Commit Graph

95 Commits

Author SHA1 Message Date
Toomas Soome
ed79202682 loader: add file_remove() function to undo file_insert_tail().
346002 did miss the fact that we do not only undo the loadaddr, but also
we need to remove the inserted module. Implement file_remove() to do the job.

MFC after:	1w
2019-04-07 13:36:17 +00:00
Toomas Soome
d7125bb1e2 loader: mod_loadkld() error: we previously assumed 'last_file' could be null
The last_file variable is used to reset the loadaddr variable back to original
value; however, it is possible the last_file is NULL, so we can not blindly
trust it. But then again, we can just save the original loadaddr and use
the saved value for recovery.

MFC after:	1w
2019-04-07 12:20:17 +00:00
Toomas Soome
d28c594669 loader: file_addmetadata() should check for memory allocation
malloc() can return NULL.

MFC after:	1w
2019-04-07 12:10:19 +00:00
Toomas Soome
1d28f39d20 loader: remove pointer checks before free() in module.c
free() does check for NULL argument, remove duplicate checks.

MFC after:	1w
2019-04-07 11:55:11 +00:00
Toomas Soome
db7599e9e5 loader: file_addmodule should check for memory allocation
strdup() can return NULL.

MFC after:	1w
2019-04-07 11:50:41 +00:00
Toomas Soome
cef2742e20 loader: malloc+bzero is calloc
Replace malloc+bzero in module.c with calloc.

MFC after:	1w
2019-04-07 11:48:41 +00:00
Marcin Wojtas
b0fefb25c5 Create kernel module to parse Veriexec manifest based on envs
The current approach of injecting manifest into mac_veriexec is to
verify the integrity of it in userspace (veriexec (8)) and pass its
entries into kernel using a char device (/dev/veriexec).
This requires verifying root partition integrity in loader,
for example by using memory disk and checking its hash.
Otherwise if rootfs is compromised an attacker could inject their own data.

This patch introduces an option to parse manifest in kernel based on envs.
The loader sets manifest path and digest.
EVENTHANDLER is used to launch the module right after the rootfs is mounted.
It has to be done this way, since one might want to verify integrity of the init file.
This means that manifest is required to be present on the root partition.
Note that the envs have to be set right before boot to make sure that no one can spoof them.

Submitted by: Kornel Duleba <mindal@semihalf.com>
Reviewed by: sjg
Obtained from: Semihalf
Sponsored by: Stormshield
Differential Revision: https://reviews.freebsd.org/D19281
2019-04-03 03:57:37 +00:00
Ian Lepore
14243f8de7 Distinguish between "no partition" and "choose best partition" with a constant.
The values of the d_slice and d_partition fields of a disk_devdesc have a
few values with special meanings in the disk_open() routine. Through various
evolutions of the loader code over time, a d_partition value of -1 has
meant both "use the first ufs partition found in the bsd label" and "don't
open a bsd partition at all, open the raw slice."

This defines a new special value of -2 to mean open the raw slice, and it
gives symbolic names to all the special values used in d_slice and
d_partition, and adjusts all existing uses of those fields to use the new
constants.

The phab review for this timed out without being accepted, but I'm still
citing it below because there is useful commentary there.

Differential Revision:	https://reviews.freebsd.org/D19262
2019-03-24 18:51:52 +00:00
Ed Maste
fe6ee08134 loader: fix loading of kernels with . in path
The loader indended to search the kernel file name (only) for . but
instead searched the entire path, so paths like
"boot/test.elfv2/kernel" would not work.

Submitted by:	alfredo.junior_eldorado.org.br
Reviewed by:	kevans
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D19658
2019-03-20 16:24:47 +00:00
Marcin Wojtas
c42e554dc9 Add missing boot.4th verification
During initialization of the forth interpreter
the loader looks for "/boot/boot.4th"
and executes any code found there.
That file was loaded bypassing verification.
Add a call to verify_file to change that.

