1 static void glue(bswap_ehdr, SZ)(struct elfhdr *ehdr) 2 { 3 bswap16s(&ehdr->e_type); /* Object file type */ 4 bswap16s(&ehdr->e_machine); /* Architecture */ 5 bswap32s(&ehdr->e_version); /* Object file version */ 6 bswapSZs(&ehdr->e_entry); /* Entry point virtual address */ 7 bswapSZs(&ehdr->e_phoff); /* Program header table file offset */ 8 bswapSZs(&ehdr->e_shoff); /* Section header table file offset */ 9 bswap32s(&ehdr->e_flags); /* Processor-specific flags */ 10 bswap16s(&ehdr->e_ehsize); /* ELF header size in bytes */ 11 bswap16s(&ehdr->e_phentsize); /* Program header table entry size */ 12 bswap16s(&ehdr->e_phnum); /* Program header table entry count */ 13 bswap16s(&ehdr->e_shentsize); /* Section header table entry size */ 14 bswap16s(&ehdr->e_shnum); /* Section header table entry count */ 15 bswap16s(&ehdr->e_shstrndx); /* Section header string table index */ 16 } 17 18 static void glue(bswap_phdr, SZ)(struct elf_phdr *phdr) 19 { 20 bswap32s(&phdr->p_type); /* Segment type */ 21 bswapSZs(&phdr->p_offset); /* Segment file offset */ 22 bswapSZs(&phdr->p_vaddr); /* Segment virtual address */ 23 bswapSZs(&phdr->p_paddr); /* Segment physical address */ 24 bswapSZs(&phdr->p_filesz); /* Segment size in file */ 25 bswapSZs(&phdr->p_memsz); /* Segment size in memory */ 26 bswap32s(&phdr->p_flags); /* Segment flags */ 27 bswapSZs(&phdr->p_align); /* Segment alignment */ 28 } 29 30 static void glue(bswap_shdr, SZ)(struct elf_shdr *shdr) 31 { 32 bswap32s(&shdr->sh_name); 33 bswap32s(&shdr->sh_type); 34 bswapSZs(&shdr->sh_flags); 35 bswapSZs(&shdr->sh_addr); 36 bswapSZs(&shdr->sh_offset); 37 bswapSZs(&shdr->sh_size); 38 bswap32s(&shdr->sh_link); 39 bswap32s(&shdr->sh_info); 40 bswapSZs(&shdr->sh_addralign); 41 bswapSZs(&shdr->sh_entsize); 42 } 43 44 static void glue(bswap_sym, SZ)(struct elf_sym *sym) 45 { 46 bswap32s(&sym->st_name); 47 bswapSZs(&sym->st_value); 48 bswapSZs(&sym->st_size); 49 bswap16s(&sym->st_shndx); 50 } 51 52 static void glue(bswap_rela, SZ)(struct elf_rela *rela) 53 { 54 bswapSZs(&rela->r_offset); 55 bswapSZs(&rela->r_info); 56 bswapSZs((elf_word *)&rela->r_addend); 57 } 58 59 static struct elf_shdr *glue(find_section, SZ)(struct elf_shdr *shdr_table, 60 int n, int type) 61 { 62 int i; 63 for(i=0;i<n;i++) { 64 if (shdr_table[i].sh_type == type) 65 return shdr_table + i; 66 } 67 return NULL; 68 } 69 70 static int glue(symfind, SZ)(const void *s0, const void *s1) 71 { 72 hwaddr addr = *(hwaddr *)s0; 73 struct elf_sym *sym = (struct elf_sym *)s1; 74 int result = 0; 75 if (addr < sym->st_value) { 76 result = -1; 77 } else if (addr >= sym->st_value + sym->st_size) { 78 result = 1; 79 } 80 return result; 81 } 82 83 static const char *glue(lookup_symbol, SZ)(struct syminfo *s, 84 hwaddr orig_addr) 85 { 86 struct elf_sym *syms = glue(s->disas_symtab.elf, SZ); 87 struct elf_sym *sym; 88 89 sym = bsearch(&orig_addr, syms, s->disas_num_syms, sizeof(*syms), 90 glue(symfind, SZ)); 91 if (sym != NULL) { 92 return s->disas_strtab + sym->st_name; 93 } 94 95 return ""; 96 } 97 98 static int glue(symcmp, SZ)(const void *s0, const void *s1) 99 { 100 struct elf_sym *sym0 = (struct elf_sym *)s0; 101 struct elf_sym *sym1 = (struct elf_sym *)s1; 102 return (sym0->st_value < sym1->st_value) 103 ? -1 104 : ((sym0->st_value > sym1->st_value) ? 