Commit Graph

117 Commits

Author SHA1 Message Date
Simon J. Gerraty
bbac74ca3c loader: ignore some variable settings if input unverified
libsecureboot can tell us if the most recent file opened was
verfied or not.
If it's state is VE_UNVERIFIED_OK, skip if variable
matches one of the restricted prefixes.

Reviewed by:	stevek
MFC after:	1 week
Sponsored by:	Juniper Networks
Differential Revision:	https://reviews.freebsd.org//D20909
2019-07-17 23:33:14 +00:00
Warner Losh
f5a95d9a07 Remove NAND and NANDFS support
NANDFS has been broken for years. Remove it. The NAND drivers that
remain are for ancient parts that are no longer relevant. They are
polled, have terrible performance and just for ancient arm
hardware. NAND parts have evolved significantly from this early work
and little to none of it would be relevant should someone need to
update to support raw nand. This code has been off by default for
years and has violated the vnode protocol leading to panics since it
was committed.

Numerous posts to arch@ and other locations have found no actual users
for this software.

Relnotes:	Yes
No Objection From: arch@
Differential Revision: https://reviews.freebsd.org/D20745
2019-06-25 04:50:09 +00:00
Warner Losh
ec9abc1843 Move to using a common kernel path between the boot / laoder bits and
the kernel.
2019-06-24 20:34:53 +00:00
Toomas Soome
ed29b75ca3 loader: disk_open() should honor D_PARTNONE
The D_PARTNONE is documented to make it possible to open raw MBR
partition, but the current disk_open() does not really implement this
statement.

The current code is checking partition against -1 (D_PARTNONE) but does
attempt to open partition table in case we do have FreeBSD MBR partition type.
Instead, we should check -2 (D_PARTWILD).

In case we do have MBR + BSD label, this code is only working because
by default, the first BSD partiton is created starting with relative sector
0, and we can still access the BSD table from that MBR slice.

Reviewed by:	imp
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D20501
2019-06-06 16:27:05 +00:00
Warner Losh
63acab6a5b [zfsboot] Fix boot env back compat (#190)
* Fix boot env back compat

zfsboot must try zfsloader before loader in order to remain compatible
with boot environments created prior to zfs functionality being rolled
into loader proper.

* Improve comments in zfsboot

Explain the significance of the load path order, and put the comment
about looping through the paths in the appropriate scope.

Obtained From:  TrueNAS commit 4c60c62fcf0b6b6eac98ee8d46e7bbea64bc86f5
Submitted by: Ryan Moeller <ryan@freqlabs.com>
2019-06-03 19:10:46 +00:00
Rebecca Cran
ea13a93166 Fix comment parsing in interp_simple.c
loader.rc has comment lines without a trailing space, which get
interpreted as commands. Avoid this by only matching against the
backslash character.

Reviewed by:	imp, tsoome
Differential Revision:	https://reviews.freebsd.org/D20491
2019-06-01 19:47:15 +00:00
Jung-uk Kim
540a97e342 Initialize a variable to fix build with GCC. 2019-05-23 22:49:03 +00:00
Jung-uk Kim
fdb9b7af98 Remove yet another unused variable. 2019-05-23 22:01:05 +00:00
Emmanuel Vadot
8a2ad0aec8 loader: Remove unused variable
Reported by:	lwshu, ci@
2019-05-23 20:04:22 +00:00
Emmanuel Vadot
32199fb311 loader: Add pnp functions for autoloading modules based on linker.hints
This adds some new commands to loader :

- pnpmatch
   This takes a pnpinfo string as argument and tries to find a kernel module
   associated with it. -v and -d option are available and are the same as in
   devmatch (v is verbose, d dumps the hints).
- pnpload
   This takes a pnpinfo string as argument and tries to load a kernel module
   associated with it.
- pnpautoload
   This will attempt to load every kernel module for each buses. Each buses are
   probed, the probe function will generate pnpinfo string and load kernel module
   associated with it if it exists.

Only simplebus for FDT system is implemented for now.
Since we need the dtb and overlays to be applied before searching the tree
fdt_devmatch_next will load and apply the dtb + overlays.

All the pnp parsing code comes from devmatch and is the same at 99%.

