1 /*
2  * parse and load elf binaries
3  *
4  * This library is free software; you can redistribute it and/or
5  * modify it under the terms of the GNU Lesser General Public
6  * License as published by the Free Software Foundation;
7  * version 2.1 of the License.
8  *
9  * This library is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
12  * Lesser General Public License for more details.
13  *
14  * You should have received a copy of the GNU Lesser General Public
15  * License along with this library; If not, see <http://www.gnu.org/licenses/>.
16  */
17 
18 #ifdef __XEN__
19 #include <asm/guest_access.h>
20 #endif
21 
22 #include "libelf-private.h"
23 
24 /* ------------------------------------------------------------------------ */
25 
26 /* Number of section header needed in order to fit the SYMTAB and STRTAB. */
27 #define ELF_BSDSYM_SECTIONS 3
28 struct elf_sym_header {
29     uint32_t size;
30     struct {
31         elf_ehdr header;
32         elf_shdr section[ELF_BSDSYM_SECTIONS];
33     } elf_header;
34 } __attribute__((packed));
35 
elf_init(struct elf_binary * elf,const char * image_input,size_t size)36 elf_errorstatus elf_init(struct elf_binary *elf, const char *image_input, size_t size)
37 {
38     ELF_HANDLE_DECL(elf_shdr) shdr;
39     unsigned i, count, section, link;
40     uint64_t offset;
41 
42     if ( !elf_is_elfbinary(image_input, size) )
43     {
44         elf_err(elf, "ELF: not an ELF binary\n");
45         return -1;
46     }
47 
48     elf_memset_unchecked(elf, 0, sizeof(*elf));
49     elf->image_base = image_input;
50     elf->size = size;
51     elf->ehdr = ELF_MAKE_HANDLE(elf_ehdr, (elf_ptrval)image_input);
52     elf->class = elf_uval_3264(elf, elf->ehdr, e32.e_ident[EI_CLASS]);
53     elf->data = elf_uval_3264(elf, elf->ehdr, e32.e_ident[EI_DATA]);
54 
55     /* Sanity check phdr. */
56     offset = elf_uval(elf, elf->ehdr, e_phoff) +
57         elf_uval(elf, elf->ehdr, e_phentsize) * elf_phdr_count(elf);
58     if ( offset > elf->size )
59     {
60         elf_err(elf, "ELF: phdr overflow (off %" PRIx64 " > size %lx)\n",
61                 offset, (unsigned long)elf->size);
62         return -1;
63     }
64 
65     /* Sanity check shdr. */
66     offset = elf_uval(elf, elf->ehdr, e_shoff) +
67         elf_uval(elf, elf->ehdr, e_shentsize) * elf_shdr_count(elf);
68     if ( offset > elf->size )
69     {
70         elf_err(elf, "ELF: shdr overflow (off %" PRIx64 " > size %lx)\n",
71                 offset, (unsigned long)elf->size);
72         return -1;
73     }
74 
75     /* Find section string table. */
76     section = elf_uval(elf, elf->ehdr, e_shstrndx);
77     shdr = elf_shdr_by_index(elf, section);
78     if ( ELF_HANDLE_VALID(shdr) )
79         elf->sec_strtab = elf_section_start(elf, shdr);
80 
81     /* Find symbol table and symbol string table. */
82     count = elf_shdr_count(elf);
83     for ( i = 1; i < count; i++ )
84     {
85         shdr = elf_shdr_by_index(elf, i);
86         if ( !elf_access_ok(elf, ELF_HANDLE_PTRVAL(shdr), 1) )
87             /* input has an insane section header count field */
88             break;
89         if ( elf_uval(elf, shdr, sh_type) != SHT_SYMTAB )
90             continue;
91 
92         link = elf_uval(elf, shdr, sh_link);
93         if ( link == SHN_UNDEF || link >= count )
94             /* out-of-bounds link value. */
95             break;
96 
97         elf->sym_tab = shdr;
98         shdr = elf_shdr_by_index(elf, link);
99         if ( !ELF_HANDLE_VALID(shdr) )
100         {
101             elf->sym_tab = ELF_INVALID_HANDLE(elf_shdr);
102             continue;
103         }
104         elf->sym_strtab = elf_section_start(elf, shdr);
105         break;
106     }
107 
108     return 0;
109 }
110 
111 #ifndef __XEN__
