Until I figure out why NFS filesystems are having problems with

the 'load_irix_binary' and having kernel faults, Irix support is
disabled. I suspect locking of some sort, but I will now have to
investigate further.

Static IRIX binaries are now being detected properly and are using the
ELF interpreter found in this file.

Signed-off-by: Steven J. Hill <sjhill@realitydiluted.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

2 files changed, 123 insertions, 106 deletions

diff --git a/arch/mips/kernel/irixelf.c b/arch/mips/kernel/irixelf.c
index 4af20cd91f9f..881f125eecb4 100644
--- a/arch/mips/kernel/irixelf.c
+++ b/arch/mips/kernel/irixelf.c
@@ -8,7 +8,7 @@
  *
  * Copyright (C) 1993 - 1994 Eric Youngdale <ericy@cais.com>
  * Copyright (C) 1996 - 2004 David S. Miller <dm@engr.sgi.com>
- * Copyright (C) 2004 Steven J. Hill <sjhill@realitydiluted.com>
+ * Copyright (C) 2004 - 2005 Steven J. Hill <sjhill@realitydiluted.com>
  */
 #include <linux/module.h>
 #include <linux/fs.h>
@@ -31,15 +31,16 @@
 #include <linux/elfcore.h>
 #include <linux/smp_lock.h>
 
-#include <asm/uaccess.h>
 #include <asm/mipsregs.h>
+#include <asm/namei.h>
 #include <asm/prctl.h>
+#include <asm/uaccess.h>
 
 #define DLINFO_ITEMS 12
 
 #include <linux/elf.h>
 
-#undef DEBUG_ELF
+#undef DEBUG
 
 static int load_irix_binary(struct linux_binprm * bprm, struct pt_regs * regs);
 static int load_irix_library(struct file *);
@@ -55,7 +56,7 @@ static struct linux_binfmt irix_format = {
 #define elf_addr_t unsigned long
 #endif
 
-#ifdef DEBUG_ELF
+#ifdef DEBUG
 /* Debugging routines. */
 static char *get_elf_p_type(Elf32_Word p_type)
 {
@@ -120,7 +121,7 @@ static void dump_phdrs(struct elf_phdr *ep, int pnum)
 			print_phdr(i, ep);
 	}
 }
-#endif /* (DEBUG_ELF) */
+#endif /* DEBUG */
 
 static void set_brk(unsigned long start, unsigned long end)
 {
@@ -150,16 +151,16 @@ static void padzero(unsigned long elf_bss)
 	}
 }
 
-unsigned long * create_irix_tables(char * p, int argc, int envc,
-				   struct elfhdr * exec, unsigned int load_addr,
-				   unsigned int interp_load_addr,
-				   struct pt_regs *regs, struct elf_phdr *ephdr)
+static unsigned long * create_irix_tables(char * p, int argc, int envc,
+	struct elfhdr * exec, unsigned int load_addr,
+	unsigned int interp_load_addr, struct pt_regs *regs,
+	struct elf_phdr *ephdr)
 {
 	elf_addr_t *argv;
 	elf_addr_t *envp;
 	elf_addr_t *sp, *csp;
 
-#ifdef DEBUG_ELF
+#ifdef DEBUG
 	printk("create_irix_tables: p[%p] argc[%d] envc[%d] "
 	       "load_addr[%08x] interp_load_addr[%08x]\n",
 	       p, argc, envc, load_addr, interp_load_addr);
@@ -248,14 +249,13 @@ static unsigned int load_irix_interp(struct elfhdr * interp_elf_ex,
 	last_bss = 0;
 	error = load_addr = 0;
 
