[linux.git] / kernel / kexec_elf.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Load ELF vmlinux file for the kexec_file_load syscall.
 *
 * Copyright (C) 2004  Adam Litke ([email protected])
 * Copyright (C) 2004  IBM Corp.
 * Copyright (C) 2005  R Sharada ([email protected])
 * Copyright (C) 2006  Mohan Kumar M ([email protected])
 * Copyright (C) 2016  IBM Corporation
 *
 * Based on kexec-tools' kexec-elf-exec.c and kexec-elf-ppc64.c.
 * Heavily modified for the kernel by
 * Thiago Jung Bauermann <[email protected]>.
 */

#define pr_fmt(fmt)	"kexec_elf: " fmt

#include <linux/elf.h>
#include <linux/kexec.h>
#include <linux/module.h>
#include <linux/slab.h>
#include <linux/types.h>

static inline bool elf_is_elf_file(const struct elfhdr *ehdr)
{
	return memcmp(ehdr->e_ident, ELFMAG, SELFMAG) == 0;
}

static uint64_t elf64_to_cpu(const struct elfhdr *ehdr, uint64_t value)
{
	if (ehdr->e_ident[EI_DATA] == ELFDATA2LSB)
		value = le64_to_cpu(value);
	else if (ehdr->e_ident[EI_DATA] == ELFDATA2MSB)
		value = be64_to_cpu(value);

	return value;
}

static uint32_t elf32_to_cpu(const struct elfhdr *ehdr, uint32_t value)
{
	if (ehdr->e_ident[EI_DATA] == ELFDATA2LSB)
		value = le32_to_cpu(value);
	else if (ehdr->e_ident[EI_DATA] == ELFDATA2MSB)
		value = be32_to_cpu(value);

	return value;
}

static uint16_t elf16_to_cpu(const struct elfhdr *ehdr, uint16_t value)
{
	if (ehdr->e_ident[EI_DATA] == ELFDATA2LSB)
		value = le16_to_cpu(value);
	else if (ehdr->e_ident[EI_DATA] == ELFDATA2MSB)
		value = be16_to_cpu(value);

	return value;
}

/**
 * elf_is_ehdr_sane - check that it is safe to use the ELF header
 * @buf_len:	size of the buffer in which the ELF file is loaded.
 */
static bool elf_is_ehdr_sane(const struct elfhdr *ehdr, size_t buf_len)
{
	if (ehdr->e_phnum > 0 && ehdr->e_phentsize != sizeof(struct elf_phdr)) {
		pr_debug("Bad program header size.\n");
		return false;
	} else if (ehdr->e_shnum > 0 &&
		   ehdr->e_shentsize != sizeof(struct elf_shdr)) {
		pr_debug("Bad section header size.\n");
		return false;
	} else if (ehdr->e_ident[EI_VERSION] != EV_CURRENT ||
		   ehdr->e_version != EV_CURRENT) {
		pr_debug("Unknown ELF version.\n");
		return false;
	}

	if (ehdr->e_phoff > 0 && ehdr->e_phnum > 0) {
		size_t phdr_size;

		/*
		 * e_phnum is at most 65535 so calculating the size of the
		 * program header cannot overflow.
		 */
		phdr_size = sizeof(struct elf_phdr) * ehdr->e_phnum;

		/* Sanity check the program header table location. */
		if (ehdr->e_phoff + phdr_size < ehdr->e_phoff) {
			pr_debug("Program headers at invalid location.\n");
			return false;
		} else if (ehdr->e_phoff + phdr_size > buf_len) {
			pr_debug("Program headers truncated.\n");
			return false;
		}
	}

	if (ehdr->e_shoff > 0 && ehdr->e_shnum > 0) {
		size_t shdr_size;

		/*
		 * e_shnum is at most 65536 so calculating
		 * the size of the section header cannot overflow.
		 */
		shdr_size = sizeof(struct elf_shdr) * ehdr->e_shnum;

