The use of sprintf can easily result in buffer overflows as it assumes
that the buffer it writes to is large enough to contain the formatted
string. Thus replace sprintf by snprintf and update its users.
This removes the last user of vsprintf. Thus also remove vsprintf and
its dependencies.
Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Per definition vsprint assumes that the provided buffer it writes to is
large enough to contain the formatted string. As printf uses a fixed
sized buffer (81 bytes) and has no size checks the use of vsprintf can
easily cause buffer overflows. Protect against these buffer overflows by
using vsnprintf instead.
While at it fix a typo in the comment.
Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The zipl boot loaders have their own minimalistic libc implementation.
In it printf and sprintf use vsprintf for string formatting. Per
definition vsprintf assumes that the buffer it writes to is large enough
to contain the formatted string and performs no size checks. This is
problematic for the boot loaders because the buffer they use are often
allocated on the stack. Thus even small changes to the string format can
potentially cause buffer overflows on the stack with the well known
consequences. Protect against such errors by implementing vsnprintf.
Later patches will make use of it.
This implementation of vsnprintf only supports a small subset of format
options defined in the C standard. In particular it allows the
specifiers:
* %s (strings)
* %o (unsigned int octal)
* %u (unsigned int decimal)
* %x (unsigned int hexadecimal)
Integer specifiers (o, u, and x) always use the long form, i.e. assume the
argument to be of type 'unsigned long int'. The length modified 'l' can
be given but is ignored.
Furthermore, it is possible to provide the optional field width (aligned
to the right only) and precision as decimal integer (i.e. not via '*')
as well as the flag for zero padding integers (i.e. '0').
The implementation was heavily inspired by the implementation in
lib/vsprintf.c from the Linux kernel tree.
Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
A simple comment above the struct declaration to indicate that the
structure must not have any padding is prone to error. Therefore let's
add a check for the structure size at compile time.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
zipl creates a temp bootmap file to keep the original file in case of an
error. Delete this temp file in case of an error.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The hierarchy of the secure boot settings in the config file should be:
defaultboot > menu > section
This patch implements this hierarchy and adds a check if a valid option is
specified and prints an error message otherwise.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Allow that --secure or -S is specified on command line without the need to
allow all options on the command line.
Also ensure that the command line option overrules the config option and
correctly ensure that secure boot is only set for SCSI devices.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
As the definition of `stfle_fac_list` in the lowcore uses uint64_t, we
should also use uint64_t for the `stfle_fac_list` parameter of the
`stfle/__stfle_asm` function.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use '$(MAKE)' to pass down the makefile flags.
This fixes the warning:
make[4]: warning: jobserver unavailable: using -j1. Add '+' to parent make rule.
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Increase consistency with the other macros by moving and renaming
the STAGE{2,3} macros in zipl.h.
Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Make use of the pre-defined __packed macro throughout zipl. This
requires adding the global include dir to ALL_CFLAGS.
Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When adding new header from zipl/include to a .c file within zipl/boot
a compiler error appears
stage3.c:16:10: fatal error: zipl.h: No such file or directory
#include "zipl.h"
^~~~~~~~
compilation terminated.
CC zipl/boot/stage3.o
This is because the rule to generate dependencies (*.o.d) does not use
the CFLAGS_BOOT. Thus it cannot find the header and fails. Note this
only applies to the dependency generation, the actual build succeeds.
To fix this rename the CFLAGS_BOOT to ALL_CFLAGS. Using ALL_CFLAGS
instead of e.g. ALL_CPPFLAGS is important to also overwrite flags given
on the commandline via OPT_FLAGS, e.g.
make V=1 OPT_FLAGS="-D__FOO__"
While at it also remove the unused and wrong '-D__ASSEMBLY__'.