elf_call_log_callback(struct elf_binary * elf,bool iserr,const char * fmt,...)112 void elf_call_log_callback(struct elf_binary *elf, bool iserr,
113                            const char *fmt,...) {
114     va_list al;
115 
116     if (!elf->log_callback)
117         return;
118     if (!(iserr || elf->verbose))
119         return;
120 
121     va_start(al,fmt);
122     elf->log_callback(elf, elf->log_caller_data, iserr, fmt, al);
123     va_end(al);
124 }
125 
elf_set_log(struct elf_binary * elf,elf_log_callback * log_callback,void * log_caller_data,bool verbose)126 void elf_set_log(struct elf_binary *elf, elf_log_callback *log_callback,
127                  void *log_caller_data, bool verbose)
128 {
129     elf->log_callback = log_callback;
130     elf->log_caller_data = log_caller_data;
131     elf->verbose = verbose;
132 }
133 
elf_load_image(struct elf_binary * elf,elf_ptrval dst,elf_ptrval src,uint64_t filesz,uint64_t memsz)134 static elf_errorstatus elf_load_image(struct elf_binary *elf,
135                           elf_ptrval dst, elf_ptrval src,
136                           uint64_t filesz, uint64_t memsz)
137 {
138     elf_memcpy_safe(elf, dst, src, filesz);
139     elf_memset_safe(elf, dst + filesz, 0, memsz - filesz);
140     return 0;
141 }
142 #else
143 
elf_set_verbose(struct elf_binary * elf)144 void elf_set_verbose(struct elf_binary *elf)
145 {
146     elf->verbose = 1;
147 }
148 
elf_memcpy(struct vcpu * v,void * dst,void * src,uint64_t size)149 static elf_errorstatus elf_memcpy(struct vcpu *v, void *dst, void *src,
150                                   uint64_t size)
151 {
152     unsigned int res;
153 
154 #ifdef CONFIG_X86
155     if ( is_hvm_vcpu(v) )
156     {
157         enum hvm_translation_result rc;
158 
159         rc = hvm_copy_to_guest_phys((paddr_t)dst, src, size, v);
160         return rc != HVMTRANS_okay ? -1 : 0;
161     }
162 #endif
163 
164     res = src ? raw_copy_to_guest(dst, src, size) :
165                 raw_clear_guest(dst, size);
166 
167     return res ? -1 : 0;
168 }
169 
elf_load_image(struct elf_binary * elf,elf_ptrval dst,elf_ptrval src,uint64_t filesz,uint64_t memsz)170 static elf_errorstatus elf_load_image(struct elf_binary *elf, elf_ptrval dst, elf_ptrval src, uint64_t filesz, uint64_t memsz)
171 {
172     elf_errorstatus rc;
173     if ( filesz > ULONG_MAX || memsz > ULONG_MAX )
174         return -1;
175     /* We trust the dom0 kernel image completely, so we don't care
176      * about overruns etc. here. */
177     rc = elf_memcpy(elf->vcpu, ELF_UNSAFE_PTR(dst), ELF_UNSAFE_PTR(src),
178                     filesz);
179     if ( rc != 0 )
180         return -1;
181     rc = elf_memcpy(elf->vcpu, ELF_UNSAFE_PTR(dst + filesz), NULL,
182                     memsz - filesz);
183     if ( rc != 0 )
184         return -1;
185     return 0;
186 }
187 #endif
188 
189 /* Calculate the required additional kernel space for the elf image */
elf_parse_bsdsyms(struct elf_binary * elf,uint64_t pstart)190 void elf_parse_bsdsyms(struct elf_binary *elf, uint64_t pstart)
191 {
192     uint64_t sz;
193     ELF_HANDLE_DECL(elf_shdr) shdr;
194 
195     if ( !ELF_HANDLE_VALID(elf->sym_tab) )
196     {
197         elf_mark_broken(elf, "invalid ELF handle for symtab section");
198         return;
199     }
200 
201     pstart = elf_round_up(elf, pstart);
202 
203     /* Space to store the size of the elf image */
204     sz = sizeof(uint32_t);
205 
206     /* Space for the ELF header and section headers */
207     sz += offsetof(struct elf_sym_header, elf_header.section) +
208           ELF_BSDSYM_SECTIONS * (elf_64bit(elf) ? sizeof(Elf64_Shdr) :
209                                                   sizeof(Elf32_Shdr));
210     sz = elf_round_up(elf, sz);
211 
212     /*
213      * No need to search for the symtab section header again, it's handler
214      * is stored in elf->sym_tab by the elf_init function.