		/* Sanity check the section header table location. */
		if (ehdr->e_shoff + shdr_size < ehdr->e_shoff) {
			pr_debug("Section headers at invalid location.\n");
			return false;
		} else if (ehdr->e_shoff + shdr_size > buf_len) {
			pr_debug("Section headers truncated.\n");
			return false;
		}
	}

	return true;
}

static int elf_read_ehdr(const char *buf, size_t len, struct elfhdr *ehdr)
{
	struct elfhdr *buf_ehdr;

	if (len < sizeof(*buf_ehdr)) {
		pr_debug("Buffer is too small to hold ELF header.\n");
		return -ENOEXEC;
	}

	memset(ehdr, 0, sizeof(*ehdr));
	memcpy(ehdr->e_ident, buf, sizeof(ehdr->e_ident));
	if (!elf_is_elf_file(ehdr)) {
		pr_debug("No ELF header magic.\n");
		return -ENOEXEC;
	}

	if (ehdr->e_ident[EI_CLASS] != ELF_CLASS) {
		pr_debug("Not a supported ELF class.\n");
		return -ENOEXEC;
	} else  if (ehdr->e_ident[EI_DATA] != ELFDATA2LSB &&
		ehdr->e_ident[EI_DATA] != ELFDATA2MSB) {
		pr_debug("Not a supported ELF data format.\n");
		return -ENOEXEC;
	}

	buf_ehdr = (struct elfhdr *) buf;
	if (elf16_to_cpu(ehdr, buf_ehdr->e_ehsize) != sizeof(*buf_ehdr)) {
		pr_debug("Bad ELF header size.\n");
		return -ENOEXEC;
	}

	ehdr->e_type      = elf16_to_cpu(ehdr, buf_ehdr->e_type);
	ehdr->e_machine   = elf16_to_cpu(ehdr, buf_ehdr->e_machine);
	ehdr->e_version   = elf32_to_cpu(ehdr, buf_ehdr->e_version);
	ehdr->e_flags     = elf32_to_cpu(ehdr, buf_ehdr->e_flags);
	ehdr->e_phentsize = elf16_to_cpu(ehdr, buf_ehdr->e_phentsize);
	ehdr->e_phnum     = elf16_to_cpu(ehdr, buf_ehdr->e_phnum);
	ehdr->e_shentsize = elf16_to_cpu(ehdr, buf_ehdr->e_shentsize);
	ehdr->e_shnum     = elf16_to_cpu(ehdr, buf_ehdr->e_shnum);
	ehdr->e_shstrndx  = elf16_to_cpu(ehdr, buf_ehdr->e_shstrndx);

	switch (ehdr->e_ident[EI_CLASS]) {
	case ELFCLASS64:
		ehdr->e_entry = elf64_to_cpu(ehdr, buf_ehdr->e_entry);
		ehdr->e_phoff = elf64_to_cpu(ehdr, buf_ehdr->e_phoff);
		ehdr->e_shoff = elf64_to_cpu(ehdr, buf_ehdr->e_shoff);
		break;

	case ELFCLASS32:
		ehdr->e_entry = elf32_to_cpu(ehdr, buf_ehdr->e_entry);
		ehdr->e_phoff = elf32_to_cpu(ehdr, buf_ehdr->e_phoff);
		ehdr->e_shoff = elf32_to_cpu(ehdr, buf_ehdr->e_shoff);
		break;

	default:
		pr_debug("Unknown ELF class.\n");
		return -EINVAL;
	}

	return elf_is_ehdr_sane(ehdr, len) ? 0 : -ENOEXEC;
}

/**
 * elf_is_phdr_sane - check that it is safe to use the program header
 * @buf_len:	size of the buffer in which the ELF file is loaded.
 */
static bool elf_is_phdr_sane(const struct elf_phdr *phdr, size_t buf_len)
{

	if (phdr->p_offset + phdr->p_filesz < phdr->p_offset) {
		pr_debug("ELF segment location wraps around.\n");
		return false;
	} else if (phdr->p_offset + phdr->p_filesz > buf_len) {
		pr_debug("ELF segment not in file.\n");
		return false;
	} else if (phdr->p_paddr + phdr->p_memsz < phdr->p_paddr) {
		pr_debug("ELF segment address wraps around.\n");
		return false;
	}

	return true;
}

static int elf_read_phdr(const char *buf, size_t len,
			 struct kexec_elf_info *elf_info,
			 int idx)
{
	/* Override the const in proghdrs, we are the ones doing the loading. */
	struct elf_phdr *phdr = (struct elf_phdr *) &elf_info->proghdrs[idx];
	const struct elfhdr *ehdr = elf_info->ehdr;
	const char *pbuf;
	struct elf_phdr *buf_phdr;

	pbuf = buf + elf_info->ehdr->e_phoff + (idx * sizeof(*buf_phdr));
	buf_phdr = (struct elf_phdr *) pbuf;