Reviewed by:	imp, kevans
Differential Revision:	https://reviews.freebsd.org/D19498
2019-05-23 19:26:50 +00:00
Enji Cooper
637b653270 Unbreak the build when ELF_VERBOSE is defined after r348005
This change properly terminates the formatting string quote modification done
in r348005, which is triggered when `ELF_VERBOSE` is defined.

MFC with:	r348005
Reported by:	ci (amd64, gcc)
2019-05-21 00:46:47 +00:00
Leandro Lupori
ff7449d6f5 [PowerPC64] stand: fix build using clang 8 as compiler
This change fixes "stand" build issues when using clang 8
as compiler.

Submitted by:   alfredo.junior_eldorado.org.br
Reviewed by:    jhibbits
Differential Revision: https://reviews.freebsd.org/D20026
2019-05-20 19:21:35 +00:00
Toomas Soome
b17868a211 loader: fix memory handling errors in module.c
file_loadraw():
check for file_alloc() and strdup() results.
we leak 'name'.

mod_load() does leak 'filename'.

mod_loadkld() does not need to check fp, file_discard() does check.
2019-05-13 22:17:11 +00:00
Toomas Soome
82c29d4fde loader: use DPRINTF in biosdisk.c and define safe DPRINTF
r345066 did miss biosdisk.c.

Also define DPRINTF as ((void)0) for case we do not want debug printouts.

MFC after:	1 week
2019-05-09 13:12:43 +00:00
Toomas Soome
41a1c642e4 loader: ptable_print() needs two tabs sometimes
Since the partition/slice names do vary in length, check the length
of the fixed part of the line against 3 * 8, if the lenth is less than
3 tab stops, print out extra tab.

use snprintf() instead of sprintf.
2019-05-09 11:04:10 +00:00
Toomas Soome
726f09bc6a command_bcache() does not use argv
Therefore mark argv __unused.
2019-05-07 10:01:45 +00:00
Toomas Soome
e3e96239cd loader: bcache code does not need to check argument for free() 2019-05-07 08:14:30 +00:00
Toomas Soome
74772ef1ae loader: use safer DPRINTF body for non-debug case 2019-05-07 07:46:40 +00:00
Toomas Soome
15f5e297d0 loader: validate sectorsize argument in disk_open()
The bug and patch is reported against 11.2, but it is good idea to have
the check in place for all versions.

PR:		236585
Submitted by:	john@feith.com
Reported by:	john@feith.com
MFC after:	1 day
2019-05-05 06:38:47 +00:00
Warner Losh
fa4b817970 Use D_PARTISGPT rather than bare 255
These three cases dovetail with other places in the code where we use
or set D_PARTISGPT when we mean that the partitioning scheme is
GPT. Use this #define to make the code easier to undertand.

Reviewed by: tsoome@
Differential Revision: https://reviews.freebsd.org/D20122
2019-05-01 05:42:13 +00:00
Toomas Soome
4914ee11ae loader: implement map-vdisk and unmap-vdisk commands
illumos update: https://www.illumos.org/issues/10598

Add map-vdisk and unmap-vdisk commands to create virtual disk interface on top of file. This will allow to use disk image from file system to load and start the kernel.

By mapping file, we create vdiskX device, the device will be listed by lsdev [-v] and can be accessed directly as ls vdisk0p1:/path or can be used as value for currdev variable.

vdisk strategy function does not use bcache as we have bcache used with backing file. vdisk can be unmapped when all consumers have closed the open files.

In first iteration we do not support the zfs images because zfs pools do keep the device open (there is no "zpool export" mechanism). Adding zfs support is relatively simple, we just need to run zfs disk probe after mapping is done.

Differential Revision:	https://reviews.freebsd.org/D19733
2019-04-26 17:58:44 +00:00
Ian Lepore
e77f4eb2a0 Restore the ability to open a raw disk or partition in loader(8).
The disk_open() function searches for "the best partition" when slice and
partition information is not provided as part of the device name.  As of
r345477 the slice and partition fields of a disk_devdesc are initialized to
D_SLICEWILD and D_PARTWILD; in the past they were initialized to -1, which
was sometimes interpreted as meaning 'wildcard' and sometimes as 'open the
raw partition' depending on the context.  So as an unintended side effect of
r345477 it became basically impossible to ever open a disk or partition
without doing the 'best partition' search.  One visible effect of that was
the inability to open the raw disk to read the partition table correctly in
zfs_probe_dev(), leading to failures to find the zfs pool unless it was on
the first partition.

