dcavalca / rpms / grub2

Forked from rpms/grub2 3 years ago
Clone

Blame SOURCES/0224-Re-work-some-intricacies-of-PE-loading.patch

27a4da
From c4b5674831842e954f261a99c260866ea69361c9 Mon Sep 17 00:00:00 2001
27a4da
From: Peter Jones <pjones@redhat.com>
27a4da
Date: Thu, 9 Jun 2016 12:22:29 -0400
27a4da
Subject: [PATCH 224/260] Re-work some intricacies of PE loading.
27a4da
27a4da
The PE spec is not a well written document, and awesomely every place
27a4da
where there's an ambiguous way to read something, Windows' bootmgfw.efi
27a4da
takes a different read than either of them.
27a4da
---
27a4da
 grub-core/loader/efi/chainloader.c | 156 +++++++++++++++++++++++++++++--------
27a4da
 include/grub/efi/pe32.h            |  32 +++++++-
27a4da
 2 files changed, 152 insertions(+), 36 deletions(-)
27a4da
27a4da
diff --git a/grub-core/loader/efi/chainloader.c b/grub-core/loader/efi/chainloader.c
27a4da
index aee8e6bec..4b77a7d5a 100644
27a4da
--- a/grub-core/loader/efi/chainloader.c
27a4da
+++ b/grub-core/loader/efi/chainloader.c
27a4da
@@ -301,7 +301,7 @@ image_is_64_bit (grub_pe_header_t *pe_hdr)
27a4da
   return 0;
27a4da
 }
27a4da
 
27a4da
-static const grub_uint16_t machine_type =
27a4da
+static const grub_uint16_t machine_type __attribute__((__unused__)) =
27a4da
 #if defined(__x86_64__)
27a4da
   GRUB_PE32_MACHINE_X86_64;
27a4da
 #elif defined(__aarch64__)
27a4da
@@ -367,10 +367,10 @@ relocate_coff (pe_coff_loader_image_context_t *context,
27a4da
 
27a4da
   reloc_base = image_address (orig, size, section->raw_data_offset);
27a4da
   reloc_base_end = image_address (orig, size, section->raw_data_offset
27a4da
-				  + section->virtual_size - 1);
27a4da
+				  + section->virtual_size);
27a4da
 
27a4da
-  grub_dprintf ("chain", "reloc_base %p reloc_base_end %p\n", reloc_base,
27a4da
-		reloc_base_end);
27a4da
+  grub_dprintf ("chain", "relocate_coff(): reloc_base %p reloc_base_end %p\n",
27a4da
+		reloc_base, reloc_base_end);
27a4da
 
27a4da
   if (!reloc_base && !reloc_base_end)
27a4da
     return GRUB_EFI_SUCCESS;
27a4da
@@ -507,12 +507,13 @@ handle_image (void *data, grub_efi_uint32_t datasize)
27a4da
   grub_efi_status_t efi_status;
27a4da
   char *buffer = NULL;
27a4da
   char *buffer_aligned = NULL;
27a4da
-  grub_efi_uint32_t i, size;
27a4da
+  grub_efi_uint32_t i;
27a4da
   struct grub_pe32_section_table *section;
27a4da
   char *base, *end;
27a4da
   pe_coff_loader_image_context_t context;
27a4da
   grub_uint32_t section_alignment;
27a4da
   grub_uint32_t buffer_size;
27a4da
+  int found_entry_point = 0;
27a4da
 
27a4da
   b = grub_efi_system_table->boot_services;
27a4da
 
27a4da
@@ -526,8 +527,28 @@ handle_image (void *data, grub_efi_uint32_t datasize)
27a4da
       goto error_exit;
27a4da
     }
27a4da
 