Submitted by: Kornel Duleba <mindal@semihalf.com>
Reviewed by: sjg
Obtained from: Semihalf
Sponsored by: Stormshield
2019-03-19 02:45:32 +00:00
Kyle Evans
7325df02c5 stand: Improve some debugging experience
Some of these files using <FOO>_DEBUG defined a DEBUG() macro to serve as a
debug-printf. -DDEBUG is useful to enable some debugging output across
multiple ELF/common parts, so switch the DEBUG-as-printf macros over to
something more like DPRINTF that is more commonly used for this kind of
thing and less likely to conflict.

userboot/elf64_freebsd debugging also assumed %llx for uint64; use PRIx64
instead.

MFC after:	1 week
2019-03-12 16:21:39 +00:00
Emmanuel Vadot
73a41ff81c stand/common/module: Apply style(9) 2019-03-07 18:57:43 +00:00
Simon J. Gerraty
fd1d7567d8 Add -d flag to load command
When doing load -t manifest -d increments debug level

Reviewed by:	stevek
2019-03-04 19:50:59 +00:00
Simon J. Gerraty
8df8b2d3e5 Enable veriexec for loader
This relies on libbearssl and libsecureboot
to verify files read by loader in a maner equivalent
to how mac_veriexec

Note: disabled by default.
Use is initially expected to be by embeded vendors

Reviewed by:	emaste, imp
Sponsored by:	Juniper Networks
Differential Revision:	D16336
2019-02-26 06:22:10 +00:00
Toomas Soome
63f582e0f5 loader: ptable_close() should check its argument
If the passed in table is NULL, just return.
2019-02-18 20:29:19 +00:00
Ian Lepore
7827bb1c2c Garbage collection no-longer-used constant. 2019-02-17 23:48:51 +00:00
Ian Lepore
5b777dbfa5 Make lsdev -v output line up in neat columns by using a fixed width for
the size field and a tab between the partition type and the size.

Changes this

  disk devices:
        disk0 (MMC)
        disk0s1: DOS/Windows            49MB
        disk0s2: FreeBSD                14GB
        disk0s2a: FreeBSD UFS         14GB
        disk0s2b: Unknown             2048KB
        disk0s2d: FreeBSD UFS         2040KB

to this

  disk devices:
        disk0 (MMC)
        disk0s1: DOS/Windows      49MB
        disk0s2: FreeBSD          14GB
        disk0s2a: FreeBSD UFS     14GB
        disk0s2b: Unknown       2048KB
        disk0s2d: FreeBSD UFS   2040KB
2019-02-17 23:46:11 +00:00
Ian Lepore
71c96def1c Use a couple local variables to avoid repetitive long expressions that
cause line-wrapping.
2019-02-17 23:38:17 +00:00
Ian Lepore
4d02caf7cb Restore loader(8)'s ability for lsdev to show partitions within a bsd slice.
I'm pretty sure this used to work at one time, perhaps long ago.  It has
been failing recently because if you call disk_open() with dev->d_partition
set to -1 when d_slice refers to a bsd slice, it assumes you want it to
open the first partition within that slice.  When you then pass that open
dev instance to ptable_open(), it tries to read the start of the 'a'
partition and decides there is no recognizable partition type there.

This restores the old functionality by resetting d_offset to the start
of the raw slice after disk_open() returns.  For good measure, d_partition
is also set back to -1, although that doesn't currently affect anything.

I would have preferred to make disk_open() avoid such rude assumptions and
if you ask for partition -1 you get the raw slice.  But the commit history
shows that someone already did that once (r239058), and had to revert it
(r239232), so I didn't even try to go down that road.
2019-02-17 23:32:09 +00:00
Kyle Evans
e49f2c66d1 stand: dev_net: correct net_open's interpretation of params
net_open previously casted the first vararg to a char * and this was
half-OK: at first, it is passed to netif_open, which would cast it back to
the struct devdesc * that it really is and use it properly. It is then
strdup()d and used as the netdev_name, which is objectively wrong.