-#ifdef DEBUG_ELF
+#ifdef DEBUG
 	print_elfhdr(interp_elf_ex);
 #endif
 
 	/* First of all, some simple consistency checks */
 	if ((interp_elf_ex->e_type != ET_EXEC &&
 	     interp_elf_ex->e_type != ET_DYN) ||
-	     !irix_elf_check_arch(interp_elf_ex) ||
 	     !interpreter->f_op->mmap) {
 		printk("IRIX interp has bad e_type %d\n", interp_elf_ex->e_type);
 		return 0xffffffff;
@@ -290,7 +290,7 @@ static unsigned int load_irix_interp(struct elfhdr * interp_elf_ex,
 			   (char *) elf_phdata,
 			   sizeof(struct elf_phdr) * interp_elf_ex->e_phnum);
 
-#ifdef DEBUG_ELF
+#ifdef DEBUG
 	dump_phdrs(elf_phdata, interp_elf_ex->e_phnum);
 #endif
 
@@ -306,13 +306,11 @@ static unsigned int load_irix_interp(struct elfhdr * interp_elf_ex,
 	    elf_type |= MAP_FIXED;
 	    vaddr = eppnt->p_vaddr;
 
-#ifdef DEBUG_ELF
-	    printk("INTERP do_mmap(%p, %08lx, %08lx, %08lx, %08lx, %08lx) ",
+	    pr_debug("INTERP do_mmap(%p, %08lx, %08lx, %08lx, %08lx, %08lx) ",
 		   interpreter, vaddr,
 		   (unsigned long) (eppnt->p_filesz + (eppnt->p_vaddr & 0xfff)),
 		   (unsigned long) elf_prot, (unsigned long) elf_type,
 		   (unsigned long) (eppnt->p_offset & 0xfffff000));
-#endif
 	    down_write(&current->mm->mmap_sem);
 	    error = do_mmap(interpreter, vaddr,
 			    eppnt->p_filesz + (eppnt->p_vaddr & 0xfff),
@@ -324,14 +322,10 @@ static unsigned int load_irix_interp(struct elfhdr * interp_elf_ex,
 		    printk("Aieee IRIX interp mmap error=%d\n", error);
 		    break;  /* Real error */
 	    }
-#ifdef DEBUG_ELF
-	    printk("error=%08lx ", (unsigned long) error);
-#endif
+	    pr_debug("error=%08lx ", (unsigned long) error);
 	    if(!load_addr && interp_elf_ex->e_type == ET_DYN) {
 	      load_addr = error;
-#ifdef DEBUG_ELF
-              printk("load_addr = error ");
-#endif
+              pr_debug("load_addr = error ");
 	    }
 
 	    /* Find the end of the file  mapping for this phdr, and keep
@@ -345,17 +339,13 @@ static unsigned int load_irix_interp(struct elfhdr * interp_elf_ex,
 	     */
 	    k = eppnt->p_memsz + eppnt->p_vaddr;
 	    if(k > last_bss) last_bss = k;
-#ifdef DEBUG_ELF
-	    printk("\n");
-#endif
+	    pr_debug("\n");
 	  }
 	}
 
 	/* Now use mmap to map the library into memory. */
 	if(error < 0 && error > -1024) {
-#ifdef DEBUG_ELF
-		printk("got error %d\n", error);
-#endif
+		pr_debug("got error %d\n", error);
 		kfree(elf_phdata);
 		return 0xffffffff;
 	}
@@ -365,16 +355,12 @@ static unsigned int load_irix_interp(struct elfhdr * interp_elf_ex,
 	 * that there are zero-mapped pages up to and including the
 	 * last bss page.
 	 */
-#ifdef DEBUG_ELF
-	printk("padzero(%08lx) ", (unsigned long) (elf_bss));
-#endif
+	pr_debug("padzero(%08lx) ", (unsigned long) (elf_bss));
 	padzero(elf_bss);
 	len = (elf_bss + 0xfff) & 0xfffff000; /* What we have mapped so far */
 
-#ifdef DEBUG_ELF
-	printk("last_bss[%08lx] len[%08lx]\n", (unsigned long) last_bss,
-	       (unsigned long) len);
-#endif
+	pr_debug("last_bss[%08lx] len[%08lx]\n", (unsigned long) last_bss,
+	         (unsigned long) len);
 
