kexec_elf.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Load ELF vmlinux file for the kexec_file_load syscall.
  4. *
  5. * Copyright (C) 2004 Adam Litke (agl@us.ibm.com)
  6. * Copyright (C) 2004 IBM Corp.
  7. * Copyright (C) 2005 R Sharada (sharada@in.ibm.com)
  8. * Copyright (C) 2006 Mohan Kumar M (mohan@in.ibm.com)
  9. * Copyright (C) 2016 IBM Corporation
  10. *
  11. * Based on kexec-tools' kexec-elf-exec.c and kexec-elf-ppc64.c.
  12. * Heavily modified for the kernel by
  13. * Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>.
  14. */
  15. #define pr_fmt(fmt) "kexec_elf: " fmt
  16. #include <linux/elf.h>
  17. #include <linux/kexec.h>
  18. #include <linux/module.h>
  19. #include <linux/slab.h>
  20. #include <linux/types.h>
  21. static inline bool elf_is_elf_file(const struct elfhdr *ehdr)
  22. {
  23. return memcmp(ehdr->e_ident, ELFMAG, SELFMAG) == 0;
  24. }
  25. static uint64_t elf64_to_cpu(const struct elfhdr *ehdr, uint64_t value)
  26. {
  27. if (ehdr->e_ident[EI_DATA] == ELFDATA2LSB)
  28. value = le64_to_cpu(value);
  29. else if (ehdr->e_ident[EI_DATA] == ELFDATA2MSB)
  30. value = be64_to_cpu(value);
  31. return value;
  32. }
  33. static uint32_t elf32_to_cpu(const struct elfhdr *ehdr, uint32_t value)
  34. {
  35. if (ehdr->e_ident[EI_DATA] == ELFDATA2LSB)
  36. value = le32_to_cpu(value);
  37. else if (ehdr->e_ident[EI_DATA] == ELFDATA2MSB)
  38. value = be32_to_cpu(value);
  39. return value;
  40. }
  41. static uint16_t elf16_to_cpu(const struct elfhdr *ehdr, uint16_t value)
  42. {
  43. if (ehdr->e_ident[EI_DATA] == ELFDATA2LSB)
  44. value = le16_to_cpu(value);
  45. else if (ehdr->e_ident[EI_DATA] == ELFDATA2MSB)
  46. value = be16_to_cpu(value);
  47. return value;
  48. }
  49. /**
  50. * elf_is_ehdr_sane - check that it is safe to use the ELF header
  51. * @buf_len: size of the buffer in which the ELF file is loaded.
  52. */
  53. static bool elf_is_ehdr_sane(const struct elfhdr *ehdr, size_t buf_len)
  54. {
  55. if (ehdr->e_phnum > 0 && ehdr->e_phentsize != sizeof(struct elf_phdr)) {
  56. pr_debug("Bad program header size.\n");
  57. return false;
  58. } else if (ehdr->e_shnum > 0 &&
  59. ehdr->e_shentsize != sizeof(struct elf_shdr)) {
  60. pr_debug("Bad section header size.\n");
  61. return false;
  62. } else if (ehdr->e_ident[EI_VERSION] != EV_CURRENT ||
  63. ehdr->e_version != EV_CURRENT) {
  64. pr_debug("Unknown ELF version.\n");
  65. return false;
  66. }
  67. if (ehdr->e_phoff > 0 && ehdr->e_phnum > 0) {
  68. size_t phdr_size;
  69. /*
  70. * e_phnum is at most 65535 so calculating the size of the
  71. * program header cannot overflow.
  72. */
  73. phdr_size = sizeof(struct elf_phdr) * ehdr->e_phnum;
  74. /* Sanity check the program header table location. */
  75. if (ehdr->e_phoff + phdr_size < ehdr->e_phoff) {
  76. pr_debug("Program headers at invalid location.\n");
  77. return false;
  78. } else if (ehdr->e_phoff + phdr_size > buf_len) {
  79. pr_debug("Program headers truncated.\n");
  80. return false;
  81. }
  82. }
  83. if (ehdr->e_shoff > 0 && ehdr->e_shnum > 0) {
  84. size_t shdr_size;
  85. /*
  86. * e_shnum is at most 65536 so calculating
  87. * the size of the section header cannot overflow.