215      */
216 
217     /* Space for the symbol and string tables. */
218     sz = elf_round_up(elf, sz + elf_uval(elf, elf->sym_tab, sh_size));
219 
220     shdr = elf_shdr_by_index(elf, elf_uval(elf, elf->sym_tab, sh_link));
221 
222     if ( !elf_access_ok(elf, ELF_HANDLE_PTRVAL(shdr), 1) )
223         /* input has an insane section header count field */
224         return;
225 
226     if ( elf_uval(elf, shdr, sh_type) != SHT_STRTAB )
227         /* Invalid symtab -> strtab link */
228         return;
229 
230     sz = elf_round_up(elf, sz + elf_uval(elf, shdr, sh_size));
231 
232     elf->bsd_symtab_pstart = pstart;
233     elf->bsd_symtab_pend   = pstart + sz;
234 }
235 
elf_load_bsdsyms(struct elf_binary * elf)236 static void elf_load_bsdsyms(struct elf_binary *elf)
237 {
238     /*
239      * Header that is placed at the end of the kernel and allows
240      * the OS to find where the symtab and strtab have been loaded.
241      * It mimics a valid ELF file header, although it only contains
242      * a symtab and a strtab section. The layout in memory is the
243      * following:
244      *
245      * +------------------------+
246      * |                        |
247      * | KERNEL                 |
248      * |                        |
249      * +------------------------+ pend
250      * | ALIGNMENT              |
251      * +------------------------+ bsd_symtab_pstart
252      * |                        |
253      * | size                   | bsd_symtab_pend - bsd_symtab_pstart
254      * |                        |
255      * +------------------------+ bsd_symtab_pstart + 4
256      * |                        |
257      * | ELF header             |
258      * |                        |
259      * +------------------------+
260      * |                        |
261      * | ELF section header 0   | Undefined section header
262      * |                        |
263      * +------------------------+
264      * |                        |
265      * | ELF section header 1   | SYMTAB section header
266      * |                        |
267      * +------------------------+
268      * |                        |
269      * | ELF section header 2   | STRTAB section header
270      * |                        |
271      * +------------------------+
272      * |                        |
273      * | SYMTAB                 |
274      * |                        |
275      * +------------------------+
276      * |                        |
277      * | STRTAB                 |
278      * |                        |
279      * +------------------------+ bsd_symtab_pend
280      *
281      * NB: according to the ELF spec there's only ONE symtab per ELF
282      * file, and accordingly we will only load the corresponding
283      * strtab, so we only need three section headers in our fake ELF
284      * header (first section header is always the undefined section).
285      */
286     struct elf_sym_header header;
287     ELF_HANDLE_DECL(elf_ehdr) header_handle;
288     unsigned long shdr_size, ehdr_size, header_size;
289     ELF_HANDLE_DECL(elf_shdr) section_handle;
290     unsigned int link, rc, i;
291     elf_ptrval header_base;
292     elf_ptrval elf_header_base;
293     elf_ptrval symtab_base;
294     elf_ptrval strtab_base;
295 
296     if ( !elf->bsd_symtab_pstart )
297         return;
298 
299 #define elf_store_field_bitness(_elf, _hdr, _elm, _val)             \
300 do {                                                                \
301     if ( elf_64bit(_elf) )                                          \
302         elf_store_field(_elf, _hdr, e64._elm, _val);                \
303     else                                                            \
304         elf_store_field(_elf, _hdr, e32._elm, _val);                \
305 } while ( 0 )
306 
307 #define SYMTAB_INDEX    1
308 #define STRTAB_INDEX    2
309 
310     /* Allow elf_memcpy_safe to write to header. */
311     elf_set_xdest(elf, &header, sizeof(header));
312 
313     /*
314      * Calculate the position of the various elements in GUEST MEMORY SPACE.