	phdr->p_type   = elf32_to_cpu(elf_info->ehdr, buf_phdr->p_type);
	phdr->p_flags  = elf32_to_cpu(elf_info->ehdr, buf_phdr->p_flags);

	switch (ehdr->e_ident[EI_CLASS]) {
	case ELFCLASS64:
		phdr->p_offset = elf64_to_cpu(ehdr, buf_phdr->p_offset);
		phdr->p_paddr  = elf64_to_cpu(ehdr, buf_phdr->p_paddr);
		phdr->p_vaddr  = elf64_to_cpu(ehdr, buf_phdr->p_vaddr);
		phdr->p_filesz = elf64_to_cpu(ehdr, buf_phdr->p_filesz);
		phdr->p_memsz  = elf64_to_cpu(ehdr, buf_phdr->p_memsz);
		phdr->p_align  = elf64_to_cpu(ehdr, buf_phdr->p_align);
		break;

	case ELFCLASS32:
		phdr->p_offset = elf32_to_cpu(ehdr, buf_phdr->p_offset);
		phdr->p_paddr  = elf32_to_cpu(ehdr, buf_phdr->p_paddr);
		phdr->p_vaddr  = elf32_to_cpu(ehdr, buf_phdr->p_vaddr);
		phdr->p_filesz = elf32_to_cpu(ehdr, buf_phdr->p_filesz);
		phdr->p_memsz  = elf32_to_cpu(ehdr, buf_phdr->p_memsz);
		phdr->p_align  = elf32_to_cpu(ehdr, buf_phdr->p_align);
		break;

	default:
		pr_debug("Unknown ELF class.\n");
		return -EINVAL;
	}

	return elf_is_phdr_sane(phdr, len) ? 0 : -ENOEXEC;
}

/**
 * elf_read_phdrs - read the program headers from the buffer
 *
 * This function assumes that the program header table was checked for sanity.
 * Use elf_is_ehdr_sane() if it wasn't.
 */
static int elf_read_phdrs(const char *buf, size_t len,
			  struct kexec_elf_info *elf_info)
{
	size_t phdr_size, i;
	const struct elfhdr *ehdr = elf_info->ehdr;

	/*
	 * e_phnum is at most 65535 so calculating the size of the
	 * program header cannot overflow.
	 */
	phdr_size = sizeof(struct elf_phdr) * ehdr->e_phnum;

	elf_info->proghdrs = kzalloc(phdr_size, GFP_KERNEL);
	if (!elf_info->proghdrs)
		return -ENOMEM;

	for (i = 0; i < ehdr->e_phnum; i++) {
		int ret;

		ret = elf_read_phdr(buf, len, elf_info, i);
		if (ret) {
			kfree(elf_info->proghdrs);
			elf_info->proghdrs = NULL;
			return ret;
		}
	}

	return 0;
}

/**
 * elf_read_from_buffer - read ELF file and sets up ELF header and ELF info
 * @buf:	Buffer to read ELF file from.
 * @len:	Size of @buf.
 * @ehdr:	Pointer to existing struct which will be populated.
 * @elf_info:	Pointer to existing struct which will be populated.
 *
 * This function allows reading ELF files with different byte order than
 * the kernel, byte-swapping the fields as needed.
 *
 * Return:
 * On success returns 0, and the caller should call
 * kexec_free_elf_info(elf_info) to free the memory allocated for the section
 * and program headers.
 */
static int elf_read_from_buffer(const char *buf, size_t len,
				struct elfhdr *ehdr,
				struct kexec_elf_info *elf_info)
{
	int ret;

	ret = elf_read_ehdr(buf, len, ehdr);
	if (ret)
		return ret;

	elf_info->buffer = buf;
	elf_info->ehdr = ehdr;
	if (ehdr->e_phoff > 0 && ehdr->e_phnum > 0) {
		ret = elf_read_phdrs(buf, len, elf_info);
		if (ret)
			return ret;
	}
	return 0;
}

/**
 * kexec_free_elf_info - free memory allocated by elf_read_from_buffer
 */
void kexec_free_elf_info(struct kexec_elf_info *elf_info)
{
	kfree(elf_info->proghdrs);
	memset(elf_info, 0, sizeof(*elf_info));
}
/**
 * kexec_build_elf_info - read ELF executable and check that we can use it
 */
int kexec_build_elf_info(const char *buf, size_t len, struct elfhdr *ehdr,
			       struct kexec_elf_info *elf_info)
{
	int i;
	int ret;

	ret = elf_read_from_buffer(buf, len, ehdr, elf_info);
	if (ret)
		return ret;

