Commit | Line | Data |
---|---|---|
175fca3b SS |
1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* | |
3 | * Load ELF vmlinux file for the kexec_file_load syscall. | |
4 | * | |
5 | * Copyright (C) 2004 Adam Litke (agl@us.ibm.com) | |
6 | * Copyright (C) 2004 IBM Corp. | |
7 | * Copyright (C) 2005 R Sharada (sharada@in.ibm.com) | |
8 | * Copyright (C) 2006 Mohan Kumar M (mohan@in.ibm.com) | |
9 | * Copyright (C) 2016 IBM Corporation | |
10 | * | |
11 | * Based on kexec-tools' kexec-elf-exec.c and kexec-elf-ppc64.c. | |
12 | * Heavily modified for the kernel by | |
13 | * Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>. | |
14 | */ | |
15 | ||
16 | #define pr_fmt(fmt) "kexec_elf: " fmt | |
17 | ||
18 | #include <linux/elf.h> | |
19 | #include <linux/kexec.h> | |
20 | #include <linux/module.h> | |
21 | #include <linux/slab.h> | |
22 | #include <linux/types.h> | |
23 | ||
175fca3b SS |
24 | #define elf_addr_to_cpu elf64_to_cpu |
25 | ||
175fca3b SS |
26 | static inline bool elf_is_elf_file(const struct elfhdr *ehdr) |
27 | { | |
28 | return memcmp(ehdr->e_ident, ELFMAG, SELFMAG) == 0; | |
29 | } | |
30 | ||
31 | static uint64_t elf64_to_cpu(const struct elfhdr *ehdr, uint64_t value) | |
32 | { | |
33 | if (ehdr->e_ident[EI_DATA] == ELFDATA2LSB) | |
34 | value = le64_to_cpu(value); | |
35 | else if (ehdr->e_ident[EI_DATA] == ELFDATA2MSB) | |
36 | value = be64_to_cpu(value); | |
37 | ||
38 | return value; | |
39 | } | |
40 | ||
d34e0ad3 | 41 | static uint32_t elf32_to_cpu(const struct elfhdr *ehdr, uint32_t value) |
175fca3b SS |
42 | { |
43 | if (ehdr->e_ident[EI_DATA] == ELFDATA2LSB) | |
d34e0ad3 | 44 | value = le32_to_cpu(value); |
175fca3b | 45 | else if (ehdr->e_ident[EI_DATA] == ELFDATA2MSB) |
d34e0ad3 | 46 | value = be32_to_cpu(value); |
175fca3b SS |
47 | |
48 | return value; | |
49 | } | |
50 | ||
d34e0ad3 | 51 | static uint16_t elf16_to_cpu(const struct elfhdr *ehdr, uint16_t value) |
175fca3b SS |
52 | { |
53 | if (ehdr->e_ident[EI_DATA] == ELFDATA2LSB) | |
d34e0ad3 | 54 | value = le16_to_cpu(value); |
175fca3b | 55 | else if (ehdr->e_ident[EI_DATA] == ELFDATA2MSB) |
d34e0ad3 | 56 | value = be16_to_cpu(value); |
175fca3b SS |
57 | |
58 | return value; | |
59 | } | |
60 | ||
61 | /** | |
62 | * elf_is_ehdr_sane - check that it is safe to use the ELF header | |
63 | * @buf_len: size of the buffer in which the ELF file is loaded. | |
64 | */ | |
65 | static bool elf_is_ehdr_sane(const struct elfhdr *ehdr, size_t buf_len) | |
66 | { | |
67 | if (ehdr->e_phnum > 0 && ehdr->e_phentsize != sizeof(struct elf_phdr)) { | |
68 | pr_debug("Bad program header size.\n"); | |
69 | return false; | |
70 | } else if (ehdr->e_shnum > 0 && | |
71 | ehdr->e_shentsize != sizeof(struct elf_shdr)) { | |
72 | pr_debug("Bad section header size.\n"); | |
73 | return false; | |
74 | } else if (ehdr->e_ident[EI_VERSION] != EV_CURRENT || | |
75 | ehdr->e_version != EV_CURRENT) { | |
