1 | // SPDX-License-Identifier: GPL-2.0-only |
2 | /* |
3 | * Load ELF vmlinux file for the kexec_file_load syscall. |
4 | * |
5 | * Copyright (C) 2004 Adam Litke (agl@us.ibm.com) |
6 | * Copyright (C) 2004 IBM Corp. |
7 | * Copyright (C) 2005 R Sharada (sharada@in.ibm.com) |
8 | * Copyright (C) 2006 Mohan Kumar M (mohan@in.ibm.com) |
9 | * Copyright (C) 2016 IBM Corporation |
10 | * |
11 | * Based on kexec-tools' kexec-elf-exec.c and kexec-elf-ppc64.c. |
12 | * Heavily modified for the kernel by |
13 | * Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>. |
14 | */ |
15 | |
16 | #define pr_fmt(fmt) "kexec_elf: " fmt |
17 | |
18 | #include <linux/elf.h> |
19 | #include <linux/kexec.h> |
20 | #include <linux/module.h> |
21 | #include <linux/slab.h> |
22 | #include <linux/types.h> |
23 | |
24 | static inline bool elf_is_elf_file(const struct elfhdr *ehdr) |
25 | { |
26 | return memcmp(p: ehdr->e_ident, ELFMAG, SELFMAG) == 0; |
27 | } |
28 | |
29 | static uint64_t elf64_to_cpu(const struct elfhdr *ehdr, uint64_t value) |
30 | { |
31 | if (ehdr->e_ident[EI_DATA] == ELFDATA2LSB) |
32 | value = le64_to_cpu(value); |
33 | else if (ehdr->e_ident[EI_DATA] == ELFDATA2MSB) |
34 | value = be64_to_cpu(value); |
35 | |
36 | return value; |
37 | } |
38 | |
39 | static uint32_t elf32_to_cpu(const struct elfhdr *ehdr, uint32_t value) |
40 | { |
41 | if (ehdr->e_ident[EI_DATA] == ELFDATA2LSB) |
42 | value = le32_to_cpu(value); |
43 | else if (ehdr->e_ident[EI_DATA] == ELFDATA2MSB) |
44 | value = be32_to_cpu(value); |
45 | |
46 | return value; |
47 | } |
48 | |
49 | static uint16_t elf16_to_cpu(const struct elfhdr *ehdr, uint16_t value) |
50 | { |
51 | if (ehdr->e_ident[EI_DATA] == ELFDATA2LSB) |
52 | value = le16_to_cpu(value); |
53 | else if (ehdr->e_ident[EI_DATA] == ELFDATA2MSB) |
54 | value = be16_to_cpu(value); |
55 | |
56 | return value; |
57 | } |
58 | |
59 | /** |
60 | * elf_is_ehdr_sane - check that it is safe to use the ELF header |
61 | * @buf_len: size of the buffer in which the ELF file is loaded. |
62 | */ |
63 | static bool elf_is_ehdr_sane(const struct elfhdr *ehdr, size_t buf_len) |
64 | { |
65 | if (ehdr->e_phnum > 0 && ehdr->e_phentsize != sizeof(struct elf_phdr)) { |
66 | pr_debug("Bad program header size.\n" ); |
67 | return false; |
68 | } else if (ehdr->e_shnum > 0 && |
69 | ehdr->e_shentsize != sizeof(struct elf_shdr)) { |
70 | pr_debug("Bad section header size.\n" ); |
71 | return false; |
72 | } else if (ehdr->e_ident[EI_VERSION] != EV_CURRENT || |
73 | ehdr->e_version != EV_CURRENT) { |
74 | pr_debug("Unknown ELF version.\n" ); |
75 | return false; |
76 | } |
77 | |
78 | if (ehdr->e_phoff > 0 && ehdr->e_phnum > 0) { |
79 | size_t phdr_size; |
80 | |
81 | /* |
82 | * e_phnum is at most 65535 so calculating the size of the |
83 | * program header cannot overflow. |
84 | */ |
85 | phdr_size = sizeof(struct elf_phdr) * ehdr->e_phnum; |
86 | |
87 | /* Sanity check the program header table location. */ |
