Set stage3_parms.envblk_len to 0, if add_envblk is false.
This fixes segmentation fault when performing job with
not defined zIPL environment (e.g. installing SCSI dump)
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Tested-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Added a tool to operate with zIPL environment, currently
installed in the boot record. All modifying operations result
in atomic update of the installed environment block, bypassing
the file system driver.
Operations currently supported by zIPL environment editor:
. set/unset environment variables,
. print/reset environment
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
from disk.c to a dedicated source file fs-map.c, so that the new
zipl-editenv tool will be also able to use it.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Before starting the kernel:
1. parse environment block (if any) and create a hash table
of all found pairs (NAME, VALUE);
2. scan the command line, which already contains extra-parameters
(if any), and for each found ${NAME} replace it with VALUE, as
found in the hash table by NAME.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When installing a boot record for "ipl" and "menu" job, always add
an environment block as a boot component located in bootmap file
at offset alinged on file system block size boundary. When adding,
first try to import environment from a file at location specified
by newly introduced "--environment" zipl option, or by default at
"/etc/ziplenv". If nothing was imported, then add a blank environment
block. Optionally print the content of the environment block.
Store environment block size and address (as of boot component) in
stage3_parms.
Change interface of add_ipl_program(): add 2 additional arguments:
a pointer to bootmap file name and a predicate indicating if we
need to add environment block as a boot component.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Provide helper functions disk_write_block_buffer_align()
and add_component_buffer_align() to align offset of the record
on specified block size boundary and to save the offset, where
the record was made at.
This will be used by a later patch.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
. expand interface of disk_get_blocklist_from_file() to get
block pointers for a specific range of data within a file.
. provide a helper function add_component_file_range() to add a
specific range of data within a file as a boot component.
This will be used by a later patch.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When creating a bootmap, look for zipl components (stage3.bin and
zipl helpers) in a directory specified by S390TOOLS_LIBDIR shell
environment variable. If that variable is not set, then look for
them at the default location.
In verbose mode print the name of s390-tools library directory,
where the search was implemented.
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The HSA size, which limits the address space in kdump case, is not constant
and depends on the underlying architecture.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For the stage2 of zipl's boot loaders only 3 heap pages are available
[0x6000, 0x6000 + 0x3000]. Therefore, stage2 code needs to be very careful
when and for how long it allocates a heap page.
The heap OOM problem in stage2 was hidden until the commit 252be376
("zipl/boot: fix potential heap overflow in stage2"). Before this commit,
stage2 assumed that heap is 4 pages large which is apparently very wrong
but get_zeroed_page() still allowed allocating an extra 4th page by
overriding the memory segment following the heap area of stage2 (stage3
parameter area).
Try to avoid allocating a heap page and keeping it allocated over a long
period of time in the DASD dumpers. Free a heap page as soon as possible
if not required anymore.
And be extra careful with printf() because it always tries to allocate
a free heap page.
Fixes: 252be376 ("zipl/boot: fix potential heap overflow in stage2")
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Install libasan first, e.g. on Fedora 32:
dnf install -y libasan libasan-static.
To compile with address sanitizer, pass ASAN=1 to make.
AdressSanitizer helps to catch various memory bugs for which C/C++ is
infamous.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Current heap size in stage2 is three pages long [0x6000-0x9000] but
get_zeroed_page() assumes it is one page more which might lead to
a heap overflow which will corrupt data located at 0x9000 (stage3
parameters). Calculate the heap size of a stage at run-time
by using the symbols provided by linker.
Furthermore, validate the given address in free_page() to stop illegal
memory accesses.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Prevent access to freed memory still pointed to by entry.
entry still points into load_page that has been released with free_page.
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Stage 3 flags is a 64bit integer but function add_ipl_program
used a 32bit integer instead. Due to this bug
STAGE3_FLAG_SCSI and STAGE3_FLAG_KDUMP were not correctly set.
