boot1.c

linux下用PCMCIA无线网卡虚拟无线AP的程序源码

/* Run an ELF binary on a linux system.

   Copyright (C) 1993-1996, Eric Youngdale.

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 2, or (at your option)
   any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program; if not, write to the Free Software
   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.  */



/* Program to load an ELF binary on a linux system, and run it.
 * References to symbols in sharable libraries can be resolved by
 * an ELF sharable library. */

/* Disclaimer:  I have never seen any AT&T source code for SVr4, nor have
   I ever taken any courses on internals.  This program was developed using
   information available through the book "UNIX SYSTEM V RELEASE 4,
   Programmers guide: Ansi C and Programming Support Tools", which did
   a more than adequate job of explaining everything required to get this
   working. */

/*
 * The main trick with this program is that initially, we ourselves are not
 * dynamicly linked.  This means that we cannot access any global variables
 * since the GOT is initialized by the linker assuming a virtual address of 0,
 * and we cannot call any functions since the PLT is not initialized at all
 * (it will tend to want to call the dynamic linker
 *
 * There are further restrictions - we cannot use large switch statements,
 * since the compiler generates tables of addresses and jumps through them.
 * We can use inline functions, because these do not transfer control to
 * a new address, but they must be static so that they are not exported
 * from the modules.  We cannot use normal syscall stubs, because these
 * all reference the errno global variable which is not yet initialized.
 * We can use all of the local stack variables that we want, since these
 * are all referenced to %ebp or %esp.
 *
 * Life is further complicated by the fact that initially we do not want
 * to do a complete dynamic linking.  We want to allow the user to supply
 * new functions replacing some of the library versions, and until we have
 * the list of modules that we should search set up, we do not want to do
 * any of this.  Thus I have chosen to only perform the relocations for
 * variables that start with "_dl_" since ANSI specifies that the user is
 * not supposed to redefine any of these variables.
 *
 * Fortunately, the linker itself leaves a few clues lying around, and
 * when the kernel starts the image, there are a few further clues.
 * First of all, there is information buried on the stack that the kernel
 * leaves, which includes information about the load address that the
 * program interpreter was loaded at, the number of sections, the address
 * the application was loaded at and so forth.  Here this information
 * is stored in the array dl_info, and the indicies are taken from the
 * file /usr/include/sys/auxv.h on any SVr4 system.
 *
 * The linker itself leaves a pointer to the .dynamic section in the first
 * slot of the GOT, and as it turns out, %ebx points to ghe GOT when
 * you are using PIC code, so we just dereference this to get the address
 * of the dynamic sections.
 *
 * Typically you must load all text pages as writable so that dynamic linking
 * can succeed.  The kernel under SVr4 loads these as R/O, so we must call
 * mprotect to change the protections.  Once we are done, we should set these
 * back again, so the desired behavior is achieved.  Under linux there is
 * currently no mprotect function in the distribution kernel (although
 * someone has alpha patches), so for now everything is loaded writable.
 *
 * We do not have access to malloc and friends at the initial stages of dynamic
 * linking, and it would be handy to have some scratchpad memory available for
 * use as we set things up.  We mmap one page of scratch space, and have a
 * simple _dl_malloc that uses this memory.  This is a good thing, since we do
 * not want to use the same memory pool as malloc anyway - esp if the user
 * redefines malloc to do something funky.
 *
 * Our first task is to perform a minimal linking so that we can call other
 * portions of the dynamic linker.  Once we have done this, we then build
 * the list of modules that the application requires, using LD_LIBRARY_PATH
 * if this is not a suid program (/usr/lib otherwise).  Once this is done,
 * we can do the dynamic linking as required (and we must omit the things
 * we did to get the dynamic linker up and running in the first place.
 * After we have done this, we just have a few housekeeping chores and we
 * can transfer control to the user's application.
 */

#include <stdarg.h>
#include "sysdep.h" /* before elf.h to get ELF_USES_RELOCA right */
#include <elf.h>
#include "linuxelf.h"
#include "hash.h"
#include "syscall.h"
#include "string.h"
#include "../config.h"

#define ALLOW_ZERO_PLTGOT

/*  Some arches may need to override this in boot1_arch.h */
#define	    ELFMAGIC	ELFMAG