 	/* Map the last of the bss segment */
 	if (last_bss > len) {
@@ -396,12 +382,7 @@ static int verify_binary(struct elfhdr *ehp, struct linux_binprm *bprm)
 
 	/* First of all, some simple consistency checks */
 	if((ehp->e_type != ET_EXEC && ehp->e_type != ET_DYN) ||
-	    !irix_elf_check_arch(ehp) || !bprm->file->f_op->mmap) {
-		return -ENOEXEC;
-	}
-
-	/* Only support MIPS ARCH2 or greater IRIX binaries for now. */
-	if(!(ehp->e_flags & EF_MIPS_ARCH) && !(ehp->e_flags & 0x04)) {
+	    !bprm->file->f_op->mmap) {
 		return -ENOEXEC;
 	}
 
@@ -411,16 +392,17 @@ static int verify_binary(struct elfhdr *ehp, struct linux_binprm *bprm)
 	 * XXX all registers as 64bits on cpu's capable of this at
 	 * XXX exception time plus frob the XTLB exception vector.
 	 */
-	if((ehp->e_flags & 0x20)) {
+	if((ehp->e_flags & EF_MIPS_ABI2))
 		return -ENOEXEC;
-	}
 
-	return 0; /* It's ok. */
+	return 0;
 }
 
-#define IRIX_INTERP_PREFIX "/usr/gnemul/irix"
-
-/* Look for an IRIX ELF interpreter. */
+/*
+ * This is where the detailed check is performed. Irix binaries
+ * use interpreters with 'libc.so' in the name, so this function
+ * can differentiate between Linux and Irix binaries.
+ */
 static inline int look_for_irix_interpreter(char **name,
 					    struct file **interpreter,
 					    struct elfhdr *interp_elf_ex,
@@ -440,12 +422,13 @@ static inline int look_for_irix_interpreter(char **name,
 		if (*name != NULL)
 			goto out;
 
-		*name = kmalloc((epp->p_filesz + strlen(IRIX_INTERP_PREFIX)),
-				GFP_KERNEL);
+		*name = (char *) kmalloc((epp->p_filesz +
+					  strlen(IRIX_EMUL)),
+					 GFP_KERNEL);
 		if (!*name)
 			return -ENOMEM;
 
-		strcpy(*name, IRIX_INTERP_PREFIX);
+		strcpy(*name, IRIX_EMUL);
 		retval = kernel_read(bprm->file, epp->p_offset, (*name + 16),
 		                     epp->p_filesz);
 		if (retval < 0)
@@ -562,7 +545,7 @@ static inline int map_interpreter(struct elf_phdr *epp, struct elfhdr *ihp,
  * process and the system, here we map the page and fill the
  * structure
  */
-void irix_map_prda_page (void)
+static void irix_map_prda_page(void)
 {
 	unsigned long v;
 	struct prda *pp;
@@ -601,14 +584,33 @@ static int load_irix_binary(struct linux_binprm * bprm, struct pt_regs * regs)
 
 	load_addr = 0;
 	has_interp = has_ephdr = 0;
-	elf_ihdr = elf_ephdr = 0;
+	elf_ihdr = elf_ephdr = NULL;
 	elf_ex = *((struct elfhdr *) bprm->buf);
 	retval = -ENOEXEC;
 
 	if (verify_binary(&elf_ex, bprm))
 		goto out;
 
-#ifdef DEBUG_ELF
+	/*
+	 * Telling -o32 static binaries from Linux and Irix apart from each
+	 * other is difficult. There are 2 differences to be noted for static
+	 * binaries from the 2 operating systems:
+	 *
+	 *    1) Irix binaries have their .text section before their .init
+	 *       section. Linux binaries are just the opposite.
+	 *
+	 *    2) Irix binaries usually have <= 12 sections and Linux
+	 *       binaries have > 20.
+	 *
+	 * We will use Method #2 since Method #1 would require us to read in
+	 * the section headers which is way too much overhead. This appears
+	 * to work for everything we have ran into so far. If anyone has a
+	 * better method to tell the binaries apart, I'm listening.
+	 */
+	if (elf_ex.e_shnum > 20)
+		goto out;
+
+#ifdef DEBUG
 	print_elfhdr(&elf_ex);
 #endif
 