	/* Big endian vmlinux has type ET_DYN. */
	if (ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) {
		pr_err("Not an ELF executable.\n");
		goto error;
	} else if (!elf_info->proghdrs) {
		pr_err("No ELF program header.\n");
		goto error;
	}

	for (i = 0; i < ehdr->e_phnum; i++) {
		/*
		 * Kexec does not support loading interpreters.
		 * In addition this check keeps us from attempting
		 * to kexec ordinay executables.
		 */
		if (elf_info->proghdrs[i].p_type == PT_INTERP) {
			pr_err("Requires an ELF interpreter.\n");
			goto error;
		}
	}

	return 0;
error:
	kexec_free_elf_info(elf_info);
	return -ENOEXEC;
}


int kexec_elf_probe(const char *buf, unsigned long len)
{
	struct elfhdr ehdr;
	struct kexec_elf_info elf_info;
	int ret;

	ret = kexec_build_elf_info(buf, len, &ehdr, &elf_info);
	if (ret)
		return ret;

	kexec_free_elf_info(&elf_info);

	return elf_check_arch(&ehdr) ? 0 : -ENOEXEC;
}

/**
 * kexec_elf_load - load ELF executable image
 * @lowest_load_addr:	On return, will be the address where the first PT_LOAD
 *			section will be loaded in memory.
 *
 * Return:
 * 0 on success, negative value on failure.
 */
int kexec_elf_load(struct kimage *image, struct elfhdr *ehdr,
			 struct kexec_elf_info *elf_info,
			 struct kexec_buf *kbuf,
			 unsigned long *lowest_load_addr)
{
	unsigned long lowest_addr = UINT_MAX;
	int ret;
	size_t i;

	/* Read in the PT_LOAD segments. */
	for (i = 0; i < ehdr->e_phnum; i++) {
		unsigned long load_addr;
		size_t size;
		const struct elf_phdr *phdr;

		phdr = &elf_info->proghdrs[i];
		if (phdr->p_type != PT_LOAD)
			continue;

		size = phdr->p_filesz;
		if (size > phdr->p_memsz)
			size = phdr->p_memsz;

		kbuf->buffer = (void *) elf_info->buffer + phdr->p_offset;
		kbuf->bufsz = size;
		kbuf->memsz = phdr->p_memsz;
		kbuf->buf_align = phdr->p_align;
		kbuf->buf_min = phdr->p_paddr;
		kbuf->mem = KEXEC_BUF_MEM_UNKNOWN;
		ret = kexec_add_buffer(kbuf);
		if (ret)
			goto out;
		load_addr = kbuf->mem;