  88. */
  89. shdr_size = sizeof(struct elf_shdr) * ehdr->e_shnum;
  90. /* Sanity check the section header table location. */
  91. if (ehdr->e_shoff + shdr_size < ehdr->e_shoff) {
  92. pr_debug("Section headers at invalid location.\n");
  93. return false;
  94. } else if (ehdr->e_shoff + shdr_size > buf_len) {
  95. pr_debug("Section headers truncated.\n");
  96. return false;
  97. }
  98. }
  99. return true;
  100. }
  101. static int elf_read_ehdr(const char *buf, size_t len, struct elfhdr *ehdr)
  102. {
  103. struct elfhdr *buf_ehdr;
  104. if (len < sizeof(*buf_ehdr)) {
  105. pr_debug("Buffer is too small to hold ELF header.\n");
  106. return -ENOEXEC;
  107. }
  108. memset(ehdr, 0, sizeof(*ehdr));
  109. memcpy(ehdr->e_ident, buf, sizeof(ehdr->e_ident));
  110. if (!elf_is_elf_file(ehdr)) {
  111. pr_debug("No ELF header magic.\n");
  112. return -ENOEXEC;
  113. }
  114. if (ehdr->e_ident[EI_CLASS] != ELF_CLASS) {
  115. pr_debug("Not a supported ELF class.\n");
  116. return -ENOEXEC;
  117. } else if (ehdr->e_ident[EI_DATA] != ELFDATA2LSB &&
  118. ehdr->e_ident[EI_DATA] != ELFDATA2MSB) {
  119. pr_debug("Not a supported ELF data format.\n");
  120. return -ENOEXEC;
  121. }
  122. buf_ehdr = (struct elfhdr *) buf;
  123. if (elf16_to_cpu(ehdr, buf_ehdr->e_ehsize) != sizeof(*buf_ehdr)) {
  124. pr_debug("Bad ELF header size.\n");
  125. return -ENOEXEC;
  126. }
  127. ehdr->e_type = elf16_to_cpu(ehdr, buf_ehdr->e_type);
  128. ehdr->e_machine = elf16_to_cpu(ehdr, buf_ehdr->e_machine);
  129. ehdr->e_version = elf32_to_cpu(ehdr, buf_ehdr->e_version);
  130. ehdr->e_flags = elf32_to_cpu(ehdr, buf_ehdr->e_flags);
  131. ehdr->e_phentsize = elf16_to_cpu(ehdr, buf_ehdr->e_phentsize);
  132. ehdr->e_phnum = elf16_to_cpu(ehdr, buf_ehdr->e_phnum);
  133. ehdr->e_shentsize = elf16_to_cpu(ehdr, buf_ehdr->e_shentsize);
  134. ehdr->e_shnum = elf16_to_cpu(ehdr, buf_ehdr->e_shnum);
  135. ehdr->e_shstrndx = elf16_to_cpu(ehdr, buf_ehdr->e_shstrndx);
  136. switch (ehdr->e_ident[EI_CLASS]) {
  137. case ELFCLASS64:
  138. ehdr->e_entry = elf64_to_cpu(ehdr, buf_ehdr->e_entry);
  139. ehdr->e_phoff = elf64_to_cpu(ehdr, buf_ehdr->e_phoff);
  140. ehdr->e_shoff = elf64_to_cpu(ehdr, buf_ehdr->e_shoff);
  141. break;
  142. case ELFCLASS32:
  143. ehdr->e_entry = elf32_to_cpu(ehdr, buf_ehdr->e_entry);
  144. ehdr->e_phoff = elf32_to_cpu(ehdr, buf_ehdr->e_phoff);
  145. ehdr->e_shoff = elf32_to_cpu(ehdr, buf_ehdr->e_shoff);
  146. break;
  147. default:
  148. pr_debug("Unknown ELF class.\n");
  149. return -EINVAL;
  150. }
  151. return elf_is_ehdr_sane(ehdr, len) ? 0 : -ENOEXEC;
  152. }
  153. /**
  154. * elf_is_phdr_sane - check that it is safe to use the program header
  155. * @buf_len: size of the buffer in which the ELF file is loaded.
