| 1 | /* Contributed by Viktor Dukhovni. */ |
| 2 | /* |
| 3 | * Unexec for Berkeley a.out format + SUNOS shared libraries |
| 4 | * The unexeced executable contains the __DYNAMIC area from the |
| 5 | * original text file, and then the rest of data + bss + malloced area of |
| 6 | * the current process. (The __DYNAMIC area is at the top of the process |
| 7 | * data segment, we use "data_start" defined externally to mark the start |
| 8 | * of the "real" data segment.) |
| 9 | * |
| 10 | * For programs that want to remap some of the data segment read only |
| 11 | * a run_time_remap is provided. This attempts to remap largest area starting |
| 12 | * and ending on page boundaries between "data_start" and "bndry" |
| 13 | * For this it to figure out where the text file is located. A path search |
| 14 | * is attempted after trying argv[0] and if all fails we simply do not remap |
| 15 | * |
| 16 | * One feature of run_time_remap () is mandatory: reseting the break. |
| 17 | * |
| 18 | * Note that we can no longer map data into the text segment, as this causes |
| 19 | * the __DYNAMIC struct to become read only, breaking the runtime loader. |
| 20 | * Thus we no longer need to mess with a private crt0.c, the standard one |
| 21 | * will do just fine, since environ can live in the writable area between |
| 22 | * __DYNAMIC and data_start, just make sure that pre-crt0.o (the name |
| 23 | * is somewhat abused here) is loaded first! |
| 24 | * |
| 25 | */ |
| 26 | #include <sys/param.h> |
| 27 | #include <sys/mman.h> |
| 28 | #include <sys/file.h> |
| 29 | #include <sys/stat.h> |
| 30 | #include <string.h> |
| 31 | #include <stdio.h> |
| 32 | #include <a.out.h> |
| 33 | |
| 34 | /* Do this after the above #include's in case a configuration file wants |
| 35 | to define things for this file based on what <a.out.h> defines. */ |
| 36 | #ifdef emacs |
| 37 | #include <config.h> |
| 38 | #endif |
| 39 | |
| 40 | #ifdef HAVE_UNISTD_H |
| 41 | #include <unistd.h> |
| 42 | #endif |
| 43 | |
| 44 | /* NetBSD needs this bit, but SunOS does not have it. */ |
| 45 | #ifndef MAP_FILE |
| 46 | #define MAP_FILE 0 |
| 47 | #endif |
| 48 | |
| 49 | |
| 50 | /* |
| 51 | * for programs other than emacs |
| 52 | * define data_start + initialized here, and make sure |
| 53 | * this object is loaded first! |
| 54 | * emacs will define these elsewhere, and load the object containing |
| 55 | * data_start (pre-crt0.o or firstfile.o?) first! |
| 56 | * The custom crt0.o *must not* be loaded! |
| 57 | */ |
| 58 | #ifndef emacs |
| 59 | static int data_start = 0; |
| 60 | static int initialized = 0; |
| 61 | #else |
| 62 | extern int initialized; |
| 63 | extern unsigned data_start; |
| 64 | extern int pureptr; |
| 65 | #endif |
| 66 | |
| 67 | extern char *getenv (); |
| 68 | static unsigned Brk; |
| 69 | static struct exec nhdr; |
| 70 | static int rd_only_len; |
| 71 | static long cookie; |
| 72 | |
| 73 | |
| 74 | unexec (new_name, a_name, bndry, bss_start, entry) |
| 75 | char *new_name, *a_name; |
| 76 | unsigned bndry, bss_start, entry; |
| 77 | { |
| 78 | int fd, new; |
| 79 | char *old; |
| 80 | struct exec ohdr; /* Allocate on the stack, not needed in the next life */ |
| 81 | struct stat stat; |
| 82 | |
| 83 | #ifdef emacs |