		if (load_addr < lowest_addr)
			lowest_addr = load_addr;
	}

	*lowest_load_addr = lowest_addr;
	ret = 0;
 out:
	return ret;
}
Commit	Line	Data
175fca3b SS	1	// SPDX-License-Identifier: GPL-2.0-only
	2	/*
	3	* Load ELF vmlinux file for the kexec_file_load syscall.
	4	*
	5	* Copyright (C) 2004 Adam Litke ([email protected])
	6	* Copyright (C) 2004 IBM Corp.
	7	* Copyright (C) 2005 R Sharada ([email protected])
	8	* Copyright (C) 2006 Mohan Kumar M ([email protected])
	9	* Copyright (C) 2016 IBM Corporation
	10	*
	11	* Based on kexec-tools' kexec-elf-exec.c and kexec-elf-ppc64.c.
	12	* Heavily modified for the kernel by
	13	* Thiago Jung Bauermann <[email protected]>.
	14	*/
	15
	16	#define pr_fmt(fmt) "kexec_elf: " fmt
	17
	18	#include <linux/elf.h>
	19	#include <linux/kexec.h>
	20	#include <linux/module.h>
	21	#include <linux/slab.h>
	22	#include <linux/types.h>
	23
175fca3b SS	24	static inline bool elf_is_elf_file(const struct elfhdr *ehdr)
	25	{
	26	return memcmp(ehdr->e_ident, ELFMAG, SELFMAG) == 0;
	27	}
	28
	29	static uint64_t elf64_to_cpu(const struct elfhdr *ehdr, uint64_t value)
	30	{
	31	if (ehdr->e_ident[EI_DATA] == ELFDATA2LSB)
	32	value = le64_to_cpu(value);
	33	else if (ehdr->e_ident[EI_DATA] == ELFDATA2MSB)
	34	value = be64_to_cpu(value);
	35
	36	return value;
	37	}
	38
d34e0ad3	39	static uint32_t elf32_to_cpu(const struct elfhdr *ehdr, uint32_t value)
175fca3b SS	40	{
175fca3b SS	41	if (ehdr->e_ident[EI_DATA] == ELFDATA2LSB)
d34e0ad3	42	value = le32_to_cpu(value);
175fca3b	43	else if (ehdr->e_ident[EI_DATA] == ELFDATA2MSB)
d34e0ad3	44	value = be32_to_cpu(value);
175fca3b SS	45
	46	return value;
	47	}
	48
d34e0ad3	49	static uint16_t elf16_to_cpu(const struct elfhdr *ehdr, uint16_t value)
175fca3b SS	50	{
175fca3b SS	51	if (ehdr->e_ident[EI_DATA] == ELFDATA2LSB)
d34e0ad3	52	value = le16_to_cpu(value);
175fca3b	53	else if (ehdr->e_ident[EI_DATA] == ELFDATA2MSB)
d34e0ad3	54	value = be16_to_cpu(value);
175fca3b SS	55
	56	return value;
	57	}
	58
	59	/**
	60	* elf_is_ehdr_sane - check that it is safe to use the ELF header
	61	* @buf_len: size of the buffer in which the ELF file is loaded.
	62	*/
	63	static bool elf_is_ehdr_sane(const struct elfhdr *ehdr, size_t buf_len)
	64	{
	65	if (ehdr->e_phnum > 0 && ehdr->e_phentsize != sizeof(struct elf_phdr)) {
	66	pr_debug("Bad program header size.\n");
	67	return false;
	68	} else if (ehdr->e_shnum > 0 &&
	69	ehdr->e_shentsize != sizeof(struct elf_shdr)) {
	70	pr_debug("Bad section header size.\n");
	71	return false;
	72	} else if (ehdr->e_ident[EI_VERSION] != EV_CURRENT \|\|
	73	ehdr->e_version != EV_CURRENT) {
	74	pr_debug("Unknown ELF version.\n");
	75	return false;
	76	}
	77
	78	if (ehdr->e_phoff > 0 && ehdr->e_phnum > 0) {
	79	size_t phdr_size;
	80
	81	/*
	82	* e_phnum is at most 65535 so calculating the size of the
	83	* program header cannot overflow.
	84	*/
	85	phdr_size = sizeof(struct elf_phdr) * ehdr->e_phnum;
	86
	87	/* Sanity check the program header table location. */
	88	if (ehdr->e_phoff + phdr_size < ehdr->e_phoff) {
	89	pr_debug("Program headers at invalid location.\n");
	90	return false;
	91	} else if (ehdr->e_phoff + phdr_size > buf_len) {
	92	pr_debug("Program headers truncated.\n");
	93	return false;
	94	}
	95	}
	96
	97	if (ehdr->e_shoff > 0 && ehdr->e_shnum > 0) {
	98	size_t shdr_size;
	99
	100	/*
	101	* e_shnum is at most 65536 so calculating