76 | pr_debug("Unknown ELF version.\n"); | |
77 | return false; | |
78 | } | |
79 | ||
80 | if (ehdr->e_phoff > 0 && ehdr->e_phnum > 0) { | |
81 | size_t phdr_size; | |
82 | ||
83 | /* | |
84 | * e_phnum is at most 65535 so calculating the size of the | |
85 | * program header cannot overflow. | |
86 | */ | |
87 | phdr_size = sizeof(struct elf_phdr) * ehdr->e_phnum; | |
88 | ||
89 | /* Sanity check the program header table location. */ | |
90 | if (ehdr->e_phoff + phdr_size < ehdr->e_phoff) { | |
91 | pr_debug("Program headers at invalid location.\n"); | |
92 | return false; | |
93 | } else if (ehdr->e_phoff + phdr_size > buf_len) { | |
94 | pr_debug("Program headers truncated.\n"); | |
95 | return false; | |
96 | } | |
97 | } | |
98 | ||
99 | if (ehdr->e_shoff > 0 && ehdr->e_shnum > 0) { | |
100 | size_t shdr_size; | |
101 | ||
102 | /* | |
103 | * e_shnum is at most 65536 so calculating | |
104 | * the size of the section header cannot overflow. | |
105 | */ | |
106 | shdr_size = sizeof(struct elf_shdr) * ehdr->e_shnum; | |
107 | ||
108 | /* Sanity check the section header table location. */ | |
109 | if (ehdr->e_shoff + shdr_size < ehdr->e_shoff) { | |
110 | pr_debug("Section headers at invalid location.\n"); | |
111 | return false; | |
112 | } else if (ehdr->e_shoff + shdr_size > buf_len) { | |
113 | pr_debug("Section headers truncated.\n"); | |
114 | return false; | |
115 | } | |
116 | } | |
117 | ||
118 | return true; | |
119 | } | |
120 | ||
121 | static int elf_read_ehdr(const char *buf, size_t len, struct elfhdr *ehdr) | |
122 | { | |
123 | struct elfhdr *buf_ehdr; | |
124 | ||
125 | if (len < sizeof(*buf_ehdr)) { | |
126 | pr_debug("Buffer is too small to hold ELF header.\n"); | |
127 | return -ENOEXEC; | |
128 | } | |
129 | ||
130 | memset(ehdr, 0, sizeof(*ehdr)); | |
131 | memcpy(ehdr->e_ident, buf, sizeof(ehdr->e_ident)); | |
132 | if (!elf_is_elf_file(ehdr)) { | |
133 | pr_debug("No ELF header magic.\n"); | |
134 | return -ENOEXEC; | |
135 | } | |
136 | ||
137 | if (ehdr->e_ident[EI_CLASS] != ELF_CLASS) { | |
138 | pr_debug("Not a supported ELF class.\n"); | |
139 | return -ENOEXEC; | |
140 | } else if (ehdr->e_ident[EI_DATA] != ELFDATA2LSB && | |
141 | ehdr->e_ident[EI_DATA] != ELFDATA2MSB) { | |
142 | pr_debug("Not a supported ELF data format.\n"); | |
143 | return -ENOEXEC; | |
144 | } | |
145 | ||
146 | buf_ehdr = (struct elfhdr *) buf; | |
147 | if (elf16_to_cpu(ehdr, buf_ehdr->e_ehsize) != sizeof(*buf_ehdr)) { | |
148 | pr_debug("Bad ELF header size.\n"); | |
149 | return -ENOEXEC; | |
150 | } | |
151 | ||
152 | ehdr->e_type = elf16_to_cpu(ehdr, buf_ehdr->e_type); | |
153 | ehdr->e_machine = elf16_to_cpu(ehdr, buf_ehdr->e_machine); | |
154 | ehdr->e_version = elf32_to_cpu(ehdr, buf_ehdr->e_version); | |
155 | ehdr->e_entry = elf_addr_to_cpu(ehdr, buf_ehdr->e_entry); | |
156 | ehdr->e_phoff = elf_addr_to_cpu(ehdr, buf_ehdr->e_phoff); | |
157 | ehdr->e_shoff = elf_addr_to_cpu(ehdr, buf_ehdr->e_shoff); | |