315      * This addresses MUST only be used with elf_load_image.
316      *
317      * NB: strtab_base cannot be calculated at this point because we don't
318      * know the size of the symtab yet, and the strtab will be placed after it.
319      */
320     header_base = elf_get_ptr(elf, elf->bsd_symtab_pstart);
321     elf_header_base = elf_get_ptr(elf, elf->bsd_symtab_pstart) +
322                       sizeof(uint32_t);
323     symtab_base = elf_round_up(elf, header_base + sizeof(header));
324 
325     /*
326      * Set the size of the ELF header and the section headers, based on the
327      * size of our local copy.
328      */
329     ehdr_size = elf_64bit(elf) ? sizeof(header.elf_header.header.e64) :
330                                  sizeof(header.elf_header.header.e32);
331     shdr_size = elf_64bit(elf) ? sizeof(header.elf_header.section[0].e64) :
332                                  sizeof(header.elf_header.section[0].e32);
333 
334     /* Fill the ELF header, copied from the original ELF header. */
335     header_handle = ELF_MAKE_HANDLE(elf_ehdr,
336                                 ELF_REALPTR2PTRVAL(&header.elf_header.header));
337     elf_memcpy_safe(elf, ELF_HANDLE_PTRVAL(header_handle),
338                     ELF_HANDLE_PTRVAL(elf->ehdr), ehdr_size);
339 
340     /*
341      * Set the ELF header size, section header entry size and version
342      * (in case we are dealing with an input ELF header that has extensions).
343      */
344     elf_store_field_bitness(elf, header_handle, e_ehsize, ehdr_size);
345     elf_store_field_bitness(elf, header_handle, e_shentsize, shdr_size);
346     elf_store_field_bitness(elf, header_handle, e_version, EV_CURRENT);
347 
348     /* Set the offset to the shdr array. */
349     elf_store_field_bitness(elf, header_handle, e_shoff,
350                             offsetof(typeof(header.elf_header), section));
351 
352     /* Set the right number of section headers. */
353     elf_store_field_bitness(elf, header_handle, e_shnum, ELF_BSDSYM_SECTIONS);
354 
355     /* Clear a couple of fields we don't use. */
356     elf_store_field_bitness(elf, header_handle, e_phoff, 0);
357     elf_store_field_bitness(elf, header_handle, e_phentsize, 0);
358     elf_store_field_bitness(elf, header_handle, e_phnum, 0);
359     elf_store_field_bitness(elf, header_handle, e_shstrndx, 0);
360 
361     /*
362      * The symtab section header is going to reside in section[SYMTAB_INDEX],
363      * while the corresponding strtab is going to be placed in
364      * section[STRTAB_INDEX]. sh_offset is mangled so it points to the offset
365      * where the sections are actually loaded (relative to the ELF header
366      * location).