Fixes: 412d3e8c ("zipl: consolidate stage3_params structs and stage3 flags")
Signed-off-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Commit 86856f98db ("zipl: Make use of __noreturn macro") moved the
'noreturn' attribute from declaration to definition. With this the
compiler can no longer optimize when the function is called in a
separate source file. Move the attribute back to the declaration
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Fix that a misleading BLS error message is printed in any case for missing
files.
The scan_check code in zipl already does proper error handling for missing
file. Remove the duplicated error handling from scan_check_bls and just use
the function to update the file with the target path if needed.
To indicate the intention of this function also rename it.
Fixes: #84
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Tuan Hoang <tmhoang@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Copying the SCSI scheme wasn't good enough due to how major/minor
numbers are assigned by the blkext driver. We now query the relevant
information via sysfs.
Signed-off-by: Jason J. Herne <jjherne@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Printing the number zero (e.g. printf("%u", 0)) currently only gives you
an empty string. This is because the while-do loop to map the number to a
string is only entered when the value is 'true', i.e. non-zero. Fix this
by using do-while instead.
Fixes: 6fe9e6c ("zipl/libc: Introduce vsnprintf")
Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
Reported-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
nvme devices use the same on-disk bootmap as scsi devices. When the target
device is nvme (using the blkext driver) we simply treat it as scsi.
Signed-off-by: Jason J. Herne <jjherne@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Let's assume the original `command_line` is 'aaaaaaaaaaaaaaaaaa' and
`cextra` is ' =blub'. With the old code this would result in the
following new command line:
'blubaaaaaaaaaaaaa' instead of the expected result 'blub\0aaaaaaaaaaaa'
Let's fix this by setting the NULL-termination for the new command
line. While at it, use the `command_line` variable instead of casting
an address.
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The inserted blank must also be taken into account for the calculation
of `cmdline_len`. In general it's only possible to insert a blank if
the command line length is not already the maximum.
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
`src` parameter for `memcpy` is set to `cextra + begin` but the offset
begin is not taken into account for the calculation of the length that
should be copied.
Fix this by increment the cextra pointer for each skipped whitespace
of the extra parameter.
While at it, rename `end` variable to `cmdline_len`, `command_line`
variable to `cmdline`, remove useless void pointer cast, and use
strlen instead of a while loop to determine the cmdline string length.
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
1. `begin` is used as array index and should therefore never be greater
than COMMAND_LINE_SIZE - 1. Therefore let's fix the while condition.
2. `length` describes the string length and should therefore also never
be greater than COMMAND_LINE_SIZE - 1.
The 1. off-by-two error can lead to a out-of-bounds read and the 2.
to a buffer overflow.
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use STAGE2_ENTRY and PSW_LOAD instead of hard-coded values. While at
it, also move the libc.h to the top in tape2dump.c.
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
While at it, rename PSW_SHORT_ADDR_MASK and PSW_ADDRESS_MASK to
PSW32_ADDR_MASK. As a side effect this removes the zipl.h dependency
of the boot loaders. While at it,
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use C pre-processor for linker script generation and refactor some
constants. This allows the usage of the constants in our "linker
scripts" `*.lds.S` (actually, these are assembler files, so we can
make us of the C pre-processor and its capabilities).
While at it, enforce the described memory layout in the generated
linker script.
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Move COMMAND_LINE_EXTRA to `boot/loaders_layout.h` so it can be reused
by `menu.c`and `stage3.c`. Additionally, reuse COMMAND_LINE_SIZE from
`linux_layout.h` in `menu.c`.
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Introduce a struct definition for the stage3 parameters used by
stage3.c. This makes it easier to maintain the stage3 linker script
and it allows us to consolidate the stage3_params structs defined in
`stage3.h` and `include/boot.h` as well as the stage3 flag macros.
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This allows the usage of stage3.h in files where other libc
implementations than our minimal libc is used, e.g. glibc.
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In case secure boot is enabled but no components in the IPL report
are found it ends up in an endless loop in the component verification.
To prevent this check if components are found and exit if not.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The lowcore parmblock pointer is not valid in every case. For example
it is invalid for CCW type IPL.
To have an indication if the pointer is valid do a diag308 to store the
parmblock and check if secure boot is enabled.