88 | if (ehdr->e_phoff + phdr_size < ehdr->e_phoff) { |
89 | pr_debug("Program headers at invalid location.\n" ); |
90 | return false; |
91 | } else if (ehdr->e_phoff + phdr_size > buf_len) { |
92 | pr_debug("Program headers truncated.\n" ); |
93 | return false; |
94 | } |
95 | } |
96 | |
97 | if (ehdr->e_shoff > 0 && ehdr->e_shnum > 0) { |
98 | size_t shdr_size; |
99 | |
100 | /* |
101 | * e_shnum is at most 65536 so calculating |
102 | * the size of the section header cannot overflow. |
103 | */ |
104 | shdr_size = sizeof(struct elf_shdr) * ehdr->e_shnum; |
105 | |
106 | /* Sanity check the section header table location. */ |
107 | if (ehdr->e_shoff + shdr_size < ehdr->e_shoff) { |
108 | pr_debug("Section headers at invalid location.\n" ); |
109 | return false; |
110 | } else if (ehdr->e_shoff + shdr_size > buf_len) { |
111 | pr_debug("Section headers truncated.\n" ); |
112 | return false; |
113 | } |
114 | } |
115 | |
116 | return true; |
117 | } |
118 | |
119 | static int elf_read_ehdr(const char *buf, size_t len, struct elfhdr *ehdr) |
120 | { |
121 | struct elfhdr *buf_ehdr; |
122 | |
123 | if (len < sizeof(*buf_ehdr)) { |
124 | pr_debug("Buffer is too small to hold ELF header.\n" ); |
125 | return -ENOEXEC; |
126 | } |
127 | |
128 | memset(ehdr, 0, sizeof(*ehdr)); |
129 | memcpy(ehdr->e_ident, buf, sizeof(ehdr->e_ident)); |
130 | if (!elf_is_elf_file(ehdr)) { |
131 | pr_debug("No ELF header magic.\n" ); |
132 | return -ENOEXEC; |
133 | } |
134 | |
135 | if (ehdr->e_ident[EI_CLASS] != ELF_CLASS) { |
136 | pr_debug("Not a supported ELF class.\n" ); |
137 | return -ENOEXEC; |
138 | } else if (ehdr->e_ident[EI_DATA] != ELFDATA2LSB && |
139 | ehdr->e_ident[EI_DATA] != ELFDATA2MSB) { |
140 | pr_debug("Not a supported ELF data format.\n" ); |
141 | return -ENOEXEC; |
142 | } |
143 | |
144 | buf_ehdr = (struct elfhdr *) buf; |
145 | if (elf16_to_cpu(ehdr, value: buf_ehdr->e_ehsize) != sizeof(*buf_ehdr)) { |
146 | pr_debug("Bad ELF header size.\n" ); |
147 | return -ENOEXEC; |
148 | } |
149 | |
150 | ehdr->e_type = elf16_to_cpu(ehdr, value: buf_ehdr->e_type); |
151 | ehdr->e_machine = elf16_to_cpu(ehdr, value: buf_ehdr->e_machine); |
152 | ehdr->e_version = elf32_to_cpu(ehdr, value: buf_ehdr->e_version); |
153 | ehdr->e_flags = elf32_to_cpu(ehdr, value: buf_ehdr->e_flags); |
154 | ehdr->e_phentsize = elf16_to_cpu(ehdr, value: buf_ehdr->e_phentsize); |
155 | ehdr->e_phnum = elf16_to_cpu(ehdr, value: buf_ehdr->e_phnum); |
156 | ehdr->e_shentsize = elf16_to_cpu(ehdr, value: buf_ehdr->e_shentsize); |
157 | ehdr->e_shnum = elf16_to_cpu(ehdr, value: buf_ehdr->e_shnum); |
158 | ehdr->e_shstrndx = elf16_to_cpu(ehdr, value: buf_ehdr->e_shstrndx); |
159 | |
160 | switch (ehdr->e_ident[EI_CLASS]) { |
161 | case ELFCLASS64: |
162 | ehdr->e_entry = elf64_to_cpu(ehdr, value: buf_ehdr->e_entry); |
163 | ehdr->e_phoff = elf64_to_cpu(ehdr, value: buf_ehdr->e_phoff); |