1 : 0); 105 } 106 107 static int glue(load_symbols, SZ)(struct elfhdr *ehdr, int fd, int must_swab, 108 int clear_lsb, symbol_fn_t sym_cb) 109 { 110 struct elf_shdr *symtab, *strtab, *shdr_table = NULL; 111 struct elf_sym *syms = NULL; 112 struct syminfo *s; 113 int nsyms, i; 114 char *str = NULL; 115 116 shdr_table = load_at(fd, ehdr->e_shoff, 117 sizeof(struct elf_shdr) * ehdr->e_shnum); 118 if (!shdr_table) 119 return -1; 120 121 if (must_swab) { 122 for (i = 0; i < ehdr->e_shnum; i++) { 123 glue(bswap_shdr, SZ)(shdr_table + i); 124 } 125 } 126 127 symtab = glue(find_section, SZ)(shdr_table, ehdr->e_shnum, SHT_SYMTAB); 128 if (!symtab) 129 goto fail; 130 syms = load_at(fd, symtab->sh_offset, symtab->sh_size); 131 if (!syms) 132 goto fail; 133 134 nsyms = symtab->sh_size / sizeof(struct elf_sym); 135 136 /* String table */ 137 if (symtab->sh_link >= ehdr->e_shnum) { 138 goto fail; 139 } 140 strtab = &shdr_table[symtab->sh_link]; 141 142 str = load_at(fd, strtab->sh_offset, strtab->sh_size); 143 if (!str) { 144 goto fail; 145 } 146 147 i = 0; 148 while (i < nsyms) { 149 if (must_swab) { 150 glue(bswap_sym, SZ)(&syms[i]); 151 } 152 if (sym_cb) { 153 sym_cb(str + syms[i].st_name, syms[i].st_info, 154 syms[i].st_value, syms[i].st_size); 155 } 156 /* We are only interested in function symbols. 157 Throw everything else away. */ 158 if (syms[i].st_shndx == SHN_UNDEF || 159 syms[i].st_shndx >= SHN_LORESERVE || 160 ELF_ST_TYPE(syms[i].st_info) != STT_FUNC) { 161 nsyms--; 162 if (i < nsyms) { 163 syms[i] = syms[nsyms]; 164 } 165 continue; 166 } 167 if (clear_lsb) { 168 /* The bottom address bit marks a Thumb or MIPS16 symbol. */ 169 syms[i].st_value &= ~(glue(glue(Elf, SZ), _Addr))1; 170 } 171 i++; 172 } 173 syms = g_realloc(syms, nsyms * sizeof(*syms)); 174 175 qsort(syms, nsyms, sizeof(*syms), glue(symcmp, SZ)); 176 for (i = 0; i < nsyms - 1; i++) { 177 if (syms[i].st_size == 0) { 178 syms[i].st_size = syms[i + 1].st_value - syms[i].st_value; 179 } 180 } 181 182 /* Commit */ 183 s = g_malloc0(sizeof(*s)); 184 s->lookup_symbol = glue(lookup_symbol, SZ); 185 glue(s->disas_symtab.elf, SZ) = syms; 186 s->disas_num_syms = nsyms; 187 s->disas_strtab = str; 188 s->next = syminfos; 189 syminfos = s; 190 g_free(shdr_table); 191 return 0; 192 fail: 193 g_free(syms); 194 g_free(str); 195 g_free(shdr_table); 196 return -1; 197 } 198 199 static int glue(elf_reloc, SZ)(struct elfhdr *ehdr, int fd, int must_swab, 200 uint64_t (*translate_fn)(void *, uint64_t), 201 void *translate_opaque, uint8_t *data, 202 struct elf_phdr *ph, int elf_machine) 203 { 204 struct elf_shdr *reltab, *shdr_table = NULL; 205 struct elf_rela *rels = NULL; 206 int nrels, i, ret = -1; 207 elf_word wordval; 208 void *addr; 209 210 shdr_table = load_at(fd, ehdr->e_shoff, 211 sizeof(struct elf_shdr) * ehdr->e_shnum); 212 if (!shdr_table) { 213 return -1; 214 } 215 if (must_swab) { 216 for (i = 0; i < ehdr->e_shnum; i++) { 217 glue(bswap_shdr, SZ)(&shdr_table[i]); 218 } 219 } 220 221 reltab = glue(find_section, SZ)(shdr_table, ehdr->e_shnum, SHT_RELA); 222 if (!reltab) { 223 goto fail; 224 } 225 rels = load_at(fd, reltab->sh_offset, reltab->sh_size); 226 if (!rels) { 227 goto fail; 228 } 229 nrels = reltab->sh_size / sizeof(struct elf_rela); 230 231 for (i = 0; i < nrels; i++) { 232 if (must_swab) { 233 glue(bswap_rela, SZ)(&rels[i]); 234 } 235 if (rels[i].r_offset < ph->p_vaddr || 236 rels[i].r_offset >= ph->p_vaddr + ph->p_filesz) { 237 continue; 238 } 239 addr = &data[rels[i].r_offset - ph->p_vaddr]; 240 switch (elf_machine) { 241 case EM_S390: 242 switch (rels[i].r_info) { 243 case R_390_RELATIVE: 244 wordval = *(elf_word *)addr; 245 if (must_swab) { 246 bswapSZs(&wordval); 247 } 248 wordval = translate_fn(translate_opaque, wordval); 249 if (must_swab) { 250 bswapSZs(&wordval); 251 } 252 *(elf_word *)addr = wordval; 253 break; 254 default: 255 fprintf(stderr, "Unsupported relocation type %i!