT_GID;
       a->a_v = kauth_cred_getgid(l->l_cred);
       a++;

       a->a_type = LINUX_AT_EGID;
       if (vap->va_mode & S_ISGID)
               a->a_v = vap->va_gid;
       else
               a->a_v = kauth_cred_getegid(l->l_cred);
       a++;

       a->a_type = LINUX_AT_RANDOM;
       a->a_v = (Elf_Addr)(uintptr_t)*stackp;
       a++;

       a->a_type = AT_NULL;
       a->a_v = 0;
       a++;

       randbytes[0] = cprng_strong32();
       randbytes[1] = cprng_strong32();
       randbytes[2] = cprng_strong32();
       randbytes[3] = cprng_strong32();

       len = sizeof(randbytes);
       if ((error = copyout(randbytes, *stackp, len)) != 0)
               return error;
       *stackp += len;

       len = (a - ai) * sizeof(AuxInfo);
       KASSERT(len <= LINUX_ELF_AUX_ENTRIES * sizeof(AuxInfo));
       if ((error = copyout(ai, *stackp, len)) != 0)
               return error;
       *stackp += len;

       return 0;
}
#endif /* !LINUX_MACHDEP_ELF_COPYARGS */