Fixes: 5a6605fe ("zipl: Ensure that boot loader CFLAGS are not overwritten")
Fixes: aa913b1e ("build process: Add automatic dependency generation")
Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Currently zipl doesn't differentiate between the load address and the
entry point of an image, causing stage3 to strip away the entry point at
0x10000 for stand-alone kdump. This breaks the kdump kernel as it jumps
to 0x10000 after the special handling needed for kdump has been
performed.
Fix this by differentiating between the load address and the entry point
of an image.
Fixes: d142fbd5 ("zipl: Do not strip kernel image IPL header")
Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The __packed__ attribute is not needed for these structures as they
don't need any padding to meet the size and alignment constraints
defined in the Linux for zSeries ABI.
Reported by GCC 9.2.1 when building with '-Waddress-of-packed-member'.
stage3.c: In function 'is_verified_address':
stage3.c:241:26: warning: taking address of packed member of 'struct ipl_rb_components' may result in an unaligned pointer value [-Waddress-of-packed-member]
241 | for_each_rb_entry(comp, comps) {
| ^~~~~
stage3.c:18:15: note: in definition of macro 'for_each_rb_entry'
18 | for (entry = rb->entries; \
| ^~
CC zipl/boot/kdump3.o
CC zipl/boot/sclp_stage3.o
sclp_stage3.c: In function '__sclp_hsa_copy':
sclp_stage3.c:75:34: warning: converting a packed 'struct sdias_sccb' pointer (alignment 1) to a 'struct read_sccb' pointer (alignment 4096) may result in an unaligned pointer value [-Waddress-of-packed-member]
75 | if (sclp_hsa_copy_wait((struct read_sccb *)sccb))
| ^~~~~~~~~
In file included from sclp_stage3.c:13:
sclp_stage3.h:43:8: note: defined here
43 | struct sdias_sccb {
| ^~~~~~~~~~
In file included from sclp_stage3.c:12:
sclp.h:149:8: note: defined here
149 | struct read_sccb {
| ^~~~~~~~~
sclp_stage3.c: In function 'sclp_hsa_get_size':
sclp_stage3.c:126:34: warning: converting a packed 'struct sdias_sccb' pointer (alignment 1) to a 'struct read_sccb' pointer (alignment 4096) may result in an unaligned pointer value [-Waddress-of-packed-member]
126 | if (sclp_hsa_copy_wait((struct read_sccb *)sccb))
| ^~~~~~~~~
In file included from sclp_stage3.c:13:
sclp_stage3.h:43:8: note: defined here
43 | struct sdias_sccb {
| ^~~~~~~~~~
In file included from sclp_stage3.c:12:
sclp.h:149:8: note: defined here
149 | struct read_sccb {
| ^~~~~~~~~
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Reported by GCC 9.2.1 when building with '-Waddress-of-packed-member'.
menu.c: In function 'menu_read':
menu.c:30:22: warning: taking address of packed member of 'struct boot_stage2_params' may result in an unaligned pointer value [-Waddress-of-packed-member]
30 | uint16_t *configs = __stage2_params.config;
| ^~~~~~~~~~~~~~~
menu.c: In function 'menu_list':
menu.c:83:22: warning: taking address of packed member of 'struct boot_stage2_params' may result in an unaligned pointer value [-Waddress-of-packed-member]
83 | uint16_t *configs = __stage2_params.config;
| ^~~~~~~~~~~~~~~
menu.c: In function 'menu':
menu.c:139:22: warning: taking address of packed member of 'struct boot_stage2_params' may result in an unaligned pointer value [-Waddress-of-packed-member]
139 | uint16_t *configs = __stage2_params.config;
| ^~~~~~~~~~~~~~~
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Reported by GCC 9.2.1 when building with '-Wmaybe-uninitialized'.
job.c: In function 'job_get':
job.c:1817:14: warning: 'filename' may be used uninitialized in this function [-Wmaybe-uninitialized]
1817 | scan_size = scan_file(filename, &scan);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
job.c:1791:14: note: 'filename' was declared here
1791 | const char *filename;
| ^~~~~~~~
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Reported by GCC 9.2.1 when building with '-Wdiscarded-qualifiers'.
job.c: In function 'get_job_from_config_file':
job.c:1810:14: warning: assignment discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In the BLS files, the 'linux' and 'initrd' fields are relative to the
$BOOT directory. If $BOOT is a mount point of boot partition, 'linux'
and 'initrd' fields are relative to boot partition. If not, the paths
are relative to $BOOT directory of root partition.
zipl always starts searching at / regardless of partitions and mount
points.