	102	* the size of the section header cannot overflow.
	103	*/
	104	shdr_size = sizeof(struct elf_shdr) * ehdr->e_shnum;
	105
	106	/* Sanity check the section header table location. */
	107	if (ehdr->e_shoff + shdr_size < ehdr->e_shoff) {
	108	pr_debug("Section headers at invalid location.\n");
	109	return false;
	110	} else if (ehdr->e_shoff + shdr_size > buf_len) {
	111	pr_debug("Section headers truncated.\n");
	112	return false;
	113	}
	114	}
	115
	116	return true;
	117	}
	118
119	static int elf_read_ehdr(const char buf, size_t len, struct elfhdr ehdr)
120	{
121	struct elfhdr *buf_ehdr;
122
123	if (len < sizeof(*buf_ehdr)) {
124	pr_debug("Buffer is too small to hold ELF header.\n");
125	return -ENOEXEC;
126	}
127
128	memset(ehdr, 0, sizeof(*ehdr));
129	memcpy(ehdr->e_ident, buf, sizeof(ehdr->e_ident));
130	if (!elf_is_elf_file(ehdr)) {
131	pr_debug("No ELF header magic.\n");
132	return -ENOEXEC;
133	}
134
135	if (ehdr->e_ident[EI_CLASS] != ELF_CLASS) {
136	pr_debug("Not a supported ELF class.\n");
137	return -ENOEXEC;
138	} else if (ehdr->e_ident[EI_DATA] != ELFDATA2LSB &&
139	ehdr->e_ident[EI_DATA] != ELFDATA2MSB) {
140	pr_debug("Not a supported ELF data format.\n");
141	return -ENOEXEC;
142	}
143
144	buf_ehdr = (struct elfhdr *) buf;
145	if (elf16_to_cpu(ehdr, buf_ehdr->e_ehsize) != sizeof(*buf_ehdr)) {
146	pr_debug("Bad ELF header size.\n");
147	return -ENOEXEC;
148	}
149
150	ehdr->e_type = elf16_to_cpu(ehdr, buf_ehdr->e_type);
151	ehdr->e_machine = elf16_to_cpu(ehdr, buf_ehdr->e_machine);
152	ehdr->e_version = elf32_to_cpu(ehdr, buf_ehdr->e_version);
175fca3b SS	153	ehdr->e_flags = elf32_to_cpu(ehdr, buf_ehdr->e_flags);
	154	ehdr->e_phentsize = elf16_to_cpu(ehdr, buf_ehdr->e_phentsize);
	155	ehdr->e_phnum = elf16_to_cpu(ehdr, buf_ehdr->e_phnum);
	156	ehdr->e_shentsize = elf16_to_cpu(ehdr, buf_ehdr->e_shentsize);
	157	ehdr->e_shnum = elf16_to_cpu(ehdr, buf_ehdr->e_shnum);
	158	ehdr->e_shstrndx = elf16_to_cpu(ehdr, buf_ehdr->e_shstrndx);
	159
ea46a13e SS	160	switch (ehdr->e_ident[EI_CLASS]) {
	161	case ELFCLASS64:
	162	ehdr->e_entry = elf64_to_cpu(ehdr, buf_ehdr->e_entry);
	163	ehdr->e_phoff = elf64_to_cpu(ehdr, buf_ehdr->e_phoff);
	164	ehdr->e_shoff = elf64_to_cpu(ehdr, buf_ehdr->e_shoff);
	165	break;
	166
	167	case ELFCLASS32:
	168	ehdr->e_entry = elf32_to_cpu(ehdr, buf_ehdr->e_entry);
	169	ehdr->e_phoff = elf32_to_cpu(ehdr, buf_ehdr->e_phoff);
	170	ehdr->e_shoff = elf32_to_cpu(ehdr, buf_ehdr->e_shoff);
	171	break;
	172
	173	default:
	174	pr_debug("Unknown ELF class.\n");
	175	return -EINVAL;
	176	}
	177
175fca3b SS	178	return elf_is_ehdr_sane(ehdr, len) ? 0 : -ENOEXEC;
	179	}
	180
	181	/**
	182	* elf_is_phdr_sane - check that it is safe to use the program header
	183	* @buf_len: size of the buffer in which the ELF file is loaded.
	184	*/
	185	static bool elf_is_phdr_sane(const struct elf_phdr *phdr, size_t buf_len)
	186	{
	187
	188	if (phdr->p_offset + phdr->p_filesz < phdr->p_offset) {
	189	pr_debug("ELF segment location wraps around.\n");
	190	return false;
	191	} else if (phdr->p_offset + phdr->p_filesz > buf_len) {
	192	pr_debug("ELF segment not in file.\n");
	193	return false;
	194	} else if (phdr->p_paddr + phdr->p_memsz < phdr->p_paddr) {
	195	pr_debug("ELF segment address wraps around.\n");
	196	return false;
	197	}
	198
	199	return true;
	200	}
	201
	202	static int elf_read_phdr(const char *buf, size_t len,
