1 static void glue(bswap_ehdr, SZ)(struct elfhdr *ehdr) 2 { 3 bswap16s(&ehdr->e_type); /* Object file type */ 4 bswap16s(&ehdr->e_machine); /* Architecture */ 5 bswap32s(&ehdr->e_version); /* Object file version */ 6 bswapSZs(&ehdr->e_entry); /* Entry point virtual address */ 7 bswapSZs(&ehdr->e_phoff); /* Program header table file offset */ 8 bswapSZs(&ehdr->e_shoff); /* Section header table file offset */ 9 bswap32s(&ehdr->e_flags); /* Processor-specific flags */ 10 bswap16s(&ehdr->e_ehsize); /* ELF header size in bytes */ 11 bswap16s(&ehdr->e_phentsize); /* Program header table entry size */ 12 bswap16s(&ehdr->e_phnum); /* Program header table entry count */ 13 bswap16s(&ehdr->e_shentsize); /* Section header table entry size */ 14 bswap16s(&ehdr->e_shnum); /* Section header table entry count */ 15 bswap16s(&ehdr->e_shstrndx); /* Section header string table index */ 16 } 17 18 static void glue(bswap_phdr, SZ)(struct elf_phdr *phdr) 19 { 20 bswap32s(&phdr->p_type); /* Segment type */ 21 bswapSZs(&phdr->p_offset); /* Segment file offset */ 22 bswapSZs(&phdr->p_vaddr); /* Segment virtual address */ 23 bswapSZs(&phdr->p_paddr); /* Segment physical address */ 24 bswapSZs(&phdr->p_filesz); /* Segment size in file */ 25 bswapSZs(&phdr->p_memsz); /* Segment size in memory */ 26 bswap32s(&phdr->p_flags); /* Segment flags */ 27 bswapSZs(&phdr->p_align); /* Segment alignment */ 28 } 29 30 static void glue(bswap_shdr, SZ)(struct elf_shdr *shdr) 31 { 32 bswap32s(&shdr->sh_name); 33 bswap32s(&shdr->sh_type); 34 bswapSZs(&shdr->sh_flags); 35 bswapSZs(&shdr->sh_addr); 36 bswapSZs(&shdr->sh_offset); 37 bswapSZs(&shdr->sh_size); 38 bswap32s(&shdr->sh_link); 39 bswap32s(&shdr->sh_info); 40 bswapSZs(&shdr->sh_addralign); 41 bswapSZs(&shdr->sh_entsize); 42 } 43 44 static void glue(bswap_sym, SZ)(struct elf_sym *sym) 45 { 46 bswap32s(&sym->st_name); 47 bswapSZs(&sym->st_value); 48 bswapSZs(&sym->st_size); 49 bswap16s(&sym->st_shndx); 50 } 51 52 static void glue(bswap_rela, SZ)(struct elf_rela *rela) 53 { 54 bswapSZs(&rela->r_offset); 55 bswapSZs(&rela->r_info); 56 bswapSZs((elf_word *)&rela->r_addend); 57 } 58 59 static struct elf_shdr *glue(find_section, SZ)(struct elf_shdr *shdr_table, 60 int n, int type) 61 { 62 int i; 63 for(i=0;i<n;i++) { 64 if (shdr_table[i].sh_type == type) 65 return shdr_table + i; 66 } 67 return NULL; 68 } 69 70 static int glue(symfind, SZ)(const void *s0, const void *s1) 71 { 72 hwaddr addr = *(hwaddr *)s0; 73 struct elf_sym *sym = (struct elf_sym *)s1; 74 int result = 0; 75 if (addr < sym->st_value) { 76 result = -1; 77 } else if (addr >= sym->st_value + sym->st_size) { 78 result = 1; 79 } 80 return result; 81 } 82 83 static const char *glue(lookup_symbol, SZ)(struct syminfo *s, 84 hwaddr orig_addr) 85 { 86 struct elf_sym *syms = glue(s->disas_symtab.elf, SZ); 87 struct elf_sym *sym; 88 89 sym = bsearch(&orig_addr, syms, s->disas_num_syms, sizeof(*syms), 90 glue(symfind, SZ)); 91 if (sym != NULL) { 92 return s->disas_strtab + sym->st_name; 93 } 94 95 return ""; 96 } 97 98 static int glue(symcmp, SZ)(const void *s0, const void *s1) 99 { 100 struct elf_sym *sym0 = (struct elf_sym *)s0; 101 struct elf_sym *sym1 = (struct elf_sym *)s1; 102 return (sym0->st_value < sym1->st_value) 103 ? -1 104 : ((sym0->st_value > sym1->st_value) ? 