If it is enabled the lowcore pointer is valid and the ipl report that is
needed for secure boot can be found right behind the ipl parmblock.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This fixes the false positive
CC zipl/src/misc.o
misc.c: In function ‘misc_temp_dev’:
misc.c:313:27: warning: ‘%04d’ directive writing between 4 and 11 bytes into a region of size 5 [-Wformat-overflow=]
sprintf(filename, "zipl%04d", retry);
^~~~
misc.c:313:22: note: directive argument in the range [-2147483648, 999]
sprintf(filename, "zipl%04d", retry);
^~~~~~~~~~
misc.c:313:4: note: ‘sprintf’ output between 9 and 16 bytes into a destination of size 9
sprintf(filename, "zipl%04d", retry);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
While at it, add an assertion that protects against a format-overflow,
e.g. if TEMP_DEV_MAX_RETRIES changes.
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Add a boot loader for protected virtualization (PV) that can be
combined with a kernel/initrd/parmfile to form a single bootable file.
This file must be constructed in a way that it can be used (1) for a
QEMU direct kernel boot and (2) it can be zipl'ed by the normal,
unmodified zipl program.
This new boot loader consists of two parts:
1. stage3a boot loader (cleartext), this loader is responsible for
the transition into the protected mode by doing diag308 subcode 8
and 10 calls.
2. stage3b boot loader (encrypted), this loader is very similar to the
normal zipl stage3 boot loader. It will be loaded by the Ultravisor
after the successful transition into protected mode. Like the zipl
stage3 boot loader it moves the kernel and patches in the values
for initrd and parmline.
The requirements for (1) and (2) result in the following constraints:
1. It must be possible to place stage3a and stage3b at a location >=
0x10000 because the zipl stage3 loader zeroes out everything at
addresses lower than 0x10000 of the image.
2. As the stage3 loader of zipl assumes that the passed kernel image
looks like a normal kernel image, the zipl stage3 loader modifies the
content at the memory area 0x10400 - 0x10800, therefore we leave this
area unused in our stage3a loader.
3. The default entry address used by the zipl stage3 loader is 0x10000
so we add a simple branch to 0x11000 at 0x10000 so the zipl stage3
loader can modify the area 0x10400 - 0x10800 without affecting the
stage3a loader.
The stage3b loader is linked at address 0x9000, therefore it will not
work at another address. The relocation support for the stage3b
loader, so that it can be placed at addresses != 0x9000, is added in
the next patch. This loader with relocation support has the name
'stage3b_reloc'.
The memory layout of the single bootable file looks like:
+-----------------------+-----------+------------------------+
|Start |End |Use |
+=======================+===========+========================+
|0 |0x7 |Short PSW, starting |
| | |instruction at 0x11000 |
+-----------------------+-----------+------------------------+
|0x10000 |0x10012 |Branch to 0x11000 |
+-----------------------+-----------+------------------------+
|0x10013 |0x10fff |Left intentionally |
| | |unused |
+-----------------------+-----------+------------------------+
|0x11000 |0x12fff |Stage3a |
+-----------------------+-----------+------------------------+
|0x13000 |0x13fff |IPIB used as argument |
| | |for the diag308 call |
+-----------------------+-----------+------------------------+
|0x14000 |0x1[45]fff |UV header used for the |
| | |diag308 call (size can |
| | |be either 1 or 2 pages) |
+-----------------------+-----------+------------------------+
|NEXT_PAGE_ALIGNED_ADDR | |Encrypted Kernel |
+-----------------------+-----------+------------------------+
|NEXT_PAGE_ALIGNED_ADDR | |Encrypted Cmdline |
+-----------------------+-----------+------------------------+
|NEXT_PAGE_ALIGNED_ADDR | |Encrypted Initrd |
+-----------------------+-----------+------------------------+
|NEXT_PAGE_ALIGNED_ADDR | |Encrypted Stage3b_reloc |
+-----------------------+-----------+------------------------+
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Consolidate `ALIGN, __ALIGN_MASK, ARRAY_SIZE` macros and add them to
lib/zt_common.h. While at it, adapt coding style.
Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