	203	struct kexec_elf_info *elf_info,
	204	int idx)
	205	{
	206	/* Override the const in proghdrs, we are the ones doing the loading. */
	207	struct elf_phdr phdr = (struct elf_phdr ) &elf_info->proghdrs[idx];
ea46a13e	208	const struct elfhdr *ehdr = elf_info->ehdr;
175fca3b SS	209	const char *pbuf;
	210	struct elf_phdr *buf_phdr;
	211
	212	pbuf = buf + elf_info->ehdr->e_phoff + (idx * sizeof(*buf_phdr));
	213	buf_phdr = (struct elf_phdr *) pbuf;
	214
	215	phdr->p_type = elf32_to_cpu(elf_info->ehdr, buf_phdr->p_type);
175fca3b SS	216	phdr->p_flags = elf32_to_cpu(elf_info->ehdr, buf_phdr->p_flags);
175fca3b SS	217
ea46a13e SS	218	switch (ehdr->e_ident[EI_CLASS]) {
	219	case ELFCLASS64:
	220	phdr->p_offset = elf64_to_cpu(ehdr, buf_phdr->p_offset);
	221	phdr->p_paddr = elf64_to_cpu(ehdr, buf_phdr->p_paddr);
	222	phdr->p_vaddr = elf64_to_cpu(ehdr, buf_phdr->p_vaddr);
	223	phdr->p_filesz = elf64_to_cpu(ehdr, buf_phdr->p_filesz);
	224	phdr->p_memsz = elf64_to_cpu(ehdr, buf_phdr->p_memsz);
	225	phdr->p_align = elf64_to_cpu(ehdr, buf_phdr->p_align);
	226	break;
	227
	228	case ELFCLASS32:
	229	phdr->p_offset = elf32_to_cpu(ehdr, buf_phdr->p_offset);
	230	phdr->p_paddr = elf32_to_cpu(ehdr, buf_phdr->p_paddr);
	231	phdr->p_vaddr = elf32_to_cpu(ehdr, buf_phdr->p_vaddr);
	232	phdr->p_filesz = elf32_to_cpu(ehdr, buf_phdr->p_filesz);
	233	phdr->p_memsz = elf32_to_cpu(ehdr, buf_phdr->p_memsz);
	234	phdr->p_align = elf32_to_cpu(ehdr, buf_phdr->p_align);
	235	break;
	236
	237	default:
	238	pr_debug("Unknown ELF class.\n");
	239	return -EINVAL;
	240	}
175fca3b SS	241
	242	return elf_is_phdr_sane(phdr, len) ? 0 : -ENOEXEC;
	243	}
	244
	245	/**
	246	* elf_read_phdrs - read the program headers from the buffer
	247	*
	248	* This function assumes that the program header table was checked for sanity.
	249	* Use elf_is_ehdr_sane() if it wasn't.
	250	*/
	251	static int elf_read_phdrs(const char *buf, size_t len,
	252	struct kexec_elf_info *elf_info)
	253	{
	254	size_t phdr_size, i;
	255	const struct elfhdr *ehdr = elf_info->ehdr;
	256
	257	/*
	258	* e_phnum is at most 65535 so calculating the size of the
	259	* program header cannot overflow.
	260	*/
	261	phdr_size = sizeof(struct elf_phdr) * ehdr->e_phnum;
	262
	263	elf_info->proghdrs = kzalloc(phdr_size, GFP_KERNEL);
	264	if (!elf_info->proghdrs)
	265	return -ENOMEM;
	266
	267	for (i = 0; i < ehdr->e_phnum; i++) {
	268	int ret;
	269
	270	ret = elf_read_phdr(buf, len, elf_info, i);
	271	if (ret) {
	272	kfree(elf_info->proghdrs);
	273	elf_info->proghdrs = NULL;
	274	return ret;
	275	}
	276	}
	277
	278	return 0;
	279	}
	280
175fca3b SS	281	/**
	282	* elf_read_from_buffer - read ELF file and sets up ELF header and ELF info
	283	* @buf: Buffer to read ELF file from.
	284	* @len: Size of @buf.
	285	* @ehdr: Pointer to existing struct which will be populated.
	286	* @elf_info: Pointer to existing struct which will be populated.
	287	*
	288	* This function allows reading ELF files with different byte order than
	289	* the kernel, byte-swapping the fields as needed.
	290	*
	291	* Return:
	292	* On success returns 0, and the caller should call
	293	* kexec_free_elf_info(elf_info) to free the memory allocated for the section
	294	* and program headers.
	295	*/
	296	static int elf_read_from_buffer(const char *buf, size_t len,
	297	struct elfhdr *ehdr,
	298	struct kexec_elf_info *elf_info)
	299	{
	300	int ret;