Correct it so that the first vararg is properly casted to a struct devdesc *
and the netdev_name gets set properly to make it more clear at a glance that
it's not doing something horribly wrong.

Reported by:	mmel
Reviewed by:	imp, mmel, tsoome
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D19206
2019-02-15 18:28:51 +00:00
Maxim Sobolev
d92fb78458 When handling CMD_CRIT error set command_errmsg to NULL after we dump it out,
so that it does not result in error message printed twice.

OK load doodoo
can't find 'doodoo'
can't find 'doodoo'
OK

MFC after:	2 weeks
2018-11-30 02:14:41 +00:00
Maxim Sobolev
55d5c94943 The libstand's panic() appends its own '\n' to the message, so that users of the API
don't need to supply one.

MFC after:	2 weeks
2018-11-29 18:37:48 +00:00
Toomas Soome
13dcff6bd8 loader: command_bcache() should print unsigned values
All bcache counters are unsigned.
2018-11-29 14:21:01 +00:00
Maxim Sobolev
6c81fe160c Nuke out buffer overflow safety marker code, it duplicates similar code in
the malloc()/free() as well as having potential of softening the handling
in case error is detected down to a mere warning as compared to hard panic
in free().

Submitted by:	tsoome
Differential Revision:	https://reviews.freebsd.org/D18299
2018-11-23 22:36:56 +00:00
Toomas Soome
a3fd276be0 loader: ptable_open() check for ptable_cd9660read result is wrong
The ptable_*read() functions return NULL on read errors (and partition table
closed as an side effect). The ptable_open must check the return value and
act properly.

PR:		232483
Reported by:	lev
Reviewed by:	lev,cem
Differential Revision:	https://reviews.freebsd.org/D17890
2018-11-07 21:36:52 +00:00
Toomas Soome
53e3fbee09 loader: always set media size from partition.
The disk access is validated by using partition table definitions, therefore
we have no need for if statements, just set the disk size.

Of course the partition table itself may be incorrect/inconsistent, but if
so, we are in trouble anyhow.

Differential Revision:	https://reviews.freebsd.org/D17822
2018-11-07 11:14:22 +00:00
Kyle Evans
d3d381b2b1 userboot: handle guest interpreter mismatches more intelligently
The switch to lualoader creates a problem with userboot: the host is
inclined to build userboot with Lua, but the host userboot's interpreter
must match what's available on the guest. For almost all FreeBSD guests in
the wild, Lua is not yet available and a Lua-based userboot will fail.

This revision updates userboot protocol to version 5, which adds a
swap_interpreter callback to request a different interpreter, and tries to
determine the proper interpreter to be used based on how the guest
/boot/loader is compiled. This is still a bit of a guess, but it's likely
the best possible guess we can make in order to get it right. The
interpreter is now embedded in the resulting executable, so we can open
/boot/loader on the guest and hunt that down to derive the interpreter it
was built with.

Using -l with bhyveload will not allow an intepreter swap, even if the
loader specified happens to be a userboot with the wrong interpreter. We'll
simply complain about the mismatch and bail out.

For legacy guests without the interpreter marker, we assume they're 4th.
For new guests with the interpreter marker, we'll read it and swap over
to the proper interpreter if it doesn't match what the userboot we're using
was compiled with.

Both flavors of userboot are installed by default, userboot_4th.so and
userboot_lua.so. This fixes the build WITHOUT_FORTH as a coincidence, which
was broken by userboot being forced to 4th.

Reviewed by:	imp, jhb, araujo (earlier version)
Approved by:	re (gjb)
Differential Revision:	https://reviews.freebsd.org/D16945
2018-09-01 02:23:45 +00:00
Kyle Evans
2ac6dfb0c2 lualoader: Print error messages from command failures at the prompt
Previously lualoader would remain silent, rather than printing
command_errmsg or noting that a command had failed or was not found.