  156. */
  157. static bool elf_is_phdr_sane(const struct elf_phdr *phdr, size_t buf_len)
  158. {
  159. if (phdr->p_offset + phdr->p_filesz < phdr->p_offset) {
  160. pr_debug("ELF segment location wraps around.\n");
  161. return false;
  162. } else if (phdr->p_offset + phdr->p_filesz > buf_len) {
  163. pr_debug("ELF segment not in file.\n");
  164. return false;
  165. } else if (phdr->p_paddr + phdr->p_memsz < phdr->p_paddr) {
  166. pr_debug("ELF segment address wraps around.\n");
  167. return false;
  168. }
  169. return true;
  170. }
  171. static int elf_read_phdr(const char *buf, size_t len,
  172. struct kexec_elf_info *elf_info,
  173. int idx)
  174. {
  175. /* Override the const in proghdrs, we are the ones doing the loading. */
  176. struct elf_phdr *phdr = (struct elf_phdr *) &elf_info->proghdrs[idx];
  177. const struct elfhdr *ehdr = elf_info->ehdr;
  178. const char *pbuf;
  179. struct elf_phdr *buf_phdr;
  180. pbuf = buf + elf_info->ehdr->e_phoff + (idx * sizeof(*buf_phdr));
  181. buf_phdr = (struct elf_phdr *) pbuf;
  182. phdr->p_type = elf32_to_cpu(elf_info->ehdr, buf_phdr->p_type);
  183. phdr->p_flags = elf32_to_cpu(elf_info->ehdr, buf_phdr->p_flags);
  184. switch (ehdr->e_ident[EI_CLASS]) {
  185. case ELFCLASS64:
  186. phdr->p_offset = elf64_to_cpu(ehdr, buf_phdr->p_offset);
  187. phdr->p_paddr = elf64_to_cpu(ehdr, buf_phdr->p_paddr);
  188. phdr->p_vaddr = elf64_to_cpu(ehdr, buf_phdr->p_vaddr);
  189. phdr->p_filesz = elf64_to_cpu(ehdr, buf_phdr->p_filesz);
  190. phdr->p_memsz = elf64_to_cpu(ehdr, buf_phdr->p_memsz);
  191. phdr->p_align = elf64_to_cpu(ehdr, buf_phdr->p_align);
  192. break;
  193. case ELFCLASS32:
  194. phdr->p_offset = elf32_to_cpu(ehdr, buf_phdr->p_offset);
  195. phdr->p_paddr = elf32_to_cpu(ehdr, buf_phdr->p_paddr);
  196. phdr->p_vaddr = elf32_to_cpu(ehdr, buf_phdr->p_vaddr);
  197. phdr->p_filesz = elf32_to_cpu(ehdr, buf_phdr->p_filesz);
  198. phdr->p_memsz = elf32_to_cpu(ehdr, buf_phdr->p_memsz);
  199. phdr->p_align = elf32_to_cpu(ehdr, buf_phdr->p_align);
  200. break;
  201. default:
  202. pr_debug("Unknown ELF class.\n");
  203. return -EINVAL;
  204. }
  205. return elf_is_phdr_sane(phdr, len) ? 0 : -ENOEXEC;
  206. }
  207. /**
  208. * elf_read_phdrs - read the program headers from the buffer
  209. *
  210. * This function assumes that the program header table was checked for sanity.
  211. * Use elf_is_ehdr_sane() if it wasn't.
  212. */
  213. static int elf_read_phdrs(const char *buf, size_t len,
  214. struct kexec_elf_info *elf_info)
  215. {
  216. size_t phdr_size, i;
  217. const struct elfhdr *ehdr = elf_info->ehdr;
  218. /*
  219. * e_phnum is at most 65535 so calculating the size of the
  220. * program header cannot overflow.
  221. */
  222. phdr_size = sizeof(struct elf_phdr) * ehdr->e_phnum;
  223. elf_info->proghdrs = kzalloc(phdr_size, GFP_KERNEL);
  224. if (!elf_info->proghdrs)
  225. return -ENOMEM;
  226. for (i = 0; i < ehdr->e_phnum; i++) {
  227. int ret;
  228. ret = elf_read_phdr(buf, len, elf_info, i);
  229. if (ret) {
  230. kfree(elf_info->proghdrs);
  231. elf_info->proghdrs = NULL;
  232. return ret;
  233. }
  234. }
  235. return 0;
  236. }
  237. /**
  238. * elf_read_from_buffer - read ELF file and sets up ELF header and ELF info
  239. * @buf: Buffer to read ELF file from.
  240. * @len: Size of @buf.
  241. * @ehdr: Pointer to existing struct which will be populated.
  242. * @elf_info: Pointer to existing struct which will be populated.
  243. *
  244. * This function allows reading ELF files with different byte order than
  245. * the kernel, byte-swapping the fields as needed.
  246. *
  247. * Return:
  248. * On success returns 0, and the caller should call
  249. * kexec_free_elf_info(elf_info) to free the memory allocated for the section
  250. * and program headers.