| 84 | fprintf (stderr, "Used %d bytes of Pure Storage\n", pureptr); |
| 85 | #endif |
| 86 | |
| 87 | if ((fd = open (a_name, O_RDONLY)) < 0) |
| 88 | { |
| 89 | fprintf (stderr, "%s: open: ", a_name); |
| 90 | perror (a_name); |
| 91 | exit (1); |
| 92 | } |
| 93 | if ((new = open (new_name, O_WRONLY | O_CREAT, 0666)) == -1) |
| 94 | { |
| 95 | fprintf (stderr, "%s: open: ", a_name); |
| 96 | perror (new_name); |
| 97 | exit (1); |
| 98 | } |
| 99 | |
| 100 | if ((fstat (fd, &stat) == -1)) |
| 101 | { |
| 102 | fprintf (stderr, "%s: ", a_name); |
| 103 | perror ("fstat"); |
| 104 | exit (1); |
| 105 | } |
| 106 | |
| 107 | old = (char *)mmap (0, stat.st_size, PROT_READ, MAP_FILE|MAP_SHARED, fd, 0); |
| 108 | if (old == (char *)-1) |
| 109 | { |
| 110 | fprintf (stderr, "%s: ", a_name); |
| 111 | perror ("mmap"); |
| 112 | exit (1); |
| 113 | } |
| 114 | close (fd); |
| 115 | |
| 116 | nhdr = ohdr = (*(struct exec *)old); |
| 117 | |
| 118 | |
| 119 | /* |
| 120 | * Remember a magic cookie so we know we've got the right binary |
| 121 | * when remapping. |
| 122 | */ |
| 123 | cookie = time (0); |
| 124 | |
| 125 | Brk = sbrk (0); /* Save the break, it is reset to &_end (by ld.so?) */ |
| 126 | |
| 127 | /* |
| 128 | * Round up data start to a page boundary (Lose if not a 2 power!) |
| 129 | */ |
| 130 | data_start = ((((int)&data_start) - 1) & ~(N_PAGSIZ (nhdr) - 1)) + N_PAGSIZ (nhdr); |
| 131 | |
| 132 | /* |
| 133 | * Round down read only pages to a multiple of the page size |
| 134 | */ |
| 135 | if (bndry) |
| 136 | rd_only_len = ((int)bndry & ~(N_PAGSIZ (nhdr) - 1)) - data_start; |
| 137 | |
| 138 | #ifndef emacs |
| 139 | /* Have to do this some time before dumping the data */ |
| 140 | initialized = 1; |
| 141 | #endif |
| 142 | |
| 143 | /* |
| 144 | * Handle new data and bss sizes and optional new entry point. |
| 145 | * No one actually uses bss_start and entry, but tradition compels |
| 146 | * one to support them. |
| 147 | * Could complain if bss_start > Brk, but the caller is *supposed* to know |
| 148 | * what she is doing. |
| 149 | */ |
| 150 | nhdr.a_data = (bss_start ? bss_start : Brk) - N_DATADDR (nhdr); |
| 151 | nhdr.a_bss = bss_start ? Brk - bss_start : 0; |
| 152 | if (entry) |
| 153 | nhdr.a_entry = entry; |
| 154 | |
| 155 | /* |
| 156 | * Write out the text segment with new header |
| 157 | * Dynamic executables are ZMAGIC with N_TXTOFF==0 and the header |
| 158 | * part of the text segment, but no need to rely on this. |
| 159 | * So write the TEXT first, then go back replace the header. |
| 160 | * Doing it in the other order is less general! |
| 161 | */ |
| 162 | lseek (new, N_TXTOFF (nhdr), L_SET); |
| 163 | write (new, old + N_TXTOFF (ohdr), N_TXTOFF (ohdr) + ohdr.a_text); |
| 164 | lseek (new, 0L, L_SET); |
| 165 | write (new, &nhdr, sizeof (nhdr)); |
| 166 | |
| 167 | /* |
| 168 | * Write out the head of the old data segment from the file not |
| 169 | * from core, this has the unresolved __DYNAMIC relocation data |
| 170 | * we need to reload |
| 171 | */ |
| 172 | lseek (new, N_DATOFF (nhdr), L_SET); |
| 173 | write (new, old + N_DATOFF (ohdr), (int)&data_start - N_DATADDR (ohdr)); |
| 174 | |
| 175 | /* |
| 176 | * Copy the rest of the data from core |
| 177 | */ |
| 178 | write (new, &data_start, N_BSSADDR (nhdr) - (int)&data_start); |