Now instead of always initializing slice and partition to wildcards, the
disk_parsedev() function initializes them based on the presence of a
path/file name following the device.  If there is any path or filename
following the ':' that ends the device name, then slice and partition are
initialized to D_SLICEWILD and D_PARTWILD.  If there is nothing after the
':' then it is considered to be a request to open the raw device or
partition itself (not a file stored within it), and the fields are
initialized to D_SLICENONE and D_PARTNONE.

With this change in place, all the tests in src/tools/boot are succesful
again, including the recently-added cases of booting from a zfs pool on
a partition other than slice 1 of the device.

PR:		236981
2019-04-25 15:09:21 +00:00
Toomas Soome
ed79202682 loader: add file_remove() function to undo file_insert_tail().
346002 did miss the fact that we do not only undo the loadaddr, but also
we need to remove the inserted module. Implement file_remove() to do the job.

MFC after:	1w
2019-04-07 13:36:17 +00:00
Toomas Soome
d7125bb1e2 loader: mod_loadkld() error: we previously assumed 'last_file' could be null
The last_file variable is used to reset the loadaddr variable back to original
value; however, it is possible the last_file is NULL, so we can not blindly
trust it. But then again, we can just save the original loadaddr and use
the saved value for recovery.

MFC after:	1w
2019-04-07 12:20:17 +00:00
Toomas Soome
d28c594669 loader: file_addmetadata() should check for memory allocation
malloc() can return NULL.

MFC after:	1w
2019-04-07 12:10:19 +00:00
Toomas Soome
1d28f39d20 loader: remove pointer checks before free() in module.c
free() does check for NULL argument, remove duplicate checks.

MFC after:	1w
2019-04-07 11:55:11 +00:00
Toomas Soome
db7599e9e5 loader: file_addmodule should check for memory allocation
strdup() can return NULL.

MFC after:	1w
2019-04-07 11:50:41 +00:00
Toomas Soome
cef2742e20 loader: malloc+bzero is calloc
Replace malloc+bzero in module.c with calloc.

MFC after:	1w
2019-04-07 11:48:41 +00:00
Marcin Wojtas
b0fefb25c5 Create kernel module to parse Veriexec manifest based on envs
The current approach of injecting manifest into mac_veriexec is to
verify the integrity of it in userspace (veriexec (8)) and pass its
entries into kernel using a char device (/dev/veriexec).
This requires verifying root partition integrity in loader,
for example by using memory disk and checking its hash.
Otherwise if rootfs is compromised an attacker could inject their own data.

This patch introduces an option to parse manifest in kernel based on envs.
The loader sets manifest path and digest.
EVENTHANDLER is used to launch the module right after the rootfs is mounted.
It has to be done this way, since one might want to verify integrity of the init file.
This means that manifest is required to be present on the root partition.
Note that the envs have to be set right before boot to make sure that no one can spoof them.

Submitted by: Kornel Duleba <mindal@semihalf.com>
Reviewed by: sjg
Obtained from: Semihalf
Sponsored by: Stormshield
Differential Revision: https://reviews.freebsd.org/D19281
2019-04-03 03:57:37 +00:00
Ian Lepore
14243f8de7 Distinguish between "no partition" and "choose best partition" with a constant.
The values of the d_slice and d_partition fields of a disk_devdesc have a
few values with special meanings in the disk_open() routine. Through various
evolutions of the loader code over time, a d_partition value of -1 has
meant both "use the first ufs partition found in the bsd label" and "don't
open a bsd partition at all, open the raw slice."

This defines a new special value of -2 to mean open the raw slice, and it
gives symbolic names to all the special values used in d_slice and
d_partition, and adjusts all existing uses of those fields to use the new
constants.

The phab review for this timed out without being accepted, but I'm still
citing it below because there is useful commentary there.

Differential Revision:	https://reviews.freebsd.org/D19262
2019-03-24 18:51:52 +00:00
Ed Maste
fe6ee08134 loader: fix loading of kernels with . in path
The loader indended to search the kernel file name (only) for . but
instead searched the entire path, so paths like
"boot/test.elfv2/kernel" would not work.