\n", 256 (int)rels[i].r_info); 257 } 258 } 259 } 260 261 ret = 0; 262 fail: 263 g_free(rels); 264 g_free(shdr_table); 265 return ret; 266 } 267 268 /* 269 * Given 'nhdr', a pointer to a range of ELF Notes, search through them 270 * for a note matching type 'elf_note_type' and return a pointer to 271 * the matching ELF note. 272 */ 273 static struct elf_note *glue(get_elf_note_type, SZ)(struct elf_note *nhdr, 274 elf_word note_size, 275 elf_word phdr_align, 276 elf_word elf_note_type) 277 { 278 elf_word nhdr_size = sizeof(struct elf_note); 279 elf_word elf_note_entry_offset = 0; 280 elf_word note_type; 281 elf_word nhdr_namesz; 282 elf_word nhdr_descsz; 283 284 if (nhdr == NULL) { 285 return NULL; 286 } 287 288 note_type = nhdr->n_type; 289 while (note_type != elf_note_type) { 290 nhdr_namesz = nhdr->n_namesz; 291 nhdr_descsz = nhdr->n_descsz; 292 293 elf_note_entry_offset = nhdr_size + 294 QEMU_ALIGN_UP(nhdr_namesz, phdr_align) + 295 QEMU_ALIGN_UP(nhdr_descsz, phdr_align); 296 297 /* 298 * If the offset calculated in this iteration exceeds the 299 * supplied size, we are done and no matching note was found. 300 */ 301 if (elf_note_entry_offset > note_size) { 302 return NULL; 303 } 304 305 /* skip to the next ELF Note entry */ 306 nhdr = (void *)nhdr + elf_note_entry_offset; 307 note_type = nhdr->n_type; 308 } 309 310 return nhdr; 311 } 312 313 static int glue(load_elf, SZ)(const char *name, int fd, 314 uint64_t (*elf_note_fn)(void *, void *, bool), 315 uint64_t (*translate_fn)(void *, uint64_t), 316 void *translate_opaque, 317 int must_swab, uint64_t *pentry, 318 uint64_t *lowaddr, uint64_t *highaddr, 319 uint32_t *pflags, int elf_machine, 320 int clear_lsb, int data_swab, 321 AddressSpace *as, bool load_rom, 322 symbol_fn_t sym_cb) 323 { 324 struct elfhdr ehdr; 325 struct elf_phdr *phdr = NULL, *ph; 326 int size, i, total_size; 327 elf_word mem_size, file_size, data_offset; 328 uint64_t addr, low = (uint64_t)-1, high = 0; 329 GMappedFile *mapped_file = NULL; 330 uint8_t *data = NULL; 331 char label[128]; 332 int ret = ELF_LOAD_FAILED; 333 334 if (read(fd, &ehdr, sizeof(ehdr)) != sizeof(ehdr)) 335 goto fail; 336 if (must_swab) { 337 glue(bswap_ehdr, SZ)(&ehdr); 338 } 339 340 if (elf_machine <= EM_NONE) { 341 /* The caller didn't specify an ARCH, we can figure it out */ 342 elf_machine = ehdr.e_machine; 343 } 344 345 switch (elf_machine) { 346 case EM_PPC64: 347 if (ehdr.e_machine != EM_PPC64) { 348 if (ehdr.e_machine != EM_PPC) { 349 ret = ELF_LOAD_WRONG_ARCH; 350 goto fail; 351 } 352 } 353 break; 354 case EM_X86_64: 355 if (ehdr.e_machine != EM_X86_64) { 356 if (ehdr.e_machine != EM_386) { 357 ret = ELF_LOAD_WRONG_ARCH; 358 goto fail; 359 } 360 } 361 break; 362 case EM_MICROBLAZE: 363 if (ehdr.e_machine != EM_MICROBLAZE) { 364 if (ehdr.e_machine != EM_MICROBLAZE_OLD) { 365 ret = ELF_LOAD_WRONG_ARCH; 366 goto fail; 367 } 368 } 369 break; 370 case EM_MOXIE: 371 if (ehdr.e_machine != EM_MOXIE) { 372 if (ehdr.e_machine != EM_MOXIE_OLD) { 373 ret = ELF_LOAD_WRONG_ARCH; 374 goto fail; 375 } 376 } 377 break; 378 case EM_MIPS: 379 case EM_NANOMIPS: 380 if ((ehdr.e_machine != EM_MIPS) && 381 (ehdr.e_machine != EM_NANOMIPS)) { 382 ret = ELF_LOAD_WRONG_ARCH; 383 goto fail; 384 } 385 break; 386 default: 387 if (elf_machine != ehdr.e_machine) { 388 ret = ELF_LOAD_WRONG_ARCH; 389 goto fail; 390 } 391 } 392 393 if (pflags) { 394 *pflags = (elf_word)ehdr.e_flags; 395 } 396 if (pentry) 397 *pentry = (uint64_t)(elf_sword)ehdr.e_entry; 398 399 glue(load_symbols, SZ)(&ehdr, fd, must_swab, clear_lsb, sym_cb); 400 401 size = ehdr.e_phnum * sizeof(phdr[0]); 402 if (lseek(fd, ehdr.e_phoff, SEEK_SET) != ehdr.e_phoff) { 403 goto fail; 404 } 405 phdr = g_malloc0(size); 406 if (!phdr) 407 goto fail; 408 if (read(fd, phdr, size) != size) 409 goto fail; 410 if (must_swab) { 411 for(i = 0; i < ehdr.e_phnum; i++) { 412 ph = &phdr[i]; 413 glue(bswap_phdr, SZ)(ph); 414 } 415 } 416 417 /* 418 * Since we want to be able to modify the mapped buffer, we set the 419 * 'writeble' parameter to 'true'. Modifications to the buffer are not 420 * written back to the file. 421 */ 422 mapped_file = g_mapped_file_new_from_fd(fd, true, NULL); 423 if (!mapped_file) { 424 goto fail; 425 } 426 427 total_size = 0; 428 for(i = 0; i < ehdr.e_phnum; i++) { 429 ph = &phdr[i]; 430 if (ph->p_type == PT_LOAD) { 431 mem_size = ph->p_memsz; /* Size of the ROM */ 432 file_size = ph->p_filesz; /* Size of the allocated data */ 433 data_offset = ph->p_offset; /* Offset where the data is located */ 434 435 if (file_size > 0) { 436 if (g_mapped_file_get_length(mapped_file) < 437 file_size + data_offset) { 438 goto fail; 439 } 440 441 data = (uint8_t *)g_mapped_file_get_contents(mapped_file); 442 data += data_offset; 443 } 444 445 /* The ELF spec is somewhat vague about the purpose of the 446 * physical address field. One common use in the embedded world 447 * is that physical address field specifies the load address 448 * and the virtual address field specifies the execution address. 449 * Segments are packed into ROM or flash, and the relocation 450 * and zero-initialization of data is done at runtime. This 451 * means that the memsz header represents the runtime size of the 452 * segment, but the filesz represents the loadtime size. If 453 * we try to honour the memsz value for an ELF file like this 454 * we will end up with overlapping segments (which the 455 * loader.c code will later reject). 456 * We support ELF files using this scheme by by checking whether 457 * paddr + memsz for this segment would overlap with any other 458 * segment. If so, then we assume it's using this scheme and 459 * truncate the loaded segment to the filesz size. 460 * If the segment considered as being memsz size doesn't overlap 461 * then we use memsz for the segment length, to handle ELF files 462 * which assume that the loader will do the zero-initialization. 463 */ 464 if (mem_size > file_size) { 465 /* If this segment's zero-init portion overlaps another 466 * segment's data or zero-init portion, then truncate this one. 467 * Invalid ELF files where the segments overlap even when 468 * only file_size bytes are loaded will be rejected by 469 * the ROM overlap check in loader.c, so we don't try to 470 * explicitly detect those here. 471 */ 472 int j; 473 elf_word zero_start = ph->p_paddr + file_size; 474 elf_word zero_end = ph->p_paddr + mem_size; 475 476 for (j = 0; j < ehdr.e_phnum; j++) { 477 struct elf_phdr *jph = &phdr[j]; 478 479 if (i != j && jph->p_type == PT_LOAD) { 480 elf_word other_start = jph->p_paddr; 481 elf_word other_end = jph->p_paddr + jph->p_memsz; 482 483 if (!