27a4da
+  /*
27a4da
+   * The spec says, uselessly, of SectionAlignment:
27a4da
+   * =====
27a4da
+   * The alignment (in bytes) of sections when they are loaded into
27a4da
+   * memory. It must be greater than or equal to FileAlignment. The
27a4da
+   * default is the page size for the architecture.
27a4da
+   * =====
27a4da
+   * Which doesn't tell you whose responsibility it is to enforce the
27a4da
+   * "default", or when.  It implies that the value in the field must
27a4da
+   * be > FileAlignment (also poorly defined), but it appears visual
27a4da
+   * studio will happily write 512 for FileAlignment (its default) and
27a4da
+   * 0 for SectionAlignment, intending to imply PAGE_SIZE.
27a4da
+   *
27a4da
+   * We only support one page size, so if it's zero, nerf it to 4096.
27a4da
+   */
27a4da
   section_alignment = context.section_alignment;
27a4da
+  if (section_alignment == 0)
27a4da
+    section_alignment = 4096;
27a4da
+
27a4da
   buffer_size = context.image_size + section_alignment;
27a4da
+  grub_dprintf ("chain", "image size is %08lx, datasize is %08x\n",
27a4da
+	       context.image_size, datasize);
27a4da
 
27a4da
   efi_status = efi_call_3 (b->allocate_pool, GRUB_EFI_LOADER_DATA,
27a4da
 			   buffer_size, &buffer);
27a4da
@@ -539,7 +560,6 @@ handle_image (void *data, grub_efi_uint32_t datasize)
27a4da
     }
27a4da
 
27a4da
   buffer_aligned = (char *)ALIGN_UP ((grub_addr_t)buffer, section_alignment);
27a4da
-
27a4da
   if (!buffer_aligned)
27a4da
     {
27a4da
       grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("out of memory"));
27a4da
@@ -548,27 +568,62 @@ handle_image (void *data, grub_efi_uint32_t datasize)
27a4da
 
27a4da
   grub_memcpy (buffer_aligned, data, context.size_of_headers);
27a4da
 
27a4da
+  entry_point = image_address (buffer_aligned, context.image_size,
27a4da
+			       context.entry_point);
27a4da
+
27a4da
+  grub_dprintf ("chain", "entry_point: %p\n", entry_point);
27a4da
+  if (!entry_point)
27a4da
+    {
27a4da
+      grub_error (GRUB_ERR_BAD_ARGUMENT, "invalid entry point");
27a4da
+      goto error_exit;
27a4da
+    }
27a4da
+
27a4da
   char *reloc_base, *reloc_base_end;
27a4da
-  reloc_base = image_address (buffer_aligned, datasize,
27a4da
+  grub_dprintf ("chain", "reloc_dir: %p reloc_size: 0x%08x\n",
27a4da
+		(void *)(unsigned long long)context.reloc_dir->rva,
27a4da
+		context.reloc_dir->size);
27a4da
+  reloc_base = image_address (buffer_aligned, context.image_size,
27a4da
 			      context.reloc_dir->rva);
27a4da
   /* RelocBaseEnd here is the address of the last byte of the table */
27a4da
-  reloc_base_end = image_address (buffer_aligned, datasize,
27a4da
+  reloc_base_end = image_address (buffer_aligned, context.image_size,
27a4da
 				  context.reloc_dir->rva
27a4da
 				  + context.reloc_dir->size - 1);
27a4da
+  grub_dprintf ("chain", "reloc_base: %p reloc_base_end: %p\n",
27a4da
+		reloc_base, reloc_base_end);
27a4da
+
27a4da
   struct grub_pe32_section_table *reloc_section = NULL;
27a4da
 
27a4da
   section = context.first_section;
27a4da
   for (i = 0; i < context.number_of_sections; i++, section++)
27a4da
     {
27a4da
-      size = section->virtual_size;
27a4da
-      if (size > section->raw_data_size)
27a4da
-        size = section->raw_data_size;
27a4da
+      char name[9];
27a4da
 
27a4da
       base = image_address (buffer_aligned, context.image_size,
27a4da
 			    section->virtual_address);
27a4da
       end = image_address (buffer_aligned, context.image_size,
27a4da
-			   section->virtual_address + size - 1);
27a4da
+			   section->virtual_address + section->virtual_size -1);
27a4da
 