Approved by:	re (gjb)
2018-08-31 15:02:53 +00:00
Warner Losh
060679ef9c Collapse zfsloader functionality back down into loader.
We no longer really need a separate zfsloader. It was useful when we
were first supporting ZFS and had limited ability to properly boot off
of ZFS without the special boot loader. Now that the boot loader has
matured, go the way loader.efi pioneered and just build one
binary. Change the name of the loader to load in the secondary boot
blocks to be just /boot/loader. Provide a symbolic link from zfsloader
to loader so people who have not upgraded their boot blocks are not
affected. This has the happy benefit of making coexistence easier as
well (fewer binaries in the matrix).

Discussed with: allanjude@, kevans@
RelNotes: Yes
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D16361
2018-07-20 05:17:37 +00:00
Ian Lepore
c1418270b2 Extend loader(8) geli support to all architectures and all disk-like devices.
This moves the bulk of the geli support from lib386/biosdisk.c into a new
geli/gelidev.c which implements a devsw-type device whose dv_strategy()
function handles geli decryption. Support for all arches comes from moving
the taste-and-attach code to the devopen() function in libsa.

After opening any DEVT_DISK device, devopen() calls the new function
geli_probe_and_attach(), which will "attach" the geli code to the open_file
struct by creating a geli_devdesc instance to replace the disk_devdesc
instance in the open_file. That routes all IO for the device through the
geli code.

A new public geli_add_key() function is added, to allow arch/vendor-specific
code to add keys obtained from custom hardware or other sources.

With these changes, geli support will be compiled into all variations of
loader(8) on all arches because the default is WITH_LOADER_GELI.

Relnotes:	yes
Sponsored by:	Microchip Technology Inc
Differential Revision:	https://reviews.freebsd.org/D15743
2018-07-13 17:50:25 +00:00
Warner Losh
c96ac12e5c Transition to boot_env_to_howto and boot_howto_to_env in the boot
loader.

Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D16205
2018-07-13 16:43:29 +00:00
Warner Losh
4569e91328 Eliminate boot loader copies of boot arg parsing.
Eliminate 4 of the copies of the arg parsing in /boot/laoder
by using boot_parse_cmdline.

Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D16205
2018-07-13 16:43:23 +00:00
Warner Losh
007b82d7ab Stop using ../zfs/libzfs.h but instead use libzfs.h.
While ../zfs/libzfs.h mostly works, there are a few situations where
it does not. Eliminate the problem by using plain libzfs.h, like we do
for ufs support. This fixes the weird cases, and is easier to
understand. It also follows the general style convetion of avoiding
../ in #includes.
2018-07-08 07:42:58 +00:00
Allan Jude
436dbc4262 stand/common/disk.c: dev->d_offset still needs to be set to 0
With r335868, I thought this was no longer necessary. I was wrong.

Reported by:	ian
Sponsored by:	Klara Systems
2018-07-03 05:53:27 +00:00
Allan Jude
32c52b4847 stand/common/disk.c: Read partition table relative to the start of the disk
If a disk is of an oddball size, like the 200mb + 512b used in rootgen.sh,
when disk_open() is called on a GELI encrypted partition, attempts to read
the partition table fail, as they pass through the decryption process which
turns the already plaintext data into jibberish.

When reading the partition table, always pass a slice and partition setting
of -1, and an offset of 0. Setting the slice to -1 prevents a false
positive when checking the slice against the cache of GELI encrypted
slices.

Reviewed by:	imp, ian
Sponsored by:	Klara Systems
Differential Revision:	https://reviews.freebsd.org/D15847
2018-07-02 18:19:08 +00:00
Allan Jude
d48c0a685d stand/common/disk.c: Update debug printf
This was missed in r330809 because it is compiled out by default

Sponsored by:	Klara Systems
2018-06-17 19:31:35 +00:00
Warner Losh
5f88ee4479 bootprog_info is generated in vers.c. Move it's definition to
bootstrap.h and remove all the redundant copies.