/* This is a poor man's malloc, used prior to resolving our internal poor man's malloc */
#define DL_MALLOC(SIZE) ((void *) (malloc_buffer += SIZE, malloc_buffer - SIZE)) ;  REALIGN();
/*
 * Make sure that the malloc buffer is aligned on 4 byte boundary.  For 64 bit
 * platforms we may need to increase this to 8, but this is good enough for
 * now.  This is typically called after DL_MALLOC.
 */
#define REALIGN() malloc_buffer = (char *) (((unsigned long) malloc_buffer + 3) & ~(3))

static char *_dl_malloc_addr, *_dl_mmap_zero;
char *_dl_library_path = 0;		/* Where we look for libraries */
char *_dl_preload = 0;			/* Things to be loaded before the libs. */
#include "ld.so.h"			/* Pull in the name of ld.so */
const char *_dl_progname=_dl_static_progname;
static char *_dl_not_lazy = 0;
#ifdef DL_TRACE
static char *_dl_trace_loaded_objects = 0;
#endif
static int (*_dl_elf_main) (int, char **, char **);
static int (*_dl_elf_init) (void);
void *(*_dl_malloc_function) (int size) = NULL;
struct r_debug *_dl_debug_addr = NULL;
unsigned long *_dl_brkp;
unsigned long *_dl_envp;
char *_dl_getenv(char *symbol, char **envp);
void _dl_unsetenv(char *symbol, char **envp);
int _dl_fixup(struct elf_resolve *tpnt);
void _dl_debug_state(void);
char *_dl_get_last_path_component(char *path);

#include "boot1_arch.h"


/* When we enter this piece of code, the program stack looks like this:
        argc            argument counter (integer)
        argv[0]         program name (pointer)
        argv[1...N]     program args (pointers)
        argv[argc-1]    end of args (integer)
	NULL
        env[0...N]      environment variables (pointers)
        NULL
	auxv_t[0...N]   Auxiliary Vector Table elements (mixed types)
*/

DL_BOOT(unsigned long args)
{
	unsigned int argc;
	char **argv, **envp;
	unsigned long load_addr;
	unsigned long *got;
	unsigned long *aux_dat;
	int goof = 0;
	elfhdr *header;
	struct elf_resolve *tpnt;
	struct dyn_elf *rpnt;
	struct elf_resolve *app_tpnt;
	unsigned long brk_addr;
	Elf32_auxv_t auxv_t[AT_EGID + 1];
	unsigned char *malloc_buffer, *mmap_zero;
	int (*_dl_atexit) (void *);
	unsigned long *lpnt;
	Elf32_Dyn *dpnt;
	unsigned long *hash_addr;
	struct r_debug *debug_addr;
	unsigned long *chains;
	int indx;
	int _dl_secure;
	int status;


	/* WARNING! -- we cannot make _any_ funtion calls until we have
	 * taken care of fixing up our own relocations.  Making static
	 * lnline calls is ok, but _no_ function calls.  Not yet
	 * anyways. */

	/* First obtain the information on the stack that tells us more about
	   what binary is loaded, where it is loaded, etc, etc */
	GET_ARGV(aux_dat,args);
#if defined(__arm__)
	aux_dat+=1;
#endif	
	argc = *(aux_dat - 1);
        argv = (char **) aux_dat;
	aux_dat += argc;			/* Skip over the argv pointers */
	aux_dat++;				/* Skip over NULL at end of argv */
	envp = (char **) aux_dat;
	while (*aux_dat)
		aux_dat++;			/* Skip over the envp pointers */
	aux_dat++;				/* Skip over NULL at end of envp */

	/* Place -1 here as a checkpoint.  We later check if it was changed
	 * when we read in the auxv_t */
	auxv_t[AT_UID].a_type = -1;
	
	/* The junk on the stack immediately following the environment is  
	 * the Auxiliary Vector Table.  Read out the elements of the auxv_t,
	 * sort and store them in auxv_t for later use. */
	while (*aux_dat) 
	{
		Elf32_auxv_t *auxv_entry = (Elf32_auxv_t*) aux_dat;

		if (auxv_entry->a_type <= AT_EGID) {
			_dl_memcpy(&(auxv_t[auxv_entry->a_type]), 
				auxv_entry, sizeof(Elf32_auxv_t));
		}
		aux_dat += 2;
	}
	