158 | ehdr->e_flags = elf32_to_cpu(ehdr, buf_ehdr->e_flags); | |
159 | ehdr->e_phentsize = elf16_to_cpu(ehdr, buf_ehdr->e_phentsize); | |
160 | ehdr->e_phnum = elf16_to_cpu(ehdr, buf_ehdr->e_phnum); | |
161 | ehdr->e_shentsize = elf16_to_cpu(ehdr, buf_ehdr->e_shentsize); | |
162 | ehdr->e_shnum = elf16_to_cpu(ehdr, buf_ehdr->e_shnum); | |
163 | ehdr->e_shstrndx = elf16_to_cpu(ehdr, buf_ehdr->e_shstrndx); | |
164 | ||
165 | return elf_is_ehdr_sane(ehdr, len) ? 0 : -ENOEXEC; | |
166 | } | |
167 | ||
168 | /** | |
169 | * elf_is_phdr_sane - check that it is safe to use the program header | |
170 | * @buf_len: size of the buffer in which the ELF file is loaded. | |
171 | */ | |
172 | static bool elf_is_phdr_sane(const struct elf_phdr *phdr, size_t buf_len) | |
173 | { | |
174 | ||
175 | if (phdr->p_offset + phdr->p_filesz < phdr->p_offset) { | |
176 | pr_debug("ELF segment location wraps around.\n"); | |
177 | return false; | |
178 | } else if (phdr->p_offset + phdr->p_filesz > buf_len) { | |
179 | pr_debug("ELF segment not in file.\n"); | |
180 | return false; | |
181 | } else if (phdr->p_paddr + phdr->p_memsz < phdr->p_paddr) { | |
182 | pr_debug("ELF segment address wraps around.\n"); | |
183 | return false; | |
184 | } | |
185 | ||
186 | return true; | |
187 | } | |
188 | ||
189 | static int elf_read_phdr(const char *buf, size_t len, | |
190 | struct kexec_elf_info *elf_info, | |
191 | int idx) | |
192 | { | |
193 | /* Override the const in proghdrs, we are the ones doing the loading. */ | |
194 | struct elf_phdr *phdr = (struct elf_phdr *) &elf_info->proghdrs[idx]; | |
195 | const char *pbuf; | |
196 | struct elf_phdr *buf_phdr; | |
197 | ||
198 | pbuf = buf + elf_info->ehdr->e_phoff + (idx * sizeof(*buf_phdr)); | |
199 | buf_phdr = (struct elf_phdr *) pbuf; | |
200 | ||
201 | phdr->p_type = elf32_to_cpu(elf_info->ehdr, buf_phdr->p_type); | |
202 | phdr->p_offset = elf_addr_to_cpu(elf_info->ehdr, buf_phdr->p_offset); | |
203 | phdr->p_paddr = elf_addr_to_cpu(elf_info->ehdr, buf_phdr->p_paddr); | |
204 | phdr->p_vaddr = elf_addr_to_cpu(elf_info->ehdr, buf_phdr->p_vaddr); | |
205 | phdr->p_flags = elf32_to_cpu(elf_info->ehdr, buf_phdr->p_flags); | |
206 | ||
207 | /* | |
208 | * The following fields have a type equivalent to Elf_Addr | |
209 | * both in 32 bit and 64 bit ELF. | |
210 | */ | |
211 | phdr->p_filesz = elf_addr_to_cpu(elf_info->ehdr, buf_phdr->p_filesz); | |
212 | phdr->p_memsz = elf_addr_to_cpu(elf_info->ehdr, buf_phdr->p_memsz); | |
213 | phdr->p_align = elf_addr_to_cpu(elf_info->ehdr, buf_phdr->p_align); | |
214 | ||
215 | return elf_is_phdr_sane(phdr, len) ? 0 : -ENOEXEC; | |
216 | } | |
217 | ||
218 | /** | |
219 | * elf_read_phdrs - read the program headers from the buffer | |
220 | * | |
221 | * This function assumes that the program header table was checked for sanity. | |
222 | * Use elf_is_ehdr_sane() if it wasn't. | |
223 | */ | |