This commit extends the semantics of target= field in zipl.conf to make
it as a second search path, besides /, for those 2 BLS fields.
See issues #69 for more details.
Fixes: https://github.com/ibm-s390-tools/s390-tools/issues/69
Closes: https://github.com/ibm-s390-tools/s390-tools/pull/74
Signed-off-by: Tuan Hoang <tmhoang@linux.ibm.com>
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The zipl config file (zipl.conf) and the BootLoaderSpec (BLS) fragments
in /boot/loader/entries define a set of tokens that are parsed by zipl.
These are stored in an array of tokens whose size is calculated to make
sure that there is enough memory allocated for all the scanned tokens.
But the size calculation logic was wrong, since it was checking if the
current size was enough to store a single token per BLS fragment, while
up to 4 tokens can be defined in a BLS file: a section heading and the
image, ramdisk and parameter keywords.
This led to zipl being killed by a SIGABRT signal when trying to parse
more tokens than the ones that could fit in the scanned tokens array:
Using config file '/etc/zipl.conf'
Using BLS config file '/boot/loader/entries/vmlinuz-9.conf'
Using BLS config file '/boot/loader/entries/vmlinuz-8.conf'
Using BLS config file '/boot/loader/entries/vmlinuz-7.conf'
Using BLS config file '/boot/loader/entries/vmlinuz-6.conf'
Using BLS config file '/boot/loader/entries/vmlinuz-5.conf'
Using BLS config file '/boot/loader/entries/vmlinuz-4.conf'
Using BLS config file '/boot/loader/entries/vmlinuz-3.conf'
Using BLS config file '/boot/loader/entries/vmlinuz-2.conf'
Using BLS config file '/boot/loader/entries/vmlinuz-1.conf'
Using BLS config file '/boot/loader/entries/vmlinuz-0.conf'
double free or corruption (out)
Aborted (core dumped)
Fixes: https://github.com/ibm-s390-tools/s390-tools/issues/68
Closes: https://github.com/ibm-s390-tools/s390-tools/pull/73
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The duplicate statement does not have any effect. Therefore remove it.
Signed-off-by: Jens Remus <jremus@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
...
==9448== 32 bytes in 1 blocks are definitely lost in loss record 1 of 3
==9448== at 0x4831010: malloc (vg_replace_malloc.c:309)
==9448== by 0x48E2205: __vasprintf_internal (vasprintf.c:71)
==9448== by 0x1005061: misc_asprintf (misc.c:48)
==9448== by 0x10131F3: disk_get_info (disk.c:239)
==9448== by 0x1013C41: disk_get_info_from_file (disk.c:517)
==9448== by 0x1011C87: bootmap_create (bootmap.c:1127)
==9448== by 0x1004C73: main (zipl.c:192)
...
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The zfcp dumper fails with the following error:
MLOPDM003I: Machine loader finished, moving data to final storage
location.
uncompression error
--- System halted
HCPGIR450W CP entered; disabled wait
PSW 00020001 80000000 00000000 DEADBEEF
The zipl command shows overlapping components when installing the dumper
to a zfcp disk:
zipl -d /dev/sda1
Building bootmap directly on partition '/dev/sda1'
Adding dump section
kernel image......: /lib/s390-tools/zfcpdump/zfcpdump-image
kernel parmline...: 'root=/dev/ram0 dump_mem=1 possible_cpus=1
cgroup_disable=memory '
component address:
heap area.......: 0x00002000-0x00005fff
stack area......: 0x0000f000-0x0000ffff
internal loader.: 0x0000a000-0x0000dfff
parameters......: 0x00009000-0x000091ff
kernel image....: 0x00010000-0x005761ff
^^^^^^
parmline........: 0x00567000-0x005671ff
^^^^^^
Preparing boot device: sda.