1 : 0); 105 } 106 107 static void glue(load_symbols, SZ)(struct elfhdr *ehdr, int fd, int must_swab, 108 int clear_lsb, symbol_fn_t sym_cb) 109 { 110 struct elf_shdr *symtab, *strtab; 111 g_autofree struct elf_shdr *shdr_table = NULL; 112 g_autofree struct elf_sym *syms = NULL; 113 g_autofree char *str = NULL; 114 struct syminfo *s; 115 int nsyms, i; 116 117 shdr_table = load_at(fd, ehdr->e_shoff, 118 sizeof(struct elf_shdr) * ehdr->e_shnum); 119 if (!shdr_table) { 120 return; 121 } 122 123 if (must_swab) { 124 for (i = 0; i < ehdr->e_shnum; i++) { 125 glue(bswap_shdr, SZ)(shdr_table + i); 126 } 127 } 128 129 symtab = glue(find_section, SZ)(shdr_table, ehdr->e_shnum, SHT_SYMTAB); 130 if (!symtab) { 131 return; 132 } 133 syms = load_at(fd, symtab->sh_offset, symtab->sh_size); 134 if (!syms) { 135 return; 136 } 137 138 nsyms = symtab->sh_size / sizeof(struct elf_sym); 139 140 /* String table */ 141 if (symtab->sh_link >= ehdr->e_shnum) { 142 return; 143 } 144 strtab = &shdr_table[symtab->sh_link]; 145 146 str = load_at(fd, strtab->sh_offset, strtab->sh_size); 147 if (!str) { 148 return; 149 } 150 151 i = 0; 152 while (i < nsyms) { 153 if (must_swab) { 154 glue(bswap_sym, SZ)(&syms[i]); 155 } 156 if (sym_cb) { 157 sym_cb(str + syms[i].st_name, syms[i].st_info, 158 syms[i].st_value, syms[i].st_size); 159 } 160 /* We are only interested in function symbols. 161 Throw everything else away. */ 162 if (syms[i].st_shndx == SHN_UNDEF || 163 syms[i].st_shndx >= SHN_LORESERVE || 164 ELF_ST_TYPE(syms[i].st_info) != STT_FUNC) { 165 nsyms--; 166 if (i < nsyms) { 167 syms[i] = syms[nsyms]; 168 } 169 continue; 170 } 171 if (clear_lsb) { 172 /* The bottom address bit marks a Thumb or MIPS16 symbol. */ 173 syms[i].st_value &= ~(glue(glue(Elf, SZ), _Addr))1; 174 } 175 i++; 176 } 177 178 /* check we have symbols left */ 179 if (nsyms == 0) { 180 return; 181 } 182 183 syms = g_realloc(syms, nsyms * sizeof(*syms)); 184 qsort(syms, nsyms, sizeof(*syms), glue(symcmp, SZ)); 185 for (i = 0; i < nsyms - 1; i++) { 186 if (syms[i].st_size == 0) { 187 syms[i].st_size = syms[i + 1].st_value - syms[i].st_value; 188 } 189 } 190 191 /* Commit */ 192 s = g_malloc0(sizeof(*s)); 193 s->lookup_symbol = glue(lookup_symbol, SZ); 194 glue(s->disas_symtab.elf, SZ) = g_steal_pointer(&syms); 195 s->disas_num_syms = nsyms; 196 s->disas_strtab = g_steal_pointer(&str); 197 s->next = syminfos; 198 syminfos = s; 199 } 200 201 static int glue(elf_reloc, SZ)(struct elfhdr *ehdr, int fd, int must_swab, 202 uint64_t (*translate_fn)(void *, uint64_t), 