Sponsored by: Netflix
2018-06-14 06:41:33 +00:00
Kyle Evans
3db6d179e8 stand: One more trivial consolidation (setting environment from howto) 2018-06-09 15:52:29 +00:00
Kyle Evans
28ee318d9c stand: Fix build after r334882
Not sure how this was not caught in Universe.
2018-06-09 15:28:37 +00:00
Kyle Evans
593e2c6ece stand: Consolidate checking for boot flags driven by environment vars
e.g. boot_mute, boot_single, boot_verbose, and friends; we checked for these
in multiple places, consolidate into common/ and allow a setting of "NO" for
any of these to turn them off. This allows systems with multiple
loader.conf(5) or loader.conf(5) overlay systems to easily turn off
variables in later processed files by setting it to NO.

Reported by:	Nick Wolff @ iXsystems
Reviewed by:	imp
2018-06-09 15:10:39 +00:00
Ian Lepore
9f6fd8397c Remove comments and assertions that are no longer valid after r330809.
r330809 replaced duplication of devdesc struct fields with an embedded copy
of the devdesc struct, to avoid fragility.  That means all the scattered
comments indicating that structs must match are no longer valid.  Likewise
asserts that attempted to mitigate some of the old fragility.

Reviewed by:	imp@
2018-06-05 22:13:45 +00:00
Dimitry Andric
073193ed51 Fix build of stand with base gcc
* Make autoboot() a static function in stand/common/boot.c, so it does
  not shadow local variables in gptboot.c and zfsboot.c.
* Remove -Winline from the Makefiles for gptboot, gptzfsboot and
  zfsboot, as gcc will always fail to inline some functions, and there
  is nothing we can do about it.
* For gcc <= 4.2.1, silence -Wuninitialized for isoboot, as it produces
  a false positive warning.
* Remove deprecated and unnecessary -mcpu=i386 flag from stand/defs.mk,
  as there is already a -march=i386 flag further in the file.

Reviewed by:	imp
MFC after:	3 days
Differential Revision: https://reviews.freebsd.org/D15628
2018-05-31 14:38:13 +00:00
Marius Strobl
dd5dbb3199 - Unbreak booting sparc64 kernels after the metadata unification in
r329190; sparc64 kernels are always 64-bit but with that revision
  in place, the loader was treating them as 32-bit ones.
- In order to reduce the likelihood of this kind of breakage in the
  future, #ifdef out md_load() on sparc64 and make md_load_dual() -
  which is currently local to metadata.c anyway - static.
- Make md_getboothowto() - also local to metadata.c - static.
- Get rid of the unused DTB pointer on sparc64.
2018-05-21 01:20:19 +00:00
Warner Losh
09001b5c78 Revert r333365
Even though we don't use it, it appears something else requires it to
be != 0 to work. This breaks tftp boot in loader.efi, so revert until
that can be sorted out.
2018-05-10 20:27:12 +00:00
Warner Losh
a1947307e7 We don't use f_devdata, so don't set it. Should that need to change
later, we can. This leaves ZFS as the only irregular f_devdata
user in the tree.
2018-05-08 16:16:56 +00:00
Warner Losh
e4eef18848 Use M. Warner Losh everywhere on my copyrights.
Remove 'All Rights Reserved' where I can.
2018-05-01 16:29:22 +00:00
Toomas Soome
b67d407ac7 loader: cstyle cleanup of command.c
just clean it up. no functional changes intended.

Reviewed by:	imp
Differential Revision:	https://reviews.freebsd.org/D15087
2018-04-16 14:10:19 +00:00
Toomas Soome
6d68f8acf4 loader: make sure we do not return garbage from help_getnext
Since we do free subtopic and desc in help_getnext(), we need to set them also
NULL, so we make sure we dont get double free().

Approved by:	bapt
Differential Revision:	https://reviews.freebsd.org/D15082
2018-04-16 12:46:14 +00:00
Toomas Soome
746dddb134 loader: command_errmsg should be const
Use const char * for command_errmsg.
2018-04-16 08:41:44 +00:00
Toomas Soome
faa5306390 loader: make sure we use snprintf() in commands.c
Safeguard against memory corruptions.
2018-04-16 08:15:50 +00:00