	301
	302	ret = elf_read_ehdr(buf, len, ehdr);
	303	if (ret)
	304	return ret;
	305
	306	elf_info->buffer = buf;
	307	elf_info->ehdr = ehdr;
	308	if (ehdr->e_phoff > 0 && ehdr->e_phnum > 0) {
	309	ret = elf_read_phdrs(buf, len, elf_info);
	310	if (ret)
	311	return ret;
	312	}
175fca3b SS	313	return 0;
	314	}
	315
	316	/**
	317	* kexec_free_elf_info - free memory allocated by elf_read_from_buffer
	318	*/
	319	void kexec_free_elf_info(struct kexec_elf_info *elf_info)
	320	{
	321	kfree(elf_info->proghdrs);
175fca3b SS	322	memset(elf_info, 0, sizeof(*elf_info));
	323	}
	324	/**
	325	* kexec_build_elf_info - read ELF executable and check that we can use it
	326	*/
	327	int kexec_build_elf_info(const char buf, size_t len, struct elfhdr ehdr,
	328	struct kexec_elf_info *elf_info)
	329	{
	330	int i;
	331	int ret;
	332
	333	ret = elf_read_from_buffer(buf, len, ehdr, elf_info);
	334	if (ret)
	335	return ret;
	336
	337	/* Big endian vmlinux has type ET_DYN. */
	338	if (ehdr->e_type != ET_EXEC && ehdr->e_type != ET_DYN) {
	339	pr_err("Not an ELF executable.\n");
	340	goto error;
	341	} else if (!elf_info->proghdrs) {
	342	pr_err("No ELF program header.\n");
	343	goto error;
	344	}
	345
	346	for (i = 0; i < ehdr->e_phnum; i++) {
	347	/*
	348	* Kexec does not support loading interpreters.
	349	* In addition this check keeps us from attempting
	350	* to kexec ordinay executables.
	351	*/
	352	if (elf_info->proghdrs[i].p_type == PT_INTERP) {
	353	pr_err("Requires an ELF interpreter.\n");
	354	goto error;
	355	}
	356	}
	357
	358	return 0;
	359	error:
	360	kexec_free_elf_info(elf_info);
	361	return -ENOEXEC;
	362	}
	363
	364
	365	int kexec_elf_probe(const char *buf, unsigned long len)
	366	{
	367	struct elfhdr ehdr;
	368	struct kexec_elf_info elf_info;
	369	int ret;
	370
	371	ret = kexec_build_elf_info(buf, len, &ehdr, &elf_info);
	372	if (ret)
	373	return ret;
	374
	375	kexec_free_elf_info(&elf_info);
	376
	377	return elf_check_arch(&ehdr) ? 0 : -ENOEXEC;
	378	}
	379
	380	/**
	381	* kexec_elf_load - load ELF executable image
	382	* @lowest_load_addr: On return, will be the address where the first PT_LOAD
	383	* section will be loaded in memory.
	384	*
	385	* Return:
386	* 0 on success, negative value on failure.
387	*/
388	int kexec_elf_load(struct kimage image, struct elfhdr ehdr,
389	struct kexec_elf_info *elf_info,
390	struct kexec_buf *kbuf,
391	unsigned long *lowest_load_addr)
392	{
571ceb7d	393	unsigned long lowest_addr = UINT_MAX;
175fca3b SS	394	int ret;
	395	size_t i;
	396
	397	/* Read in the PT_LOAD segments. */
	398	for (i = 0; i < ehdr->e_phnum; i++) {
	399	unsigned long load_addr;
	400	size_t size;
	401	const struct elf_phdr *phdr;
	402
	403	phdr = &elf_info->proghdrs[i];
	404	if (phdr->p_type != PT_LOAD)
	405	continue;
	406
	407	size = phdr->p_filesz;
	408	if (size > phdr->p_memsz)
	409	size = phdr->p_memsz;
	410
	411	kbuf->buffer = (void *) elf_info->buffer + phdr->p_offset;
	412	kbuf->bufsz = size;
	413	kbuf->memsz = phdr->p_memsz;
	414	kbuf->buf_align = phdr->p_align;
571ceb7d	415	kbuf->buf_min = phdr->p_paddr;
175fca3b SS	416	kbuf->mem = KEXEC_BUF_MEM_UNKNOWN;
	417	ret = kexec_add_buffer(kbuf);
	418	if (ret)
	419	goto out;
	420	load_addr = kbuf->mem;
	421
	422	if (load_addr < lowest_addr)
	423	lowest_addr = load_addr;
	424	}
	425
175fca3b SS	426	*lowest_load_addr = lowest_addr;
	427	ret = 0;
	428	out:
	429	return ret;
	430	}