367      */
368     section_handle = ELF_MAKE_HANDLE(elf_shdr,
369                 ELF_REALPTR2PTRVAL(&header.elf_header.section[SYMTAB_INDEX]));
370 
371     elf_memcpy_safe(elf, ELF_HANDLE_PTRVAL(section_handle),
372                     ELF_HANDLE_PTRVAL(elf->sym_tab),
373                     shdr_size);
374 
375     /* Copy the original sh_link field before mangling it. */
376     link = elf_uval(elf, section_handle, sh_link);
377 
378     /* Load symtab into guest memory. */
379     rc = elf_load_image(elf, symtab_base,
380                         elf_section_start(elf, section_handle),
381                         elf_uval(elf, section_handle, sh_size),
382                         elf_uval(elf, section_handle, sh_size));
383     if ( rc != 0 )
384     {
385         elf_mark_broken(elf, "unable to load symtab into guest memory");
386         return;
387     }
388 
389     /* Adjust the sh_offset and sh_link of the copied section header. */
390     elf_store_field_bitness(elf, section_handle, sh_offset,
391                             symtab_base - elf_header_base);
392     elf_store_field_bitness(elf, section_handle, sh_link,
393                             STRTAB_INDEX);
394 
395     /* Calculate the guest address where strtab is loaded. */
396     strtab_base = elf_round_up(elf, symtab_base +
397                                elf_uval(elf, section_handle, sh_size));
398 
399     /* Load strtab section header. */
400     section_handle = ELF_MAKE_HANDLE(elf_shdr,
401             ELF_REALPTR2PTRVAL(&header.elf_header.section[STRTAB_INDEX]));
402     elf_memcpy_safe(elf, ELF_HANDLE_PTRVAL(section_handle),
403                     ELF_HANDLE_PTRVAL(elf_shdr_by_index(elf, link)),
404                     shdr_size);
405 
406     if ( elf_uval(elf, section_handle, sh_type) != SHT_STRTAB )
407     {
408         elf_mark_broken(elf, "strtab not found");
409         return;
410     }
411 
412     /* Load strtab into guest memory. */
413     rc = elf_load_image(elf, strtab_base,
414                         elf_section_start(elf, section_handle),
415                         elf_uval(elf, section_handle, sh_size),
416                         elf_uval(elf, section_handle, sh_size));
417     if ( rc != 0 )
418     {
419         elf_mark_broken(elf, "unable to load strtab into guest memory");
420         return;
421     }
422 
423     elf_store_field_bitness(elf, section_handle, sh_offset,
424                             strtab_base - elf_header_base);
425 
426     /* Store the whole size (including headers and loaded sections). */
427     header.size = strtab_base + elf_uval(elf, section_handle, sh_size) -
428                   elf_header_base;
429 
430     /* Load the size plus ELF header. */
431     header_size = offsetof(typeof(header), elf_header.section);
432     rc = elf_load_image(elf, header_base, ELF_REALPTR2PTRVAL(&header),
433                         header_size, header_size);
434     if ( rc != 0 )
435     {
436         elf_mark_broken(elf, "unable to load ELF headers into guest memory");
437         return;
438     }
439 
440     /*
441      * Load the section headers.
442      *
443      * NB: this _must_ be done one by one, and taking the bitness into account,
444      * so that the guest can treat this as an array of type Elf{32/64}_Shdr.
445      */
446     for ( i = 0; i < ELF_BSDSYM_SECTIONS; i++ )
447     {
448         rc = elf_load_image(elf, header_base + header_size + shdr_size * i,
449                             ELF_REALPTR2PTRVAL(&header.elf_header.section[i]),
450                             shdr_size, shdr_size);
451         if ( rc != 0 )
452         {
453             elf_mark_broken(elf,
454                         "unable to load ELF section header into guest memory");
455             return;
456         }
457     }
458 
459     /* Remove permissions from elf_memcpy_safe. */
460     elf_set_xdest(elf, NULL, 0);
461 
462 #undef SYMTAB_INDEX
463 #undef STRTAB_INDEX
464 #undef elf_store_field_bitness
465 }
466 
elf_parse_binary(struct elf_binary * elf)467 void elf_parse_binary(struct elf_binary *elf)
468 {
469     ELF_HANDLE_DECL(elf_phdr) phdr;
470     uint64_t low = -1, high = 0, paddr, memsz;
471     unsigned i, count;
472 
473     count = elf_phdr_count(elf);
474     for ( i = 0; i < count; i++ )
475     {
476         phdr = elf_phdr_by_index(elf, i);
477         if ( !elf_access_ok(elf, ELF_HANDLE_PTRVAL(phdr), 1) )
478             /* input has an insane program header count field */
479             break;
480         if ( !elf_phdr_is_loadable(elf, phdr) )
481             continue;
482         paddr = elf_uval(elf, phdr, p_paddr);
483         memsz = elf_uval(elf, phdr, p_memsz);
484         elf_msg(elf, "ELF: phdr: paddr=%#" PRIx64 " memsz=%#" PRIx64 "\n",
485                 paddr, memsz);
486         if ( low > paddr )
487             low = paddr;
488         if ( high < paddr + memsz )
489             high = paddr + memsz;
490     }
491     elf->pstart = low;
492     elf->pend = high;
493     elf_msg(elf, "ELF: memory: %#" PRIx64 " -> %#" PRIx64 "\n",
494             elf->pstart, elf->pend);
495 }
496 
elf_load_binary(struct elf_binary * elf)497 elf_errorstatus elf_load_binary(struct elf_binary *elf)
498 {
499     ELF_HANDLE_DECL(elf_phdr) phdr;
500     uint64_t paddr, offset, filesz, memsz;
501     unsigned i, count;
502     elf_ptrval dest;
503     /*
504      * Let bizarre ELFs write the output image up to twice; this
505      * calculation is just to ensure our copying loop is no worse than
506      * O(domain_size).