27a4da
+      grub_strncpy(name, section->name, 9);
27a4da
+      name[8] = '\0';
27a4da
+      grub_dprintf ("chain", "Section %d \"%s\" at %p..%p\n", i,
27a4da
+		   name, base, end);
27a4da
+
27a4da
+      if (end < base)
27a4da
+	{
27a4da
+	  grub_dprintf ("chain", " base is %p but end is %p... bad.\n",
27a4da
+		       base, end);
27a4da
+	  grub_error (GRUB_ERR_BAD_ARGUMENT,
27a4da
+		      "Image has invalid negative size");
27a4da
+	  goto error_exit;
27a4da
+	}
27a4da
+
27a4da
+      if (section->virtual_address <= context.entry_point &&
27a4da
+	  (section->virtual_address + section->raw_data_size - 1)
27a4da
+	  > context.entry_point)
27a4da
+	{
27a4da
+	  found_entry_point++;
27a4da
+	  grub_dprintf ("chain", " section contains entry point\n");
27a4da
+	}
27a4da
 
27a4da
       /* We do want to process .reloc, but it's often marked
27a4da
        * discardable, so we don't want to memcpy it. */
27a4da
@@ -587,21 +642,46 @@ handle_image (void *data, grub_efi_uint32_t datasize)
27a4da
 	  if (section->raw_data_size && section->virtual_size &&
27a4da
 	      base && end && reloc_base == base && reloc_base_end == end)
27a4da
 	    {
27a4da
+	      grub_dprintf ("chain", " section is relocation section\n");
27a4da
 	      reloc_section = section;
27a4da
 	    }
27a4da
+	  else
27a4da
+	    {
27a4da
+	      grub_dprintf ("chain", " section is not reloc section?\n");
27a4da
+	      grub_dprintf ("chain", " rds: 0x%08x, vs: %08x\n",
27a4da
+			    section->raw_data_size, section->virtual_size);
27a4da
+	      grub_dprintf ("chain", " base: %p end: %p\n", base, end);
27a4da
+	      grub_dprintf ("chain", " reloc_base: %p reloc_base_end: %p\n",
27a4da
+			    reloc_base, reloc_base_end);
27a4da
+	    }
27a4da
 	}
27a4da
 
27a4da
-      if (section->characteristics && GRUB_PE32_SCN_MEM_DISCARDABLE)
27a4da
-	continue;
27a4da
+      grub_dprintf ("chain", " Section characteristics are %08x\n",
27a4da
+		   section->characteristics);
27a4da
+      grub_dprintf ("chain", " Section virtual size: %08x\n",
27a4da
+		   section->virtual_size);
27a4da
+      grub_dprintf ("chain", " Section raw_data size: %08x\n",
27a4da
+		   section->raw_data_size);
27a4da
+      if (section->characteristics & GRUB_PE32_SCN_MEM_DISCARDABLE)
27a4da
+	{
27a4da
+	  grub_dprintf ("chain", " Discarding section\n");
27a4da
+	  continue;
27a4da
+	}
27a4da
 
27a4da
       if (!base || !end)
27a4da
         {
27a4da
+	  grub_dprintf ("chain", " section is invalid\n");
27a4da
           grub_error (GRUB_ERR_BAD_ARGUMENT, "Invalid section size");
27a4da
           goto error_exit;
27a4da
         }
27a4da
 
27a4da
-      if (section->virtual_address < context.size_of_headers ||
27a4da
-	  section->raw_data_offset < context.size_of_headers)
27a4da
+      if (section->characteristics & GRUB_PE32_SCN_CNT_UNINITIALIZED_DATA)
27a4da
+	{
27a4da
+	  if (section->raw_data_size != 0)
27a4da
+	    grub_dprintf ("chain", " UNINITIALIZED_DATA section has data?\n");
27a4da
+	}
27a4da
+      else if (section->virtual_address < context.size_of_headers ||
27a4da
+	       section->raw_data_offset < context.size_of_headers)
27a4da
 	{
27a4da
 	  grub_error (GRUB_ERR_BAD_ARGUMENT,
27a4da
 		      "Section %d is inside image headers", i);
27a4da
@@ -609,13 +689,24 @@ handle_image (void *data, grub_efi_uint32_t datasize)
27a4da
 	}
27a4da
 