Done.
With the secure IPL patchset the offset of the kernel image has been
removed for the normal IPL case but it has not been removed for the dump
image which leads to the overlap of 0x10000.
Fix by removing the offset for the dump case.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewd-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Tested-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The zipl internal loader adds a variable BOOT_IMAGE= to the commandline
so that it is visible in the operating system which menu entry has been
chosen.
This entry was overwritten by the stage3 parameter page.
Fix by re-arranging the internal memory layout and putting the command
line extra param, which contains the BOOT_IMAGE entry, at 0xe000.
This location is available because less than one page is used for the
stack.
Fixes: https://github.com/ibm-s390-tools/s390-tools/issues/67
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Currently the zipl tool doesn't remove trailing spaces from the BLS field
values. So for example if a 'title' field has trailing spaces and is used
as the default, zipl will complain that there's no section with that name:
Using config file '/etc/zipl.conf'
Using BLS config file '/boot/loader/entries/f871a0cf218348c5ba921f61c92b7eac-4.18.0-80.20.el8.s390x.conf'
Using BLS config file '/boot/loader/entries/f871a0cf218348c5ba921f61c92b7eac-0-rescue.conf'
Error: Config file '/etc/zipl.conf': Line 6: no such section 'Red Hat Enterprise Linux (4.18.0-80.20.el8.s390x) 8.1 (Ootpa)'
Since the trailing spaces are also removed from the fields defined in the
zipl.conf file, do the same for the ones that are defined in the BLS file.
Closes: https://github.com/ibm-s390-tools/s390-tools/pull/62
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Acked-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The stfle inline assembly returns the number of double words written
(condition code 0) or the double words it would have written
(condition code 3), if the memory array it got as parameter would have
been large enough.
The current stfle implementation assumes that the array is always
large enough and clears those parts of the array that have not been
written to with a subsequent memset call.
If however the array is not large enough memset will get a negative
length parameter, which means that memset clears memory until it gets
an exception and the system crashes.
To fix this simply limit the maximum length. Move also the inline
assembly to an extra function to avoid clobbering of register 0, which
might happen because of the added MIN invocation together with code
instrumentation.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
bootmap.c: In function ‘check_secure_boot_support’:
bootmap.c:131:2: warning: ignoring return value of ‘fscanf’, declared
with attribute warn_unused_result [-Wunused-result]
fscanf(fp, "%d", &val);
^~~~~~~~~~~~~~~~~~~~~~
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use the newer and more robust libutil provided function
util_sys_get_dev_addr() to identify a device address for any former user
of u2s_getbusid().
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add zipl and zipl.conf man page updates.
The zipl man page will look like:
-S <SWITCH> or --secure <SWITCH>
Control the zIPL secure boot support. <SWITCH> can take one of three values:
auto (default)
Write signatures if available and supported by the system.
1
Signatures are written independent of support indicated by the local
system. Also missing signatures for stage 3 and kernel IPL files
will result in an error.
0
No signatures will be written.
The zipl.conf man page will look like:
secure = auto/1/0 (configuration only)
Configuration section:
Control the zIPL secure boot support. Set this option to one of the following:
- auto: Write signatures if available and supported by the system.
- 1: Signatures are written independent of support indicated by the local system.
Also missing signatures for stage 3 and kernel IPL files will result in an error.
- 0: No signatures will be written.
The default value for 'secure' is auto.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
To ensure that only verified code is executed the stage 3 loader has
to check if the load psw points to an address that has previously been
verified by the machine loader.
If secure boot is enabled the IPL process will only continue if the
verification was successful.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Acked-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Philipp Rudo