| 179 | |
| 180 | /* |
| 181 | * Copy the symbol table and line numbers |
| 182 | */ |
| 183 | lseek (new, N_TRELOFF (nhdr), L_SET); |
| 184 | write (new, old + N_TRELOFF (ohdr), stat.st_size - N_TRELOFF (ohdr)); |
| 185 | |
| 186 | fchmod (new, 0755); |
| 187 | } |
| 188 | |
| 189 | void |
| 190 | run_time_remap (progname) |
| 191 | char *progname; |
| 192 | { |
| 193 | char aout[MAXPATHLEN]; |
| 194 | register char *path, *p; |
| 195 | |
| 196 | /* Just in case */ |
| 197 | if (!initialized) |
| 198 | return; |
| 199 | |
| 200 | /* Restore the break */ |
| 201 | brk (Brk); |
| 202 | |
| 203 | /* If nothing to remap: we are done! */ |
| 204 | if (rd_only_len == 0) |
| 205 | return; |
| 206 | |
| 207 | /* |
| 208 | * Attempt to find the executable |
| 209 | * First try argv[0], will almost always succeed as shells tend to give |
| 210 | * the full path from the hash list rather than using execvp () |
| 211 | */ |
| 212 | if (is_it (progname)) |
| 213 | return; |
| 214 | |
| 215 | /* |
| 216 | * If argv[0] is a full path and does not exist, not much sense in |
| 217 | * searching further |
| 218 | */ |
| 219 | if (strchr (progname, '/')) |
| 220 | return; |
| 221 | |
| 222 | /* |
| 223 | * Try to search for argv[0] on the PATH |
| 224 | */ |
| 225 | path = getenv ("PATH"); |
| 226 | if (path == NULL) |
| 227 | return; |
| 228 | |
| 229 | while (*path) |
| 230 | { |
| 231 | /* copy through ':' or end */ |
| 232 | for (p = aout; *p = *path; ++p, ++path) |
| 233 | if (*p == ':') |
| 234 | { |
| 235 | ++path; /* move past ':' */ |
| 236 | break; |
| 237 | } |
| 238 | *p++ = '/'; |
| 239 | strcpy (p, progname); |
| 240 | /* |
| 241 | * aout is a candidate full path name |
| 242 | */ |
| 243 | if (is_it (aout)) |
| 244 | return; |
| 245 | } |
| 246 | } |
| 247 | |
| 248 | is_it (path) |
| 249 | char *path; |
| 250 | { |
| 251 | int fd; |
| 252 | long paths_cookie; |
| 253 | struct exec hdr; |
| 254 | |
| 255 | /* |
| 256 | * Open an executable and check for a valid header! |
| 257 | * Can't bcmp() the header with what we had, it may have been stripped! |
| 258 | * so we may save looking at non executables with the same name, mostly |
| 259 | * directories. |
| 260 | */ |
| 261 | fd = open (path, O_RDONLY); |
| 262 | if (fd != -1) |
| 263 | { |
| 264 | if (read (fd, &hdr, sizeof (hdr)) == sizeof (hdr) |
| 265 | && !N_BADMAG (hdr) && N_DATOFF (hdr) == N_DATOFF (nhdr) |
| 266 | && N_TRELOFF (hdr) == N_TRELOFF (nhdr)) |
| 267 | { |
| 268 | /* compare cookies */ |
| 269 | lseek (fd, N_DATOFF (hdr) + (int)&cookie - N_DATADDR (hdr), L_SET); |
| 270 | read (fd, &paths_cookie, sizeof (paths_cookie)); |
| 271 | if (paths_cookie == cookie) |
| 272 | { /* Eureka */ |
| 273 | |
| 274 | /* |
| 275 | * Do the mapping |
| 276 | * The PROT_EXEC may not be needed, but it is safer this way. |
| 277 | * should the shared library decide to indirect through |
| 278 | * addresses in the data segment not part of __DYNAMIC |
| 279 | */ |
| 280 | mmap (data_start, rd_only_len, PROT_READ | PROT_EXEC, |
| 281 | MAP_FILE | MAP_SHARED | MAP_FIXED, fd, |
| 282 | N_DATOFF (hdr) + data_start - N_DATADDR (hdr)); |
| 283 | close (fd); |
| 284 | return 1; |
| 285 | } |
| 286 | } |
| 287 | close (fd); |
| 288 | } |
| 289 | return 0; |
| 290 | } |