27a4da
       if (section->raw_data_size > 0)
27a4da
-        grub_memcpy (base, (grub_efi_uint8_t*)data + section->raw_data_offset,
27a4da
-		     size);
27a4da
+	{
27a4da
+	  grub_dprintf ("chain", " copying 0x%08x bytes to %p\n",
27a4da
+			section->raw_data_size, base);
27a4da
+	  grub_memcpy (base,
27a4da
+		       (grub_efi_uint8_t*)data + section->raw_data_offset,
27a4da
+		       section->raw_data_size);
27a4da
+	}
27a4da
 
27a4da
-      if (size < section->virtual_size)
27a4da
-        grub_memset (base + size, 0, section->virtual_size - size);
27a4da
+      if (section->raw_data_size < section->virtual_size)
27a4da
+	{
27a4da
+	  grub_dprintf ("chain", " padding with 0x%08x bytes at %p\n",
27a4da
+			section->virtual_size - section->raw_data_size,
27a4da
+			base + section->raw_data_size);
27a4da
+	  grub_memset (base + section->raw_data_size, 0,
27a4da
+		       section->virtual_size - section->raw_data_size);
27a4da
+	}
27a4da
 
27a4da
-      grub_dprintf ("chain", "copied section %s\n", section->name);
27a4da
+      grub_dprintf ("chain", " finished section %s\n", name);
27a4da
     }
27a4da
 
27a4da
   /* 5 == EFI_IMAGE_DIRECTORY_ENTRY_BASERELOC */
27a4da
@@ -638,12 +729,15 @@ handle_image (void *data, grub_efi_uint32_t datasize)
27a4da
 	}
27a4da
     }
27a4da
 
27a4da
-  entry_point = image_address (buffer_aligned, context.image_size,
27a4da
-			       context.entry_point);
27a4da
-
27a4da
-  if (!entry_point)
27a4da
+  if (!found_entry_point)
27a4da
     {
27a4da
-      grub_error (GRUB_ERR_BAD_ARGUMENT, "invalid entry point");
27a4da
+      grub_error (GRUB_ERR_BAD_ARGUMENT, "entry point is not within sections");
27a4da
+      goto error_exit;
27a4da
+    }
27a4da
+  if (found_entry_point > 1)
27a4da
+    {
27a4da
+      grub_error (GRUB_ERR_BAD_ARGUMENT, "%d sections contain entry point",
27a4da
+		  found_entry_point);
27a4da
       goto error_exit;
27a4da
     }
27a4da
 
27a4da
@@ -661,26 +755,24 @@ handle_image (void *data, grub_efi_uint32_t datasize)
27a4da
   li->load_options_size = cmdline_len;
27a4da
   li->file_path = grub_efi_get_media_file_path (file_path);
27a4da
   li->device_handle = dev_handle;
27a4da
-  if (li->file_path)
27a4da
-    {
27a4da
-      grub_printf ("file path: ");
27a4da
-      grub_efi_print_device_path (li->file_path);
27a4da
-    }
27a4da
-  else
27a4da
+  if (!li->file_path)
27a4da
     {
27a4da
       grub_error (GRUB_ERR_UNKNOWN_DEVICE, "no matching file path found");
27a4da
       goto error_exit;
27a4da
     }
27a4da
 
27a4da
+  grub_dprintf ("chain", "booting via entry point\n");
27a4da
   efi_status = efi_call_2 (entry_point, grub_efi_image_handle,
27a4da
 			   grub_efi_system_table);
27a4da
 
27a4da
+  grub_dprintf ("chain", "entry_point returned %ld\n", efi_status);
27a4da
   grub_memcpy (li, &li_bak, sizeof (grub_efi_loaded_image_t));
27a4da
   efi_status = efi_call_1 (b->free_pool, buffer);
27a4da
 
27a4da
   return 1;
27a4da
 
27a4da
 error_exit:
27a4da
+  grub_dprintf ("chain", "error_exit: grub_errno: %d\n", grub_errno);
27a4da
   if (buffer)
27a4da
       efi_call_1 (b->free_pool, buffer);
27a4da
 
27a4da
diff --git a/include/grub/efi/pe32.h b/include/grub/efi/pe32.h
27a4da
index f79782e1b..8396bde49 100644
27a4da
--- a/include/grub/efi/pe32.h
27a4da
+++ b/include/grub/efi/pe32.h
27a4da
@@ -227,12 +227,18 @@ struct grub_pe32_section_table
27a4da
   grub_uint32_t characteristics;
27a4da
 };
27a4da
 