	/* locate the ELF header.   We need this done as soon as possible 
	 * (esp since SEND_STDERR() needs this on some platforms... */
	load_addr = auxv_t[AT_BASE].a_un.a_val;
	header = (elfhdr *) auxv_t[AT_BASE].a_un.a_ptr;

	/* Check the ELF header to make sure everything looks ok.  */
	if (! header || header->e_ident[EI_CLASS] != ELFCLASS32 ||
		header->e_ident[EI_VERSION] != EV_CURRENT || 
		_dl_strncmp((void *)header, ELFMAGIC, SELFMAG) != 0)
	{
	    SEND_STDERR("Invalid ELF header\n");
	    _dl_exit(0);
	}
#ifdef DL_DEBUG
	SEND_STDERR("ELF header =");
	SEND_ADDRESS_STDERR(load_addr, 1);
#endif	


	/* Locate the global offset table.  Since this code must be PIC  
	 * we can take advantage of the magic offset register, if we
	 * happen to know what that is for this architecture.  If not,
	 * we can always read stuff out of the ELF file to find it... */
#if defined(__i386__)
	__asm__("\tmovl %%ebx,%0\n\t" : "=a" (got));
#elif defined(__m68k__)
	__asm__ ("movel %%a5,%0" : "=g" (got))
#elif defined(__sparc__)
	__asm__("\tmov %%l7,%0\n\t" : "=r" (got))
#elif defined(__arm__)
	__asm__("\tmov %0, r10\n\t" : "=r"(got));
#elif defined(__powerpc__)
	__asm__("\tbl _GLOBAL_OFFSET_TABLE_-4@local\n\t" : "=l"(got));
#else
	/* Do things the slow way in C */
	{
	    unsigned long tx_reloc;
	    Elf32_Dyn *dynamic=NULL;
	    Elf32_Shdr *shdr;
	    Elf32_Phdr *pt_load;

#ifdef DL_DEBUG
	    SEND_STDERR("Finding the got using C code to read the ELF file\n");
#endif	
	    /* Find where the dynamic linking information section is hiding */
	    shdr = (Elf32_Shdr *)(header->e_shoff + (char *)header);
	    for (indx = header->e_shnum; --indx>=0; ++shdr) {
		if (shdr->sh_type == SHT_DYNAMIC) {
		    goto found_dynamic;
		}
	    }
	    SEND_STDERR("missing dynamic linking information section \n");
	    _dl_exit(0);

found_dynamic:
	    dynamic = (Elf32_Dyn*)(shdr->sh_offset + (char *)header);

	    /* Find where PT_LOAD is hiding */
	    pt_load = (Elf32_Phdr *)(header->e_phoff + (char *)header);
	    for (indx = header->e_phnum; --indx>=0; ++pt_load) {
		if (pt_load->p_type == PT_LOAD) {
		    goto found_pt_load;
		}
	    }
	    SEND_STDERR("missing loadable program segment\n");
	    _dl_exit(0);

found_pt_load:
	    /* Now (finally) find where DT_PLTGOT is hiding */
	    tx_reloc = pt_load->p_vaddr - pt_load->p_offset;
	    for (; DT_NULL!=dynamic->d_tag; ++dynamic) {
		if (dynamic->d_tag == DT_PLTGOT) {
		    goto found_got;
		}       
	    }       
	    SEND_STDERR("missing global offset table\n");
	    _dl_exit(0);

found_got:
	    got = (unsigned long *)(dynamic->d_un.d_val - tx_reloc + (char *)header );
	}
#endif

	/* Now, finally, fix up the location of the dynamic stuff */
	dpnt = (Elf32_Dyn *) (*got + load_addr);
#ifdef DL_DEBUG
	SEND_STDERR("First Dynamic section entry=");
	SEND_ADDRESS_STDERR(dpnt, 1);
#endif	