224 | static int elf_read_phdrs(const char *buf, size_t len, | |
225 | struct kexec_elf_info *elf_info) | |
226 | { | |
227 | size_t phdr_size, i; | |
228 | const struct elfhdr *ehdr = elf_info->ehdr; | |
229 | ||
230 | /* | |
231 | * e_phnum is at most 65535 so calculating the size of the | |
232 | * program header cannot overflow. | |
233 | */ | |
234 | phdr_size = sizeof(struct elf_phdr) * ehdr->e_phnum; | |
235 | ||
236 | elf_info->proghdrs = kzalloc(phdr_size, GFP_KERNEL); | |
237 | if (!elf_info->proghdrs) | |
238 | return -ENOMEM; | |
239 | ||
240 | for (i = 0; i < ehdr->e_phnum; i++) { | |
241 | int ret; | |
242 | ||
243 | ret = elf_read_phdr(buf, len, elf_info, i); | |
244 | if (ret) { | |
245 | kfree(elf_info->proghdrs); | |
246 | elf_info->proghdrs = NULL; | |
247 | return ret; | |
248 | } | |
249 | } | |
250 | ||
251 | return 0; | |
252 | } | |
253 | ||
175fca3b SS |
254 | /** |
255 | * elf_read_from_buffer - read ELF file and sets up ELF header and ELF info | |
256 | * @buf: Buffer to read ELF file from. | |
257 | * @len: Size of @buf. | |
258 | * @ehdr: Pointer to existing struct which will be populated. | |
259 | * @elf_info: Pointer to existing struct which will be populated. | |
260 | * | |
261 | * This function allows reading ELF files with different byte order than | |
262 | * the kernel, byte-swapping the fields as needed. | |
263 | * | |
264 | * Return: | |
265 | * On success returns 0, and the caller should call | |
266 | * kexec_free_elf_info(elf_info) to free the memory allocated for the section | |
267 | * and program headers. | |
268 | */ | |
269 | static int elf_read_from_buffer(const char *buf, size_t len, | |
270 | struct elfhdr *ehdr, | |
271 | struct kexec_elf_info *elf_info) | |
272 | { | |
273 | int ret; | |
274 | ||
275 | ret = elf_read_ehdr(buf, len, ehdr); | |
276 | if (ret) | |
277 | return ret; | |
278 | ||
279 | elf_info->buffer = buf; | |
280 | elf_info->ehdr = ehdr; | |
281 | if (ehdr->e_phoff > 0 && ehdr->e_phnum > 0) { | |
282 | ret = elf_read_phdrs(buf, len, elf_info); | |
283 | if (ret) | |
284 | return ret; | |
285 | } | |
175fca3b SS |
286 | return 0; |
287 | } | |
288 | ||
289 | /** | |
290 | * kexec_free_elf_info - free memory allocated by elf_read_from_buffer | |
291 | */ | |
292 | void kexec_free_elf_info(struct kexec_elf_info *elf_info) | |
293 | { | |
294 | kfree(elf_info->proghdrs); | |
175fca3b SS |
295 | memset(elf_info, 0, sizeof(*elf_info)); |
296 | } | |
297 | /** | |
298 | * kexec_build_elf_info - read ELF executable and check that we can use it | |
299 | */ | |
300 | int kexec_build_elf_info(const char *buf, size_t len, struct elfhdr *ehdr, | |
301 | struct kexec_elf_info *elf_info) | |
302 | { | |
303 | int i; | |
304 | int ret; | |
305 | ||
306 | ret = elf_read_from_buffer(buf, len, ehdr, elf_info); | |
307 | if (ret) | |
308 | return ret; | |
309 | ||
310 | /* Big endian vmlinux has type ET_DYN. */ | |