203 void *translate_opaque, uint8_t *data, 204 struct elf_phdr *ph, int elf_machine) 205 { 206 struct elf_shdr *reltab, *shdr_table = NULL; 207 struct elf_rela *rels = NULL; 208 int nrels, i, ret = -1; 209 elf_word wordval; 210 void *addr; 211 212 shdr_table = load_at(fd, ehdr->e_shoff, 213 sizeof(struct elf_shdr) * ehdr->e_shnum); 214 if (!shdr_table) { 215 return -1; 216 } 217 if (must_swab) { 218 for (i = 0; i < ehdr->e_shnum; i++) { 219 glue(bswap_shdr, SZ)(&shdr_table[i]); 220 } 221 } 222 223 reltab = glue(find_section, SZ)(shdr_table, ehdr->e_shnum, SHT_RELA); 224 if (!reltab) { 225 goto fail; 226 } 227 rels = load_at(fd, reltab->sh_offset, reltab->sh_size); 228 if (!rels) { 229 goto fail; 230 } 231 nrels = reltab->sh_size / sizeof(struct elf_rela); 232 233 for (i = 0; i < nrels; i++) { 234 if (must_swab) { 235 glue(bswap_rela, SZ)(&rels[i]); 236 } 237 if (rels[i].r_offset < ph->p_vaddr || 238 rels[i].r_offset >= ph->p_vaddr + ph->p_filesz) { 239 continue; 240 } 241 addr = &data[rels[i].r_offset - ph->p_vaddr]; 242 switch (elf_machine) { 243 case EM_S390: 244 switch (rels[i].r_info) { 245 case R_390_RELATIVE: 246 wordval = *(elf_word *)addr; 247 if (must_swab) { 248 bswapSZs(&wordval); 249 } 250 wordval = translate_fn(translate_opaque, wordval); 251 if (must_swab) { 252 bswapSZs(&wordval); 253 } 254 *(elf_word *)addr = wordval; 255 break; 256 default: 257 fprintf(stderr, "Unsupported relocation type %i!\n", 258 (int)rels[i].r_info); 259 } 260 } 261 } 262 263 ret = 0; 264 fail: 265 g_free(rels); 266 g_free(shdr_table); 267 return ret; 268 } 269 270 /* 271 * Given 'nhdr', a pointer to a range of ELF Notes, search through them 272 * for a note matching type 'elf_note_type' and return a pointer to 273 * the matching ELF note. 274 */ 275 static struct elf_note *glue(get_elf_note_type, SZ)(struct elf_note *nhdr, 276 elf_word note_size, 277 elf_word phdr_align, 278 elf_word elf_note_type) 279 { 280 elf_word nhdr_size = sizeof(struct elf_note); 281 elf_word elf_note_entry_offset = 0; 282 elf_word note_type; 283 elf_word nhdr_namesz; 284 elf_word nhdr_descsz; 285 286 if (nhdr == NULL) { 287 return NULL; 288 } 289 290 note_type = nhdr->n_type; 291 while (note_type != elf_note_type) { 292 nhdr_namesz = nhdr->n_namesz; 293 nhdr_descsz = nhdr->n_descsz; 294 295 elf_note_entry_offset = nhdr_size + 296 QEMU_ALIGN_UP(nhdr_namesz, phdr_align) + 297 QEMU_ALIGN_UP(nhdr_descsz, phdr_align); 298 299 /* 300 * If the offset calculated in this iteration exceeds the 301 * supplied size, we are done and no matching note was found. 