Submitted by:	alfredo.junior_eldorado.org.br
Reviewed by:	kevans
MFC after:	2 weeks
Differential Revision:	https://reviews.freebsd.org/D19658
2019-03-20 16:24:47 +00:00
Marcin Wojtas
c42e554dc9 Add missing boot.4th verification
During initialization of the forth interpreter
the loader looks for "/boot/boot.4th"
and executes any code found there.
That file was loaded bypassing verification.
Add a call to verify_file to change that.

Submitted by: Kornel Duleba <mindal@semihalf.com>
Reviewed by: sjg
Obtained from: Semihalf
Sponsored by: Stormshield
2019-03-19 02:45:32 +00:00
Kyle Evans
7325df02c5 stand: Improve some debugging experience
Some of these files using <FOO>_DEBUG defined a DEBUG() macro to serve as a
debug-printf. -DDEBUG is useful to enable some debugging output across
multiple ELF/common parts, so switch the DEBUG-as-printf macros over to
something more like DPRINTF that is more commonly used for this kind of
thing and less likely to conflict.

userboot/elf64_freebsd debugging also assumed %llx for uint64; use PRIx64
instead.

MFC after:	1 week
2019-03-12 16:21:39 +00:00
Emmanuel Vadot
73a41ff81c stand/common/module: Apply style(9) 2019-03-07 18:57:43 +00:00
Simon J. Gerraty
fd1d7567d8 Add -d flag to load command
When doing load -t manifest -d increments debug level

Reviewed by:	stevek
2019-03-04 19:50:59 +00:00
Simon J. Gerraty
8df8b2d3e5 Enable veriexec for loader
This relies on libbearssl and libsecureboot
to verify files read by loader in a maner equivalent
to how mac_veriexec

Note: disabled by default.
Use is initially expected to be by embeded vendors

Reviewed by:	emaste, imp
Sponsored by:	Juniper Networks
Differential Revision:	D16336
2019-02-26 06:22:10 +00:00
Toomas Soome
63f582e0f5 loader: ptable_close() should check its argument
If the passed in table is NULL, just return.
2019-02-18 20:29:19 +00:00
Ian Lepore
7827bb1c2c Garbage collection no-longer-used constant. 2019-02-17 23:48:51 +00:00
Ian Lepore
5b777dbfa5 Make lsdev -v output line up in neat columns by using a fixed width for
the size field and a tab between the partition type and the size.

Changes this

  disk devices:
        disk0 (MMC)
        disk0s1: DOS/Windows            49MB
        disk0s2: FreeBSD                14GB
        disk0s2a: FreeBSD UFS         14GB
        disk0s2b: Unknown             2048KB
        disk0s2d: FreeBSD UFS         2040KB

to this

  disk devices:
        disk0 (MMC)
        disk0s1: DOS/Windows      49MB
        disk0s2: FreeBSD          14GB
        disk0s2a: FreeBSD UFS     14GB
        disk0s2b: Unknown       2048KB
        disk0s2d: FreeBSD UFS   2040KB
2019-02-17 23:46:11 +00:00
Ian Lepore
71c96def1c Use a couple local variables to avoid repetitive long expressions that
cause line-wrapping.
2019-02-17 23:38:17 +00:00
Ian Lepore
4d02caf7cb Restore loader(8)'s ability for lsdev to show partitions within a bsd slice.
I'm pretty sure this used to work at one time, perhaps long ago.  It has
been failing recently because if you call disk_open() with dev->d_partition
set to -1 when d_slice refers to a bsd slice, it assumes you want it to
open the first partition within that slice.  When you then pass that open
dev instance to ptable_open(), it tries to read the start of the 'a'
partition and decides there is no recognizable partition type there.

This restores the old functionality by resetting d_offset to the start
of the raw slice after disk_open() returns.  For good measure, d_partition
is also set back to -1, although that doesn't currently affect anything.

I would have preferred to make disk_open() avoid such rude assumptions and
if you ask for partition -1 you get the raw slice.  But the commit history
shows that someone already did that once (r239058), and had to revert it
(r239232), so I didn't even try to go down that road.
2019-02-17 23:32:09 +00:00
Kyle Evans
e49f2c66d1 stand: dev_net: correct net_open's interpretation of params
net_open previously casted the first vararg to a char * and this was
half-OK: at first, it is passed to netif_open, which would cast it back to
the struct devdesc * that it really is and use it properly. It is then
strdup()d and used as the netdev_name, which is objectively wrong.