@@ -623,11 +625,10 @@ static int load_irix_binary(struct linux_binprm * bprm, struct pt_regs * regs)
 	}
 
 	retval = kernel_read(bprm->file, elf_ex.e_phoff, (char *)elf_phdata, size);
-
 	if (retval < 0)
 		goto out_free_ph;
 
-#ifdef DEBUG_ELF
+#ifdef DEBUG
 	dump_phdrs(elf_phdata, elf_ex.e_phnum);
 #endif
 
@@ -644,9 +645,8 @@ static int load_irix_binary(struct linux_binprm * bprm, struct pt_regs * regs)
 			break;
 		};
 	}
-#ifdef DEBUG_ELF
-	printk("\n");
-#endif
+
+	pr_debug("\n");
 
 	elf_bss = 0;
 	elf_brk = 0;
@@ -657,12 +657,19 @@ static int load_irix_binary(struct linux_binprm * bprm, struct pt_regs * regs)
 	end_code = 0;
 	end_data = 0;
 
-	retval = look_for_irix_interpreter(&elf_interpreter,
-	                                   &interpreter,
+	/*
+	 * If we get a return value, we change the value to be ENOEXEC
+	 * so that we can exit gracefully and the main binary format
+	 * search loop in 'fs/exec.c' will move onto the next handler
+	 * which should be the normal ELF binary handler.
+	 */
+	retval = look_for_irix_interpreter(&elf_interpreter, &interpreter,
 					   &interp_elf_ex, elf_phdata, bprm,
 					   elf_ex.e_phnum);
-	if (retval)
+	if (retval) {
+		retval = -ENOEXEC;
 		goto out_free_file;
+	}
 
 	if (elf_interpreter) {
 		retval = verify_irix_interpreter(&interp_elf_ex);
@@ -746,18 +753,16 @@ static int load_irix_binary(struct linux_binprm * bprm, struct pt_regs * regs)
 	 * IRIX maps a page at 0x200000 which holds some system
 	 * information.  Programs depend on this.
 	 */
-	irix_map_prda_page ();
+	irix_map_prda_page();
 
 	padzero(elf_bss);
 
-#ifdef DEBUG_ELF
-	printk("(start_brk) %lx\n" , (long) current->mm->start_brk);
-	printk("(end_code) %lx\n" , (long) current->mm->end_code);
-	printk("(start_code) %lx\n" , (long) current->mm->start_code);
-	printk("(end_data) %lx\n" , (long) current->mm->end_data);
-	printk("(start_stack) %lx\n" , (long) current->mm->start_stack);
-	printk("(brk) %lx\n" , (long) current->mm->brk);
-#endif
+	pr_debug("(start_brk) %lx\n" , (long) current->mm->start_brk);
+	pr_debug("(end_code) %lx\n" , (long) current->mm->end_code);
+	pr_debug("(start_code) %lx\n" , (long) current->mm->start_code);
+	pr_debug("(end_data) %lx\n" , (long) current->mm->end_data);
+	pr_debug("(start_stack) %lx\n" , (long) current->mm->start_stack);
+	pr_debug("(brk) %lx\n" , (long) current->mm->brk);
 
 #if 0 /* XXX No fucking way dude... */
 	/* Why this, you ask???  Well SVr4 maps page 0 as read-only,
@@ -782,8 +787,7 @@ out_free_dentry:
 	allow_write_access(interpreter);
 	fput(interpreter);
 out_free_interp:
-	if (elf_interpreter)
-		kfree(elf_interpreter);
+	kfree(elf_interpreter);
 out_free_file:
 out_free_ph:
 	kfree (elf_phdata);
@@ -813,7 +817,7 @@ static int load_irix_library(struct file *file)
 