164 | ehdr->e_shoff = elf64_to_cpu(ehdr, value: buf_ehdr->e_shoff); |
165 | break; |
166 | |
167 | case ELFCLASS32: |
168 | ehdr->e_entry = elf32_to_cpu(ehdr, value: buf_ehdr->e_entry); |
169 | ehdr->e_phoff = elf32_to_cpu(ehdr, value: buf_ehdr->e_phoff); |
170 | ehdr->e_shoff = elf32_to_cpu(ehdr, value: buf_ehdr->e_shoff); |
171 | break; |
172 | |
173 | default: |
174 | pr_debug("Unknown ELF class.\n" ); |
175 | return -EINVAL; |
176 | } |
177 | |
178 | return elf_is_ehdr_sane(ehdr, buf_len: len) ? 0 : -ENOEXEC; |
179 | } |
180 | |
181 | /** |
182 | * elf_is_phdr_sane - check that it is safe to use the program header |
183 | * @buf_len: size of the buffer in which the ELF file is loaded. |
184 | */ |
185 | static bool elf_is_phdr_sane(const struct elf_phdr *phdr, size_t buf_len) |
186 | { |
187 | |
188 | if (phdr->p_offset + phdr->p_filesz < phdr->p_offset) { |
189 | pr_debug("ELF segment location wraps around.\n" ); |
190 | return false; |
191 | } else if (phdr->p_offset + phdr->p_filesz > buf_len) { |
192 | pr_debug("ELF segment not in file.\n" ); |
193 | return false; |
194 | } else if (phdr->p_paddr + phdr->p_memsz < phdr->p_paddr) { |
195 | pr_debug("ELF segment address wraps around.\n" ); |
196 | return false; |
197 | } |
198 | |
199 | return true; |
200 | } |
201 | |
202 | static int elf_read_phdr(const char *buf, size_t len, |
203 | struct kexec_elf_info *elf_info, |
204 | int idx) |
205 | { |
206 | /* Override the const in proghdrs, we are the ones doing the loading. */ |
207 | struct elf_phdr *phdr = (struct elf_phdr *) &elf_info->proghdrs[idx]; |
208 | const struct elfhdr *ehdr = elf_info->ehdr; |
209 | const char *pbuf; |
210 | struct elf_phdr *buf_phdr; |
211 | |
212 | pbuf = buf + elf_info->ehdr->e_phoff + (idx * sizeof(*buf_phdr)); |
213 | buf_phdr = (struct elf_phdr *) pbuf; |
214 | |
215 | phdr->p_type = elf32_to_cpu(ehdr: elf_info->ehdr, value: buf_phdr->p_type); |
216 | phdr->p_flags = elf32_to_cpu(ehdr: elf_info->ehdr, value: buf_phdr->p_flags); |
217 | |
218 | switch (ehdr->e_ident[EI_CLASS]) { |
219 | case ELFCLASS64: |
220 | phdr->p_offset = elf64_to_cpu(ehdr, value: buf_phdr->p_offset); |
221 | phdr->p_paddr = elf64_to_cpu(ehdr, value: buf_phdr->p_paddr); |
222 | phdr->p_vaddr = elf64_to_cpu(ehdr, value: buf_phdr->p_vaddr); |
223 | phdr->p_filesz = elf64_to_cpu(ehdr, value: buf_phdr->p_filesz); |
224 | phdr->p_memsz = elf64_to_cpu(ehdr, value: buf_phdr->p_memsz); |
225 | phdr->p_align = elf64_to_cpu(ehdr, value: buf_phdr->p_align); |
226 | break; |
227 | |
228 | case ELFCLASS32: |
229 | phdr->p_offset = elf32_to_cpu(ehdr, value: buf_phdr->p_offset); |
230 | phdr->p_paddr = elf32_to_cpu(ehdr, value: buf_phdr->p_paddr); |
231 | phdr->p_vaddr = elf32_to_cpu(ehdr, value: buf_phdr->p_vaddr); |
232 | phdr->p_filesz = elf32_to_cpu(ehdr, value: buf_phdr->p_filesz); |
233 | phdr->p_memsz = elf32_to_cpu(ehdr, value: buf_phdr->p_memsz); |
234 | phdr->p_align = elf32_to_cpu(ehdr, value: buf_phdr->p_align); |