311 | if (ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) { | |
312 | pr_err("Not an ELF executable.\n"); | |
313 | goto error; | |
314 | } else if (!elf_info->proghdrs) { | |
315 | pr_err("No ELF program header.\n"); | |
316 | goto error; | |
317 | } | |
318 | ||
319 | for (i = 0; i < ehdr->e_phnum; i++) { | |
320 | /* | |
321 | * Kexec does not support loading interpreters. | |
322 | * In addition this check keeps us from attempting | |
323 | * to kexec ordinay executables. | |
324 | */ | |
325 | if (elf_info->proghdrs[i].p_type == PT_INTERP) { | |
326 | pr_err("Requires an ELF interpreter.\n"); | |
327 | goto error; | |
328 | } | |
329 | } | |
330 | ||
331 | return 0; | |
332 | error: | |
333 | kexec_free_elf_info(elf_info); | |
334 | return -ENOEXEC; | |
335 | } | |
336 | ||
337 | ||
338 | int kexec_elf_probe(const char *buf, unsigned long len) | |
339 | { | |
340 | struct elfhdr ehdr; | |
341 | struct kexec_elf_info elf_info; | |
342 | int ret; | |
343 | ||
344 | ret = kexec_build_elf_info(buf, len, &ehdr, &elf_info); | |
345 | if (ret) | |
346 | return ret; | |
347 | ||
348 | kexec_free_elf_info(&elf_info); | |
349 | ||
350 | return elf_check_arch(&ehdr) ? 0 : -ENOEXEC; | |
351 | } | |
352 | ||
353 | /** | |
354 | * kexec_elf_load - load ELF executable image | |
355 | * @lowest_load_addr: On return, will be the address where the first PT_LOAD | |
356 | * section will be loaded in memory. | |
357 | * | |
358 | * Return: | |
359 | * 0 on success, negative value on failure. | |
360 | */ | |
361 | int kexec_elf_load(struct kimage *image, struct elfhdr *ehdr, | |
362 | struct kexec_elf_info *elf_info, | |
363 | struct kexec_buf *kbuf, | |
364 | unsigned long *lowest_load_addr) | |
365 | { | |
366 | unsigned long base = 0, lowest_addr = UINT_MAX; | |
367 | int ret; | |
368 | size_t i; | |
369 | ||
370 | /* Read in the PT_LOAD segments. */ | |
371 | for (i = 0; i < ehdr->e_phnum; i++) { | |
372 | unsigned long load_addr; | |
373 | size_t size; | |
374 | const struct elf_phdr *phdr; | |
375 | ||
376 | phdr = &elf_info->proghdrs[i]; | |
377 | if (phdr->p_type != PT_LOAD) | |
378 | continue; | |
379 | ||
380 | size = phdr->p_filesz; | |
381 | if (size > phdr->p_memsz) | |
382 | size = phdr->p_memsz; | |
383 | ||
384 | kbuf->buffer = (void *) elf_info->buffer + phdr->p_offset; | |
385 | kbuf->bufsz = size; | |
386 | kbuf->memsz = phdr->p_memsz; | |
387 | kbuf->buf_align = phdr->p_align; | |
388 | kbuf->buf_min = phdr->p_paddr + base; | |
389 | kbuf->mem = KEXEC_BUF_MEM_UNKNOWN; | |
390 | ret = kexec_add_buffer(kbuf); | |
391 | if (ret) | |
392 | goto out; | |
393 | load_addr = kbuf->mem; | |
394 | ||
395 | if (load_addr < lowest_addr) | |
396 | lowest_addr = load_addr; | |
397 | } | |
398 | ||
399 | /* Update entry point to reflect new load address. */ | |
400 | ehdr->e_entry += base; | |
401 | ||
402 | *lowest_load_addr = lowest_addr; | |
403 | ret = 0; | |
404 | out: | |
405 | return ret; | |
406 | } |