 	/* First of all, some simple consistency checks. */
 	if(elf_ex.e_type != ET_EXEC || elf_ex.e_phnum > 2 ||
-	   !irix_elf_check_arch(&elf_ex) || !file->f_op->mmap)
+	   !file->f_op->mmap)
 		return -ENOEXEC;
 
 	/* Now read in all of the header information. */
@@ -876,33 +880,34 @@ static int load_irix_library(struct file *file)
  */
 unsigned long irix_mapelf(int fd, struct elf_phdr *user_phdrp, int cnt)
 {
+	unsigned long type, vaddr, filesz, offset, flags;
 	struct elf_phdr *hp;
 	struct file *filp;
 	int i, retval;
 
-#ifdef DEBUG_ELF
-	printk("irix_mapelf: fd[%d] user_phdrp[%p] cnt[%d]\n",
-	       fd, user_phdrp, cnt);
-#endif
+	pr_debug("irix_mapelf: fd[%d] user_phdrp[%p] cnt[%d]\n",
+	         fd, user_phdrp, cnt);
 
 	/* First get the verification out of the way. */
 	hp = user_phdrp;
 	if (!access_ok(VERIFY_READ, hp, (sizeof(struct elf_phdr) * cnt))) {
-#ifdef DEBUG_ELF
-		printk("irix_mapelf: access_ok fails!\n");
-#endif
+		pr_debug("irix_mapelf: bad pointer to ELF PHDR!\n");
+
 		return -EFAULT;
 	}
 
-#ifdef DEBUG_ELF
+#ifdef DEBUG
 	dump_phdrs(user_phdrp, cnt);
 #endif
 
-	for(i = 0; i < cnt; i++, hp++)
-		if(hp->p_type != PT_LOAD) {
+	for (i = 0; i < cnt; i++, hp++) {
+		if (__get_user(type, &hp->p_type))
+			return -EFAULT;
+		if (type != PT_LOAD) {
 			printk("irix_mapelf: One section is not PT_LOAD!\n");
 			return -ENOEXEC;
 		}
+	}
 
 	filp = fget(fd);
 	if (!filp)
@@ -917,29 +922,40 @@ unsigned long irix_mapelf(int fd, struct elf_phdr *user_phdrp, int cnt)
 	for(i = 0; i < cnt; i++, hp++) {
 		int prot;
 
-		prot  = (hp->p_flags & PF_R) ? PROT_READ : 0;
-		prot |= (hp->p_flags & PF_W) ? PROT_WRITE : 0;
-		prot |= (hp->p_flags & PF_X) ? PROT_EXEC : 0;
+		retval = __get_user(vaddr, &hp->p_vaddr);
+		retval |= __get_user(filesz, &hp->p_filesz);
+		retval |= __get_user(offset, &hp->p_offset);
+		retval |= __get_user(flags, &hp->p_flags);
+		if (retval)
+			return retval;
+
+		prot  = (flags & PF_R) ? PROT_READ : 0;
+		prot |= (flags & PF_W) ? PROT_WRITE : 0;
+		prot |= (flags & PF_X) ? PROT_EXEC : 0;
+
 		down_write(&current->mm->mmap_sem);
-		retval = do_mmap(filp, (hp->p_vaddr & 0xfffff000),
-				 (hp->p_filesz + (hp->p_vaddr & 0xfff)),
+		retval = do_mmap(filp, (vaddr & 0xfffff000),
+				 (filesz + (vaddr & 0xfff)),
 				 prot, (MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE),
-				 (hp->p_offset & 0xfffff000));
+				 (offset & 0xfffff000));
 		up_write(&current->mm->mmap_sem);
 
-		if(retval != (hp->p_vaddr & 0xfffff000)) {
+		if (retval != (vaddr & 0xfffff000)) {
 			printk("irix_mapelf: do_mmap fails with %d!\n", retval);
 			fput(filp);
 			return retval;
 		}
 	}
 