	
	/* Call mmap to get a page of writable memory that can be used 
	 * for _dl_malloc throughout the shared lib loader. */
	mmap_zero = malloc_buffer = _dl_mmap((void *) 0, 4096, 
		PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
	if (_dl_mmap_check_error(mmap_zero)) {
	    SEND_STDERR("dl_boot: mmap of a spare page failed!\n");
	    _dl_exit(13);
	}

	tpnt = DL_MALLOC(sizeof(struct elf_resolve));
	_dl_memset(tpnt, 0, sizeof(*tpnt));
	app_tpnt = DL_MALLOC(sizeof(struct elf_resolve));
	_dl_memset(app_tpnt, 0, sizeof(*app_tpnt));

	/*
	 * This is used by gdb to locate the chain of shared libraries that are currently loaded.
	 */
	debug_addr = DL_MALLOC(sizeof(struct r_debug));
	_dl_memset(debug_addr, 0, sizeof(*debug_addr));

	/* OK, that was easy.  Next scan the DYNAMIC section of the image.
	   We are only doing ourself right now - we will have to do the rest later */

	while (dpnt->d_tag) {
		tpnt->dynamic_info[dpnt->d_tag] = dpnt->d_un.d_val;
		if (dpnt->d_tag == DT_TEXTREL || SVR4_BUGCOMPAT)
			tpnt->dynamic_info[DT_TEXTREL] = 1;
		dpnt++;
	}

	{
		elf_phdr *ppnt;
		int i;

		ppnt = (elf_phdr *) auxv_t[AT_PHDR].a_un.a_ptr;
		for (i = 0; i < auxv_t[AT_PHNUM].a_un.a_val; i++, ppnt++)
			if (ppnt->p_type == PT_DYNAMIC) {
				dpnt = (Elf32_Dyn *) ppnt->p_vaddr;
				while (dpnt->d_tag) {
					if (dpnt->d_tag > DT_JMPREL) {
						dpnt++;
						continue;
					}
					app_tpnt->dynamic_info[dpnt->d_tag] = dpnt->d_un.d_val;
					if (dpnt->d_tag == DT_DEBUG)
						dpnt->d_un.d_val = (unsigned long) debug_addr;
					if (dpnt->d_tag == DT_TEXTREL || SVR4_BUGCOMPAT)
						app_tpnt->dynamic_info[DT_TEXTREL] = 1;
					dpnt++;
				}
			}
	}

	/* Get some more of the information that we will need to dynamicly link
	   this module to itself */

	hash_addr = (unsigned long *) (tpnt->dynamic_info[DT_HASH] + load_addr);
	tpnt->nbucket = *hash_addr++;
	tpnt->nchain = *hash_addr++;
	tpnt->elf_buckets = hash_addr;
	hash_addr += tpnt->nbucket;
	chains = hash_addr;

	/* Ugly, ugly.  We need to call mprotect to change the protection of
	   the text pages so that we can do the dynamic linking.  We can set the
	   protection back again once we are done */

	{
		elf_phdr *ppnt;
		int i;

		/* First cover the shared library/dynamic linker. */
		if (tpnt->dynamic_info[DT_TEXTREL]) {
			header = (elfhdr *) auxv_t[AT_BASE].a_un.a_ptr;
			ppnt = (elf_phdr *) (auxv_t[AT_BASE].a_un.a_ptr + header->e_phoff);
			for (i = 0; i < header->e_phnum; i++, ppnt++) {
				if (ppnt->p_type == PT_LOAD && !(ppnt->p_flags & PF_W))
					_dl_mprotect((void *) (load_addr + (ppnt->p_vaddr & 0xfffff000)), 
						(ppnt->p_vaddr & 0xfff) + (unsigned long) ppnt->p_filesz, 
						PROT_READ | PROT_WRITE | PROT_EXEC);
			}
		}

		/* Now cover the application program. */
		if (app_tpnt->dynamic_info[DT_TEXTREL]) {
			ppnt = (elf_phdr *) auxv_t[AT_PHDR].a_un.a_ptr;
			for (i = 0; i < auxv_t[AT_PHNUM].a_un.a_val; i++, ppnt++) {
				if (ppnt->p_type == PT_LOAD && !(ppnt->p_flags & PF_W))
					_dl_mprotect((void *) (ppnt->p_vaddr & 0xfffff000), 
						(ppnt->p_vaddr & 0xfff) + 
						(unsigned long) ppnt->p_filesz,