Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20191111' into...

[qemu.git] / include / hw / elf_ops.h

diff --git a/include/hw/elf_ops.h b/include/hw/elf_ops.h
index 690f9238c8ccce27bb6635e85d4bed6b47b2c784..e07d276df78b18b8d7ee56ea1a7bda79ec9ae3ee 100644 (file)
--- a/include/hw/elf_ops.h
+++ b/include/hw/elf_ops.h
@@ -323,8 +323,9 @@ static int glue(load_elf, SZ)(const char *name, int fd,
     struct elfhdr ehdr;
     struct elf_phdr *phdr = NULL, *ph;
     int size, i, total_size;
     struct elfhdr ehdr;
     struct elf_phdr *phdr = NULL, *ph;
     int size, i, total_size;

-    elf_word mem_size, file_size;
+    elf_word mem_size, file_size, data_offset;

     uint64_t addr, low = (uint64_t)-1, high = 0;
     uint64_t addr, low = (uint64_t)-1, high = 0;

+    GMappedFile *mapped_file = NULL;

     uint8_t *data = NULL;
     char label[128];
     int ret = ELF_LOAD_FAILED;
     uint8_t *data = NULL;
     char label[128];
     int ret = ELF_LOAD_FAILED;


@@ -409,20 +410,32 @@ static int glue(load_elf, SZ)(const char *name, int fd,
         }
     }
 
         }
     }
 

+    /*
+     * Since we want to be able to modify the mapped buffer, we set the
+     * 'writeble' parameter to 'true'. Modifications to the buffer are not
+     * written back to the file.
+     */
+    mapped_file = g_mapped_file_new_from_fd(fd, true, NULL);
+    if (!mapped_file) {
+        goto fail;
+    }
+

     total_size = 0;
     for(i = 0; i < ehdr.e_phnum; i++) {
         ph = &phdr[i];
         if (ph->p_type == PT_LOAD) {
             mem_size = ph->p_memsz; /* Size of the ROM */
             file_size = ph->p_filesz; /* Size of the allocated data */
     total_size = 0;
     for(i = 0; i < ehdr.e_phnum; i++) {
         ph = &phdr[i];
         if (ph->p_type == PT_LOAD) {
             mem_size = ph->p_memsz; /* Size of the ROM */
             file_size = ph->p_filesz; /* Size of the allocated data */

-            data = g_malloc0(file_size);
-            if (ph->p_filesz > 0) {
-                if (lseek(fd, ph->p_offset, SEEK_SET) < 0) {
-                    goto fail;
-                }
-                if (read(fd, data, file_size) != file_size) {
+            data_offset = ph->p_offset; /* Offset where the data is located */
+
+            if (file_size > 0) {
+                if (g_mapped_file_get_length(mapped_file) <
+                    file_size + data_offset) {

                     goto fail;
                 }
                     goto fail;
                 }

+
+                data = (uint8_t *)g_mapped_file_get_contents(mapped_file);
+                data += data_offset;

             }
 
             /* The ELF spec is somewhat vague about the purpose of the
             }
 
             /* The ELF spec is somewhat vague about the purpose of the


@@ -472,6 +485,11 @@ static int glue(load_elf, SZ)(const char *name, int fd,
                 }
             }
 
                 }
             }
 

+            if (mem_size > INT_MAX - total_size) {
+                ret = ELF_LOAD_TOO_BIG;
+                goto fail;
+            }
+

             /* address_offset is hack for kernel images that are
                linked at the wrong physical address.  */
             if (translate_fn) {
             /* address_offset is hack for kernel images that are
                linked at the wrong physical address.  */
             if (translate_fn) {


@@ -513,25 +531,25 @@ static int glue(load_elf, SZ)(const char *name, int fd,
                 *pentry = ehdr.e_entry - ph->p_vaddr + ph->p_paddr;
             }
 
                 *pentry = ehdr.e_entry - ph->p_vaddr + ph->p_paddr;
             }
 

-            if (mem_size == 0) {
-                /* Some ELF files really do have segments of zero size;
-                 * just ignore them rather than trying to create empty
-                 * ROM blobs, because the zero-length blob can falsely
-                 * trigger the overlapping-ROM-blobs check.
-                 */
-                g_free(data);
-            } else {
+            /* Some ELF files really do have segments of zero size;
+             * just ignore them rather than trying to create empty
+             * ROM blobs, because the zero-length blob can falsely
+             * trigger the overlapping-ROM-blobs check.
+             */
+            if (mem_size != 0) {

                 if (load_rom) {
                     snprintf(label, sizeof(label), "phdr #%d: %s", i, name);
 
                 if (load_rom) {
                     snprintf(label, sizeof(label), "phdr #%d: %s", i, name);
 

-                    /* rom_add_elf_program() seize the ownership of 'data' */
-                    rom_add_elf_program(label, data, file_size, mem_size,
-                                        addr, as);
+                    /*
+                     * rom_add_elf_program() takes its own reference to
+                     * 'mapped_file'.
+                     */
+                    rom_add_elf_program(label, mapped_file, data, file_size,
+                                        mem_size, addr, as);

                 } else {
                     address_space_write(as ? as : &address_space_memory,
                                         addr, MEMTXATTRS_UNSPECIFIED,
                                         data, file_size);
                 } else {
                     address_space_write(as ? as : &address_space_memory,
                                         addr, MEMTXATTRS_UNSPECIFIED,
                                         data, file_size);

-                    g_free(data);

                 }
             }
 
                 }
             }
 


@@ -547,14 +565,16 @@ static int glue(load_elf, SZ)(const char *name, int fd,
             struct elf_note *nhdr = NULL;
 
             file_size = ph->p_filesz; /* Size of the range of ELF notes */
             struct elf_note *nhdr = NULL;
 
             file_size = ph->p_filesz; /* Size of the range of ELF notes */

-            data = g_malloc0(file_size);
-            if (ph->p_filesz > 0) {
-                if (lseek(fd, ph->p_offset, SEEK_SET) < 0) {
-                    goto fail;
-                }
-                if (read(fd, data, file_size) != file_size) {
+            data_offset = ph->p_offset; /* Offset where the notes are located */
+
+            if (file_size > 0) {
+                if (g_mapped_file_get_length(mapped_file) <
+                    file_size + data_offset) {

                     goto fail;
                 }
                     goto fail;
                 }

+
+                data = (uint8_t *)g_mapped_file_get_contents(mapped_file);
+                data += data_offset;

             }
 
             /*
             }
 
             /*


@@ -570,19 +590,17 @@ static int glue(load_elf, SZ)(const char *name, int fd,
                     sizeof(struct elf_note) == sizeof(struct elf64_note);
                 elf_note_fn((void *)nhdr, (void *)&ph->p_align, is64);
             }
                     sizeof(struct elf_note) == sizeof(struct elf64_note);
                 elf_note_fn((void *)nhdr, (void *)&ph->p_align, is64);
             }

-            g_free(data);

             data = NULL;
         }
     }
 
             data = NULL;
         }
     }
 

-    g_free(phdr);

     if (lowaddr)
         *lowaddr = (uint64_t)(elf_sword)low;
     if (highaddr)
         *highaddr = (uint64_t)(elf_sword)high;
     if (lowaddr)
         *lowaddr = (uint64_t)(elf_sword)low;
     if (highaddr)
         *highaddr = (uint64_t)(elf_sword)high;

-    return total_size;
+    ret = total_size;

  fail:
  fail:

-    g_free(data);
+    g_mapped_file_unref(mapped_file);

     g_free(phdr);
     return ret;
 }
     g_free(phdr);
     return ret;
 }