Correct it so that the first vararg is properly casted to a struct devdesc *
and the netdev_name gets set properly to make it more clear at a glance that
it's not doing something horribly wrong.

Reported by:	mmel
Reviewed by:	imp, mmel, tsoome
MFC after:	1 week
Differential Revision:	https://reviews.freebsd.org/D19206
2019-02-15 18:28:51 +00:00
Maxim Sobolev
d92fb78458 When handling CMD_CRIT error set command_errmsg to NULL after we dump it out,
so that it does not result in error message printed twice.

OK load doodoo
can't find 'doodoo'
can't find 'doodoo'
OK

MFC after:	2 weeks
2018-11-30 02:14:41 +00:00
Maxim Sobolev
55d5c94943 The libstand's panic() appends its own '\n' to the message, so that users of the API
don't need to supply one.

MFC after:	2 weeks
2018-11-29 18:37:48 +00:00
Toomas Soome
13dcff6bd8 loader: command_bcache() should print unsigned values
All bcache counters are unsigned.
2018-11-29 14:21:01 +00:00
Maxim Sobolev
6c81fe160c Nuke out buffer overflow safety marker code, it duplicates similar code in
the malloc()/free() as well as having potential of softening the handling
in case error is detected down to a mere warning as compared to hard panic
in free().

Submitted by:	tsoome
Differential Revision:	https://reviews.freebsd.org/D18299
2018-11-23 22:36:56 +00:00
Toomas Soome
a3fd276be0 loader: ptable_open() check for ptable_cd9660read result is wrong
The ptable_*read() functions return NULL on read errors (and partition table
closed as an side effect). The ptable_open must check the return value and
act properly.

PR:		232483
Reported by:	lev
Reviewed by:	lev,cem
Differential Revision:	https://reviews.freebsd.org/D17890
2018-11-07 21:36:52 +00:00
Toomas Soome
53e3fbee09 loader: always set media size from partition.
The disk access is validated by using partition table definitions, therefore
we have no need for if statements, just set the disk size.

Of course the partition table itself may be incorrect/inconsistent, but if
so, we are in trouble anyhow.

Differential Revision:	https://reviews.freebsd.org/D17822
2018-11-07 11:14:22 +00:00
Kyle Evans
d3d381b2b1 userboot: handle guest interpreter mismatches more intelligently
The switch to lualoader creates a problem with userboot: the host is
inclined to build userboot with Lua, but the host userboot's interpreter
must match what's available on the guest. For almost all FreeBSD guests in
the wild, Lua is not yet available and a Lua-based userboot will fail.

This revision updates userboot protocol to version 5, which adds a
swap_interpreter callback to request a different interpreter, and tries to
determine the proper interpreter to be used based on how the guest
/boot/loader is compiled. This is still a bit of a guess, but it's likely
the best possible guess we can make in order to get it right. The
interpreter is now embedded in the resulting executable, so we can open
/boot/loader on the guest and hunt that down to derive the interpreter it
was built with.

Using -l with bhyveload will not allow an intepreter swap, even if the
loader specified happens to be a userboot with the wrong interpreter. We'll
simply complain about the mismatch and bail out.

For legacy guests without the interpreter marker, we assume they're 4th.
For new guests with the interpreter marker, we'll read it and swap over
to the proper interpreter if it doesn't match what the userboot we're using
was compiled with.

Both flavors of userboot are installed by default, userboot_4th.so and
userboot_lua.so. This fixes the build WITHOUT_FORTH as a coincidence, which
was broken by userboot being forced to 4th.

Reviewed by:	imp, jhb, araujo (earlier version)
Approved by:	re (gjb)
Differential Revision:	https://reviews.freebsd.org/D16945
2018-09-01 02:23:45 +00:00
Kyle Evans
2ac6dfb0c2 lualoader: Print error messages from command failures at the prompt
Previously lualoader would remain silent, rather than printing
command_errmsg or noting that a command had failed or was not found.

Approved by:	re (gjb)
2018-08-31 15:02:53 +00:00