(other_start >= zero_end || 484 zero_start >= other_end)) { 485 mem_size = file_size; 486 break; 487 } 488 } 489 } 490 } 491 492 if (mem_size > INT_MAX - total_size) { 493 ret = ELF_LOAD_TOO_BIG; 494 goto fail; 495 } 496 497 /* address_offset is hack for kernel images that are 498 linked at the wrong physical address. */ 499 if (translate_fn) { 500 addr = translate_fn(translate_opaque, ph->p_paddr); 501 glue(elf_reloc, SZ)(&ehdr, fd, must_swab, translate_fn, 502 translate_opaque, data, ph, elf_machine); 503 } else { 504 addr = ph->p_paddr; 505 } 506 507 if (data_swab) { 508 int j; 509 for (j = 0; j < file_size; j += (1 << data_swab)) { 510 uint8_t *dp = data + j; 511 switch (data_swab) { 512 case (1): 513 *(uint16_t *)dp = bswap16(*(uint16_t *)dp); 514 break; 515 case (2): 516 *(uint32_t *)dp = bswap32(*(uint32_t *)dp); 517 break; 518 case (3): 519 *(uint64_t *)dp = bswap64(*(uint64_t *)dp); 520 break; 521 default: 522 g_assert_not_reached(); 523 } 524 } 525 } 526 527 /* the entry pointer in the ELF header is a virtual 528 * address, if the text segments paddr and vaddr differ 529 * we need to adjust the entry */ 530 if (pentry && !translate_fn && 531 ph->p_vaddr != ph->p_paddr && 532 ehdr.e_entry >= ph->p_vaddr && 533 ehdr.e_entry < ph->p_vaddr + ph->p_filesz && 534 ph->p_flags & PF_X) { 535 *pentry = ehdr.e_entry - ph->p_vaddr + ph->p_paddr; 536 } 537 538 /* Some ELF files really do have segments of zero size; 539 * just ignore them rather than trying to create empty 540 * ROM blobs, because the zero-length blob can falsely 541 * trigger the overlapping-ROM-blobs check. 542 */ 543 if (mem_size != 0) { 544 if (load_rom) { 545 snprintf(label, sizeof(label), "phdr #%d: %s", i, name); 546 547 /* 548 * rom_add_elf_program() takes its own reference to 549 * 'mapped_file'. 550 */ 551 rom_add_elf_program(label, mapped_file, data, file_size, 552 mem_size, addr, as); 553 } else { 554 address_space_write(as ? as : &address_space_memory, 555 addr, MEMTXATTRS_UNSPECIFIED, 556 data, file_size); 557 } 558 } 559 560 total_size += mem_size; 561 if (addr < low) 562 low = addr; 563 if ((addr + mem_size) > high) 564 high = addr + mem_size; 565 566 data = NULL; 567 568 } else if (ph->p_type == PT_NOTE && elf_note_fn) { 569 struct elf_note *nhdr = NULL; 570 571 file_size = ph->p_filesz; /* Size of the range of ELF notes */ 572 data_offset = ph->p_offset; /* Offset where the notes are located */ 573 574 if (file_size > 0) { 575 if (g_mapped_file_get_length(mapped_file) < 576 file_size + data_offset) { 577 goto fail; 578 } 579 580 data = (uint8_t *)g_mapped_file_get_contents(mapped_file); 581 data += data_offset; 582 } 583 584 /* 585 * Search the ELF notes to find one with a type matching the 586 * value passed in via 'translate_opaque' 587 */ 588 nhdr = (struct elf_note *)data; 589 assert(translate_opaque != NULL); 590 nhdr = glue(get_elf_note_type, SZ)(nhdr, file_size, ph->p_align, 591 *(uint64_t *)translate_opaque); 592 if (nhdr != NULL) { 593 bool is64 = 594 sizeof(struct elf_note) == sizeof(struct elf64_note); 595 elf_note_fn((void *)nhdr, (void *)&ph->p_align, is64); 596 } 597 data = NULL; 598 } 599 } 600 601 if (lowaddr) 602 *lowaddr = (uint64_t)(elf_sword)low; 603 if (highaddr) 604 *highaddr = (uint64_t)(elf_sword)high; 605 ret = total_size; 606 fail: 607 g_mapped_file_unref(mapped_file); 608 g_free(phdr); 609 return ret; 610 } 611