235 | break; |
236 | |
237 | default: |
238 | pr_debug("Unknown ELF class.\n" ); |
239 | return -EINVAL; |
240 | } |
241 | |
242 | return elf_is_phdr_sane(phdr, buf_len: len) ? 0 : -ENOEXEC; |
243 | } |
244 | |
245 | /** |
246 | * elf_read_phdrs - read the program headers from the buffer |
247 | * |
248 | * This function assumes that the program header table was checked for sanity. |
249 | * Use elf_is_ehdr_sane() if it wasn't. |
250 | */ |
251 | static int elf_read_phdrs(const char *buf, size_t len, |
252 | struct kexec_elf_info *elf_info) |
253 | { |
254 | size_t phdr_size, i; |
255 | const struct elfhdr *ehdr = elf_info->ehdr; |
256 | |
257 | /* |
258 | * e_phnum is at most 65535 so calculating the size of the |
259 | * program header cannot overflow. |
260 | */ |
261 | phdr_size = sizeof(struct elf_phdr) * ehdr->e_phnum; |
262 | |
263 | elf_info->proghdrs = kzalloc(size: phdr_size, GFP_KERNEL); |
264 | if (!elf_info->proghdrs) |
265 | return -ENOMEM; |
266 | |
267 | for (i = 0; i < ehdr->e_phnum; i++) { |
268 | int ret; |
269 | |
270 | ret = elf_read_phdr(buf, len, elf_info, idx: i); |
271 | if (ret) { |
272 | kfree(objp: elf_info->proghdrs); |
273 | elf_info->proghdrs = NULL; |
274 | return ret; |
275 | } |
276 | } |
277 | |
278 | return 0; |
279 | } |
280 | |
281 | /** |
282 | * elf_read_from_buffer - read ELF file and sets up ELF header and ELF info |
283 | * @buf: Buffer to read ELF file from. |
284 | * @len: Size of @buf. |
285 | * @ehdr: Pointer to existing struct which will be populated. |
286 | * @elf_info: Pointer to existing struct which will be populated. |
287 | * |
288 | * This function allows reading ELF files with different byte order than |
289 | * the kernel, byte-swapping the fields as needed. |
290 | * |
291 | * Return: |
292 | * On success returns 0, and the caller should call |
293 | * kexec_free_elf_info(elf_info) to free the memory allocated for the section |
294 | * and program headers. |
295 | */ |
296 | static int elf_read_from_buffer(const char *buf, size_t len, |
297 | struct elfhdr *ehdr, |
298 | struct kexec_elf_info *elf_info) |
299 | { |
300 | int ret; |
301 | |
302 | ret = elf_read_ehdr(buf, len, ehdr); |
303 | if (ret) |
304 | return ret; |
305 | |
306 | elf_info->buffer = buf; |
307 | elf_info->ehdr = ehdr; |
308 | if (ehdr->e_phoff > 0 && ehdr->e_phnum > 0) { |
309 | ret = elf_read_phdrs(buf, len, elf_info); |
310 | if (ret) |
311 | return ret; |
312 | } |
313 | return 0; |
314 | } |
315 | |
316 | /** |
317 | * kexec_free_elf_info - free memory allocated by elf_read_from_buffer |
318 | */ |
319 | void kexec_free_elf_info(struct kexec_elf_info *elf_info) |
320 | { |
321 | kfree(objp: elf_info->proghdrs); |
322 | memset(elf_info, 0, sizeof(*elf_info)); |
323 | } |
324 | /** |
325 | * kexec_build_elf_info - read ELF executable and check that we can use it |
326 | */ |
327 | int kexec_build_elf_info(const char *buf, size_t len, struct elfhdr *ehdr, |