27a4da
+#define GRUB_PE32_SCN_TYPE_NO_PAD		0x00000008
27a4da
 #define GRUB_PE32_SCN_CNT_CODE			0x00000020
27a4da
 #define GRUB_PE32_SCN_CNT_INITIALIZED_DATA	0x00000040
27a4da
-#define GRUB_PE32_SCN_MEM_DISCARDABLE		0x02000000
27a4da
-#define GRUB_PE32_SCN_MEM_EXECUTE		0x20000000
27a4da
-#define GRUB_PE32_SCN_MEM_READ			0x40000000
27a4da
-#define GRUB_PE32_SCN_MEM_WRITE			0x80000000
27a4da
+#define GRUB_PE32_SCN_CNT_UNINITIALIZED_DATA	0x00000080
27a4da
+#define GRUB_PE32_SCN_LNK_OTHER			0x00000100
27a4da
+#define GRUB_PE32_SCN_LNK_INFO			0x00000200
27a4da
+#define GRUB_PE32_SCN_LNK_REMOVE		0x00000800
27a4da
+#define GRUB_PE32_SCN_LNK_COMDAT		0x00001000
27a4da
+#define GRUB_PE32_SCN_GPREL			0x00008000
27a4da
+#define GRUB_PE32_SCN_MEM_16BIT			0x00020000
27a4da
+#define GRUB_PE32_SCN_MEM_LOCKED		0x00040000
27a4da
+#define GRUB_PE32_SCN_MEM_PRELOAD		0x00080000
27a4da
 
27a4da
 #define GRUB_PE32_SCN_ALIGN_1BYTES		0x00100000
27a4da
 #define GRUB_PE32_SCN_ALIGN_2BYTES		0x00200000
27a4da
@@ -241,10 +247,28 @@ struct grub_pe32_section_table
27a4da
 #define GRUB_PE32_SCN_ALIGN_16BYTES		0x00500000
27a4da
 #define GRUB_PE32_SCN_ALIGN_32BYTES		0x00600000
27a4da
 #define GRUB_PE32_SCN_ALIGN_64BYTES		0x00700000
27a4da
+#define GRUB_PE32_SCN_ALIGN_128BYTES		0x00800000
27a4da
+#define GRUB_PE32_SCN_ALIGN_256BYTES		0x00900000
27a4da
+#define GRUB_PE32_SCN_ALIGN_512BYTES		0x00A00000
27a4da
+#define GRUB_PE32_SCN_ALIGN_1024BYTES		0x00B00000
27a4da
+#define GRUB_PE32_SCN_ALIGN_2048BYTES		0x00C00000
27a4da
+#define GRUB_PE32_SCN_ALIGN_4096BYTES		0x00D00000
27a4da
+#define GRUB_PE32_SCN_ALIGN_8192BYTES		0x00E00000
27a4da
 
27a4da
 #define GRUB_PE32_SCN_ALIGN_SHIFT		20
27a4da
 #define GRUB_PE32_SCN_ALIGN_MASK		7
27a4da
 
27a4da
+#define GRUB_PE32_SCN_LNK_NRELOC_OVFL		0x01000000
27a4da
+#define GRUB_PE32_SCN_MEM_DISCARDABLE		0x02000000
27a4da
+#define GRUB_PE32_SCN_MEM_NOT_CACHED		0x04000000
27a4da
+#define GRUB_PE32_SCN_MEM_NOT_PAGED		0x08000000
27a4da
+#define GRUB_PE32_SCN_MEM_SHARED		0x10000000
27a4da
+#define GRUB_PE32_SCN_MEM_EXECUTE		0x20000000
27a4da
+#define GRUB_PE32_SCN_MEM_READ			0x40000000
27a4da
+#define GRUB_PE32_SCN_MEM_WRITE			0x80000000
27a4da
+
27a4da
+
27a4da
+
27a4da
 #define GRUB_PE32_SIGNATURE_SIZE 4
27a4da
 
27a4da
 struct grub_pe32_header
27a4da
-- 
27a4da
2.13.0
27a4da