302 */ 303 if (elf_note_entry_offset > note_size) { 304 return NULL; 305 } 306 307 /* skip to the next ELF Note entry */ 308 nhdr = (void *)nhdr + elf_note_entry_offset; 309 note_type = nhdr->n_type; 310 } 311 312 return nhdr; 313 } 314 315 static ssize_t glue(load_elf, SZ)(const char *name, int fd, 316 uint64_t (*elf_note_fn)(void *, void *, bool), 317 uint64_t (*translate_fn)(void *, uint64_t), 318 void *translate_opaque, 319 int must_swab, uint64_t *pentry, 320 uint64_t *lowaddr, uint64_t *highaddr, 321 uint32_t *pflags, int elf_machine, 322 int clear_lsb, int data_swab, 323 AddressSpace *as, bool load_rom, 324 symbol_fn_t sym_cb) 325 { 326 struct elfhdr ehdr; 327 struct elf_phdr *phdr = NULL, *ph; 328 int size, i; 329 ssize_t total_size; 330 elf_word mem_size, file_size, data_offset; 331 uint64_t addr, low = (uint64_t)-1, high = 0; 332 GMappedFile *mapped_file = NULL; 333 uint8_t *data = NULL; 334 ssize_t ret = ELF_LOAD_FAILED; 335 336 if (read(fd, &ehdr, sizeof(ehdr)) != sizeof(ehdr)) 337 goto fail; 338 if (must_swab) { 339 glue(bswap_ehdr, SZ)(&ehdr); 340 } 341 342 if (elf_machine <= EM_NONE) { 343 /* The caller didn't specify an ARCH, we can figure it out */ 344 elf_machine = ehdr.e_machine; 345 } 346 347 switch (elf_machine) { 348 case EM_PPC64: 349 if (ehdr.e_machine != EM_PPC64) { 350 if (ehdr.e_machine != EM_PPC) { 351 ret = ELF_LOAD_WRONG_ARCH; 352 goto fail; 353 } 354 } 355 break; 356 case EM_X86_64: 357 if (ehdr.e_machine != EM_X86_64) { 358 if (ehdr.e_machine != EM_386) { 359 ret = ELF_LOAD_WRONG_ARCH; 360 goto fail; 361 } 362 } 363 break; 364 case EM_MICROBLAZE: 365 if (ehdr.e_machine != EM_MICROBLAZE) { 366 if (ehdr.e_machine != EM_MICROBLAZE_OLD) { 367 ret = ELF_LOAD_WRONG_ARCH; 368 goto fail; 369 } 370 } 371 break; 372 case EM_MIPS: 373 case EM_NANOMIPS: 374 if ((ehdr.e_machine != EM_MIPS) && 375 (ehdr.e_machine != EM_NANOMIPS)) { 376 ret = ELF_LOAD_WRONG_ARCH; 377 goto fail; 378 } 379 break; 380 default: 381 if (elf_machine != ehdr.e_machine) { 382 ret = ELF_LOAD_WRONG_ARCH; 383 goto fail; 384 } 385 } 386 387 if (pflags) { 388 *pflags = (elf_word)ehdr.e_flags; 389 } 390 if (pentry) 391 *pentry = (uint64_t)(elf_sword)ehdr.e_entry; 392 393 glue(load_symbols, SZ)(&ehdr, fd, must_swab, clear_lsb, sym_cb); 394 395 size = ehdr.e_phnum * sizeof(phdr[0]); 396 if (lseek(fd, ehdr.e_phoff, SEEK_SET) != ehdr.e_phoff) { 397 goto fail; 398 } 399 phdr = g_malloc0(size); 400 if (!phdr) 401 goto fail; 402 if (read(fd, phdr, size) != size) 403 goto fail; 404 if (must_swab) { 405 for(i = 0; i < ehdr.e_phnum; i++) { 406 ph = &phdr[i]; 407 glue(bswap_phdr, SZ)(ph); 408 } 409 } 410 411 /* 412 * Since we want to be able to modify the mapped buffer, we set the 413 * 'writable' parameter to 'true'. Modifications to the buffer are not 414 * written back to the file. 415 */ 416 mapped_file = g_mapped_file_new_from_fd(fd, true, NULL); 417 if (!mapped_file) { 418 goto fail; 419 } 420 421 total_size = 0; 422 for(i = 0; i < ehdr.e_phnum; i++) { 423 ph = &phdr[i]; 424 if (ph->p_type == PT_LOAD) { 425 mem_size = ph->p_memsz; /* Size of the ROM */ 426 file_size = ph->p_filesz; /* Size of the allocated data */ 427 data_offset = ph->p_offset; /* Offset where the data is located */ 428 429 if (file_size > 0) { 430 if (g_mapped_file_get_length(mapped_file) < 431 file_size + data_offset) { 432 goto fail; 433 } 434 435 data = (uint8_t *)g_mapped_file_get_contents(mapped_file); 436 data += data_offset; 437 } 438 439 /* The ELF spec is somewhat vague about the purpose of the 440 * physical address field. One common use in the embedded world 441 * is that physical address field specifies the load address 442 * and the virtual address field specifies the execution address. 443 * Segments are packed into ROM or flash, and the relocation 444 * and zero-initialization of data is done at runtime. This 445 * means that the memsz header represents the runtime size of the 446 * segment, but the filesz represents the loadtime size. If 447 * we try to honour the memsz value for an ELF file like this 448 * we will end up with overlapping segments (which the 449 * loader.c code will later reject). 450 * We support ELF files using this scheme by by checking whether 451 * paddr + memsz for this segment would overlap with any other 452 * segment. If so, then we assume it's using this scheme and 453 * truncate the loaded segment to the filesz size. 454 * If the segment considered as being memsz size doesn't overlap 455 * then we use memsz for the segment length, to handle ELF files 456 * which assume that the loader will do the zero-initialization. 457 */ 458 if (mem_size > file_size) { 459 /* If this segment's zero-init portion overlaps another 460 * segment's data or zero-init portion, then truncate this one. 461 * Invalid ELF files where the segments overlap even when 462 * only file_size bytes are loaded will be rejected by 463 * the ROM overlap check in loader.c, so we don't try to 464 * explicitly detect those here. 465 */ 466 int j; 467 elf_word zero_start = ph->p_paddr + file_size; 468 elf_word zero_end = ph->p_paddr + mem_size; 469 470 for (j = 0; j < ehdr.e_phnum; j++) { 471 struct elf_phdr *jph = &phdr[j]; 472 473 if (i != j && jph->p_type == PT_LOAD) { 474 elf_word other_start = jph->p_paddr; 475 elf_word other_end = jph->p_paddr + jph->p_memsz; 476 477 if (!(other_start >= zero_end || 478 zero_start >= other_end)) { 479 mem_size = file_size; 480 break; 481 } 482 } 483 } 484 } 485 486 if (mem_size > SSIZE_MAX - total_size) { 487 ret = ELF_LOAD_TOO_BIG; 488 goto fail; 489 } 490 491 /* address_offset is hack for kernel images that are 492 linked at the wrong physical address. */ 493 if (translate_fn) { 494 addr = translate_fn(translate_opaque, ph->p_paddr); 495 glue(elf_reloc, SZ)(&ehdr, fd, must_swab, translate_fn, 496 translate_opaque, data, ph, elf_machine); 497 } else { 498 addr = ph->p_paddr; 499 } 500 501 if (data_swab) { 502 int j; 503 for (j = 0; j < file_size; j += (1 << data_swab)) { 504 uint8_t *dp = data + j; 505 switch (data_swab) { 506 case (1): 507 *(uint16_t *)dp = bswap16(*(uint16_t *)dp); 508 break; 509 case (2): 510 *(uint32_t *)dp = bswap32(*(uint32_t *)dp); 511 break; 512 case (3): 513 *(uint64_t *)dp = bswap64(*(uint64_t *)dp); 514 break; 515 default: 516 g_assert_not_reached(); 517 } 518 } 519 } 520 521 /* the entry pointer in the ELF header is a virtual 522 * address, if the text segments paddr and vaddr differ 523 * we need to adjust the entry */ 524 if (pentry && !translate_fn && 525 ph->p_vaddr != ph->p_paddr && 526 ehdr.e_entry >= ph->p_vaddr && 527 ehdr.e_entry < ph->p_vaddr + ph->p_filesz && 528 ph->p_flags & PF_X) { 529 *pentry = ehdr.e_entry - ph->p_vaddr + ph->p_paddr; 530 } 531 532 /* Some ELF files really do have segments of zero size; 533 * just ignore them rather than trying to create empty 534 * ROM blobs, because the zero-length blob can falsely 535 * trigger the overlapping-ROM-blobs check. 536 */ 537 if (mem_size != 0) { 538 if (load_rom) { 539 g_autofree char *label = 540 g_strdup_printf("%s ELF program header segment %d", 541 name, i); 542 543 /* 544 * rom_add_elf_program() takes its own reference to 545 * 'mapped_file'. 546 */ 547 rom_add_elf_program(label, mapped_file, data, file_size, 548 mem_size, addr, as); 549 } else { 550 MemTxResult res; 551 552 res = address_space_write(as ? as : &address_space_memory, 553 addr, MEMTXATTRS_UNSPECIFIED, 554 data, file_size); 555 if (res != MEMTX_OK) { 556 goto fail; 557 } 558 /* 559 * We need to zero'ify the space that is not copied 560 * from file 561 */ 562 if (file_size < mem_size) { 563 res = address_space_set(as ? as : &address_space_memory, 564 addr + file_size, 0, 565 mem_size - file_size, 566 MEMTXATTRS_UNSPECIFIED); 567 if (res != MEMTX_OK) { 568 goto fail; 569 } 570 } 571 } 572 } 573 574 total_size += mem_size; 575 if (addr < low) 576 low = addr; 577 if ((addr + mem_size) > high) 578 high = addr + mem_size; 579 580 data = NULL; 581 582 } else if (ph->p_type == PT_NOTE && elf_note_fn) { 583 struct elf_note *nhdr = NULL; 584 585 file_size = ph->p_filesz; /* Size of the range of ELF notes */ 586 data_offset = ph->p_offset; /* Offset where the notes are located */ 587 588 if (file_size > 0) { 589 if (g_mapped_file_get_length(mapped_file) < 590 file_size + data_offset) { 591 goto fail; 592 } 593 594 data = (uint8_t *)g_mapped_file_get_contents(mapped_file); 595 data += data_offset; 596 } 597 598 /* 599 * Search the ELF notes to find one with a type matching the 600 * value passed in via 'translate_opaque' 601 */ 602 nhdr = (struct elf_note *)data; 603 assert(translate_opaque != NULL); 604 nhdr = glue(get_elf_note_type, SZ)(nhdr, file_size, ph->p_align, 605 *(uint64_t *)translate_opaque); 606 if (nhdr != NULL) { 607 elf_note_fn((void *)nhdr, (void *)&ph->p_align, SZ == 64); 608 } 609 data = NULL; 610 } 611 } 612 613 if (lowaddr) 614 *lowaddr = (uint64_t)(elf_sword)low; 615 if (highaddr) 616 *highaddr = (uint64_t)(elf_sword)high; 617 ret = total_size; 618 fail: 619 if (mapped_file) { 620 g_mapped_file_unref(mapped_file); 621 } 622 g_free(phdr); 623 return ret; 624 } 625