507      */
508     uint64_t remain_allow_copy = (uint64_t)elf->dest_size * 2;
509 
510     count = elf_phdr_count(elf);
511     for ( i = 0; i < count; i++ )
512     {
513         phdr = elf_phdr_by_index(elf, i);
514         if ( !elf_access_ok(elf, ELF_HANDLE_PTRVAL(phdr), 1) )
515             /* input has an insane program header count field */
516             break;
517         if ( !elf_phdr_is_loadable(elf, phdr) )
518             continue;
519         paddr = elf_uval(elf, phdr, p_paddr);
520         offset = elf_uval(elf, phdr, p_offset);
521         filesz = elf_uval(elf, phdr, p_filesz);
522         memsz = elf_uval(elf, phdr, p_memsz);
523         dest = elf_get_ptr(elf, paddr);
524 
525         /*
526          * We need to check that the input image doesn't have us copy
527          * the whole image zillions of times, as that could lead to
528          * O(n^2) time behaviour and possible DoS by a malicous ELF.
529          */
530         if ( remain_allow_copy < memsz )
531         {
532             elf_mark_broken(elf, "program segments total to more"
533                             " than the input image size");
534             break;
535         }
536         remain_allow_copy -= memsz;
537 
538         elf_msg(elf,
539                 "ELF: phdr %u at %#"ELF_PRPTRVAL" -> %#"ELF_PRPTRVAL"\n",
540                 i, dest, (elf_ptrval)(dest + filesz));
541         if ( elf_load_image(elf, dest, ELF_IMAGE_BASE(elf) + offset, filesz, memsz) != 0 )
542             return -1;
543     }
544 
545     elf_load_bsdsyms(elf);
546     return 0;
547 }
548 
elf_get_ptr(struct elf_binary * elf,unsigned long addr)549 elf_ptrval elf_get_ptr(struct elf_binary *elf, unsigned long addr)
550 {
551     return ELF_REALPTR2PTRVAL(elf->dest_base) + addr - elf->pstart;
552 }
553 
elf_lookup_addr(struct elf_binary * elf,const char * symbol)554 uint64_t elf_lookup_addr(struct elf_binary * elf, const char *symbol)
555 {
556     ELF_HANDLE_DECL(elf_sym) sym;
557     uint64_t value;
558 
559     sym = elf_sym_by_name(elf, symbol);
560     if ( !ELF_HANDLE_VALID(sym) )
561     {
562         elf_err(elf, "%s: not found: %s\n", __func__, symbol);
563         return -1;
564     }
565 
566     value = elf_uval(elf, sym, st_value);
567     elf_msg(elf, "%s: symbol \"%s\" at 0x%" PRIx64 "\n", __func__,
568             symbol, value);
569     return value;
570 }
571 
572 /*
573  * Local variables:
574  * mode: C
575  * c-file-style: "BSD"
576  * c-basic-offset: 4
577  * tab-width: 4
578  * indent-tabs-mode: nil
579  * End:
580  */
581