328 | struct kexec_elf_info *elf_info) |
329 | { |
330 | int i; |
331 | int ret; |
332 | |
333 | ret = elf_read_from_buffer(buf, len, ehdr, elf_info); |
334 | if (ret) |
335 | return ret; |
336 | |
337 | /* Big endian vmlinux has type ET_DYN. */ |
338 | if (ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) { |
339 | pr_err("Not an ELF executable.\n" ); |
340 | goto error; |
341 | } else if (!elf_info->proghdrs) { |
342 | pr_err("No ELF program header.\n" ); |
343 | goto error; |
344 | } |
345 | |
346 | for (i = 0; i < ehdr->e_phnum; i++) { |
347 | /* |
348 | * Kexec does not support loading interpreters. |
349 | * In addition this check keeps us from attempting |
350 | * to kexec ordinay executables. |
351 | */ |
352 | if (elf_info->proghdrs[i].p_type == PT_INTERP) { |
353 | pr_err("Requires an ELF interpreter.\n" ); |
354 | goto error; |
355 | } |
356 | } |
357 | |
358 | return 0; |
359 | error: |
360 | kexec_free_elf_info(elf_info); |
361 | return -ENOEXEC; |
362 | } |
363 | |
364 | |
365 | int kexec_elf_probe(const char *buf, unsigned long len) |
366 | { |
367 | struct elfhdr ehdr; |
368 | struct kexec_elf_info elf_info; |
369 | int ret; |
370 | |
371 | ret = kexec_build_elf_info(buf, len, ehdr: &ehdr, elf_info: &elf_info); |
372 | if (ret) |
373 | return ret; |
374 | |
375 | kexec_free_elf_info(elf_info: &elf_info); |
376 | |
377 | return elf_check_arch(&ehdr) ? 0 : -ENOEXEC; |
378 | } |
379 | |
380 | /** |
381 | * kexec_elf_load - load ELF executable image |
382 | * @lowest_load_addr: On return, will be the address where the first PT_LOAD |
383 | * section will be loaded in memory. |
384 | * |
385 | * Return: |
386 | * 0 on success, negative value on failure. |
387 | */ |
388 | int kexec_elf_load(struct kimage *image, struct elfhdr *ehdr, |
389 | struct kexec_elf_info *elf_info, |
390 | struct kexec_buf *kbuf, |
391 | unsigned long *lowest_load_addr) |
392 | { |
393 | unsigned long lowest_addr = UINT_MAX; |
394 | int ret; |
395 | size_t i; |
396 | |
397 | /* Read in the PT_LOAD segments. */ |
398 | for (i = 0; i < ehdr->e_phnum; i++) { |
399 | unsigned long load_addr; |
400 | size_t size; |
401 | const struct elf_phdr *phdr; |
402 | |
403 | phdr = &elf_info->proghdrs[i]; |
404 | if (phdr->p_type != PT_LOAD) |
405 | continue; |
406 | |
407 | size = phdr->p_filesz; |
408 | if (size > phdr->p_memsz) |
409 | size = phdr->p_memsz; |
410 | |
411 | kbuf->buffer = (void *) elf_info->buffer + phdr->p_offset; |
412 | kbuf->bufsz = size; |
413 | kbuf->memsz = phdr->p_memsz; |
414 | kbuf->buf_align = phdr->p_align; |
415 | kbuf->buf_min = phdr->p_paddr; |
416 | kbuf->mem = KEXEC_BUF_MEM_UNKNOWN; |
417 | ret = kexec_add_buffer(kbuf); |
418 | if (ret) |
419 | goto out; |
420 | load_addr = kbuf->mem; |
421 | |
422 | if (load_addr < lowest_addr) |
423 | lowest_addr = load_addr; |
424 | } |
425 | |
426 | *lowest_load_addr = lowest_addr; |
427 | ret = 0; |
428 | out: |
429 | return ret; |
430 | } |
431 | |