-#ifdef DEBUG_ELF
-	printk("irix_mapelf: Success, returning %08lx\n",
-		(unsigned long) user_phdrp->p_vaddr);
-#endif
+	pr_debug("irix_mapelf: Success, returning %08lx\n",
+		 (unsigned long) user_phdrp->p_vaddr);
+
 	fput(filp);
-	return user_phdrp->p_vaddr;
+
+	if (__get_user(vaddr, &user_phdrp->p_vaddr))
+		return -EFAULT;
+
+	return vaddr;
 }
 
 /*
@@ -954,7 +970,7 @@ unsigned long irix_mapelf(int fd, struct elf_phdr *user_phdrp, int cnt)
  */
 static int dump_write(struct file *file, const void *addr, int nr)
 {
-	return file->f_op->write(file, addr, nr, &file->f_pos) == nr;
+	return file->f_op->write(file, (const char *) addr, nr, &file->f_pos) == nr;
 }
 
 static int dump_seek(struct file *file, off_t off)
@@ -1073,7 +1089,7 @@ static int irix_core_dump(long signr, struct pt_regs * regs, struct file *file)
 	/* Count what's needed to dump, up to the limit of coredump size. */
 	segs = 0;
 	size = 0;
-	for(vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) {
+	for (vma = current->mm->mmap; vma != NULL; vma = vma->vm_next) {
 		if (maydump(vma))
 		{
 			int sz = vma->vm_end-vma->vm_start;
@@ -1187,9 +1203,9 @@ static int irix_core_dump(long signr, struct pt_regs * regs, struct file *file)
 
 		len = current->mm->arg_end - current->mm->arg_start;
 		len = len >= ELF_PRARGSZ ? ELF_PRARGSZ : len;
-		copy_from_user(&psinfo.pr_psargs,
+		(void *) copy_from_user(&psinfo.pr_psargs,
 			       (const char *)current->mm->arg_start, len);
-		for(i = 0; i < len; i++)
+		for (i = 0; i < len; i++)
 			if (psinfo.pr_psargs[i] == 0)
 				psinfo.pr_psargs[i] = ' ';
 		psinfo.pr_psargs[len] = 0;
@@ -1256,8 +1272,10 @@ static int irix_core_dump(long signr, struct pt_regs * regs, struct file *file)
 		phdr.p_memsz = sz;
 		offset += phdr.p_filesz;
 		phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
-		if (vma->vm_flags & VM_WRITE) phdr.p_flags |= PF_W;
-		if (vma->vm_flags & VM_EXEC) phdr.p_flags |= PF_X;
+		if (vma->vm_flags & VM_WRITE)
+			phdr.p_flags |= PF_W;
+		if (vma->vm_flags & VM_EXEC)
+			phdr.p_flags |= PF_X;
 		phdr.p_align = PAGE_SIZE;
 
 		DUMP_WRITE(&phdr, sizeof(phdr));
@@ -1299,7 +1317,7 @@ end_coredump:
 
 static int __init init_irix_binfmt(void)
 {
-	int init_inventory(void);
+	extern int init_inventory(void);
 	extern asmlinkage unsigned long sys_call_table;
 	extern asmlinkage unsigned long sys_call_table_irix5;
 
@@ -1318,7 +1336,9 @@ static int __init init_irix_binfmt(void)
 
 static void __exit exit_irix_binfmt(void)
 {
-	/* Remove the IRIX ELF loaders. */
+	/*
+	 * Remove the Irix ELF loader.
+	 */
 	unregister_binfmt(&irix_format);
 }
 
diff --git a/include/asm-mips/elf.h b/include/asm-mips/elf.h
index e48811440015..a743da55e110 100644
--- a/include/asm-mips/elf.h
+++ b/include/asm-mips/elf.h
@@ -234,9 +234,6 @@ extern int dump_task_fpu(struct task_struct *, elf_fpregset_t *);
 
 #endif /* __KERNEL__ */
 
-/* This one accepts IRIX binaries.  */
-#define irix_elf_check_arch(hdr)	((hdr)->e_flags & RHF_SGI_ONLY)
-
 #define USE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE	PAGE_SIZE