  251. */
  252. static int elf_read_from_buffer(const char *buf, size_t len,
  253. struct elfhdr *ehdr,
  254. struct kexec_elf_info *elf_info)
  255. {
  256. int ret;
  257. ret = elf_read_ehdr(buf, len, ehdr);
  258. if (ret)
  259. return ret;
  260. elf_info->buffer = buf;
  261. elf_info->ehdr = ehdr;
  262. if (ehdr->e_phoff > 0 && ehdr->e_phnum > 0) {
  263. ret = elf_read_phdrs(buf, len, elf_info);
  264. if (ret)
  265. return ret;
  266. }
  267. return 0;
  268. }
  269. /**
  270. * kexec_free_elf_info - free memory allocated by elf_read_from_buffer
  271. */
  272. void kexec_free_elf_info(struct kexec_elf_info *elf_info)
  273. {
  274. kfree(elf_info->proghdrs);
  275. memset(elf_info, 0, sizeof(*elf_info));
  276. }
  277. /**
  278. * kexec_build_elf_info - read ELF executable and check that we can use it
  279. */
  280. int kexec_build_elf_info(const char *buf, size_t len, struct elfhdr *ehdr,
  281. struct kexec_elf_info *elf_info)
  282. {
  283. int i;
  284. int ret;
  285. ret = elf_read_from_buffer(buf, len, ehdr, elf_info);
  286. if (ret)
  287. return ret;
  288. /* Big endian vmlinux has type ET_DYN. */
  289. if (ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) {
  290. pr_err("Not an ELF executable.\n");
  291. goto error;
  292. } else if (!elf_info->proghdrs) {
  293. pr_err("No ELF program header.\n");
  294. goto error;
  295. }
  296. for (i = 0; i < ehdr->e_phnum; i++) {
  297. /*
  298. * Kexec does not support loading interpreters.
  299. * In addition this check keeps us from attempting
  300. * to kexec ordinay executables.
  301. */
  302. if (elf_info->proghdrs[i].p_type == PT_INTERP) {
  303. pr_err("Requires an ELF interpreter.\n");
  304. goto error;
  305. }
  306. }
  307. return 0;
  308. error:
  309. kexec_free_elf_info(elf_info);
  310. return -ENOEXEC;
  311. }
  312. int kexec_elf_probe(const char *buf, unsigned long len)
  313. {
  314. struct elfhdr ehdr;
  315. struct kexec_elf_info elf_info;
  316. int ret;
  317. ret = kexec_build_elf_info(buf, len, &ehdr, &elf_info);
  318. if (ret)
  319. return ret;
  320. kexec_free_elf_info(&elf_info);
  321. return elf_check_arch(&ehdr) ? 0 : -ENOEXEC;
  322. }
  323. /**
  324. * kexec_elf_load - load ELF executable image
  325. * @lowest_load_addr: On return, will be the address where the first PT_LOAD
  326. * section will be loaded in memory.
  327. *
  328. * Return:
  329. * 0 on success, negative value on failure.
  330. */
  331. int kexec_elf_load(struct kimage *image, struct elfhdr *ehdr,
  332. struct kexec_elf_info *elf_info,
  333. struct kexec_buf *kbuf,
  334. unsigned long *lowest_load_addr)
  335. {
  336. unsigned long lowest_addr = UINT_MAX;
  337. int ret;
  338. size_t i;
  339. /* Read in the PT_LOAD segments. */
  340. for (i = 0; i < ehdr->e_phnum; i++) {
  341. unsigned long load_addr;
  342. size_t size;
  343. const struct elf_phdr *phdr;
  344. phdr = &elf_info->proghdrs[i];
  345. if (phdr->p_type != PT_LOAD)
  346. continue;
  347. size = phdr->p_filesz;
  348. if (size > phdr->p_memsz)
  349. size = phdr->p_memsz;
  350. kbuf->buffer = (void *) elf_info->buffer + phdr->p_offset;
  351. kbuf->bufsz = size;
  352. kbuf->memsz = phdr->p_memsz;
  353. kbuf->buf_align = phdr->p_align;
  354. kbuf->buf_min = phdr->p_paddr;
  355. kbuf->mem = KEXEC_BUF_MEM_UNKNOWN;
  356. ret = kexec_add_buffer(kbuf);
  357. if (ret)
  358. goto out;
  359. load_addr = kbuf->mem;
  360. if (load_addr < lowest_addr)
  361. lowest_addr = load_addr;
  362. }
  363. *lowest_load_addr = lowest_addr;
  364. ret = 0;
  365. out:
  366. return ret;
  367. }