Commit Graph

40 Commits

Author SHA1 Message Date
Kyle Evans
b3a1768824 userboot: mark host_fsops as extern
This is already defined elsewhere; mark this declaration extern to the fix
the -fno-common build.

MFC after:	3 days
2020-03-29 02:29:06 +00:00
Simon J. Gerraty
53f151f906 Fix pkgfs stat so it satisfies libsecureboot
We need a valid st_dev, st_ino and st_mtime
to correctly track which files have been verified
and to update our notion of time.

ve_utc_set(): ignore utc if it would jump our current time
by more than VE_UTC_MAX_JUMP (20 years).

Allow testing of install command via userboot.
Need to fix its stat implementation too.

bhyveload also needs stat fixed - due to change to userboot.h

Call ve_error_get() from vectx_close() when hash is wrong.

Track the names of files we have hashed into pcr

For the purposes of measured boot, it is important
to be able to reproduce the hash reflected in
loader.ve.pcr
so loader.ve.hashed provides a list of names in the order they
were added.

Reviewed by:	imp
MFC after:	1 week
Sponsored by:	Juniper Networks
Differential Revision:	https://reviews.freebsd.org//D24027
2020-03-25 19:12:19 +00:00
Simon J. Gerraty
afc571b1a6 veloader use vectx API for kernel and modules
The vectx API, computes the hash for verifying a file as it is read.
This avoids the overhead of reading files twice - once to verify, then
again to load.

For doing an install via loader, avoiding the need to rewind
large files is critical.

This API is only used for modules, kernel and mdimage as these are the
biggest files read by the loader.
The reduction in boot time depends on how expensive the I/O is
on any given platform.  On a fast VM we see 6% improvement.

For install via loader the first file to be verified is likely to be the
kernel, so some of the prep work (finding manifest etc) done by
verify_file() needs to be factored so it can be reused for
vectx_open().

For missing or unrecognized fingerprint entries, we fail
in vectx_open() unless verifying is disabled.

Otherwise fingerprint check happens in vectx_close() and
since this API is only used for files which must be verified
(VE_MUST) we panic if we get an incorrect hash.

Reviewed by:	imp,tsoome
MFC after:	1 week
Sponsored by:	Juniper Networks
Differential Revision:	https://reviews.freebsd.org//D23827
2020-03-08 17:42:42 +00:00
Toomas Soome
bcbb1e60a1 loader: userboot/test should accept more than one disk
allow to specify multiple -d options, test -d disk1 -d disk2 ..
2019-11-03 09:14:29 +00:00
Toomas Soome
96b2f9c996 userboot/test should use PRIx64 as one would expect from prefix 0x
Test is printing decimal value after prefix 0x.
2019-10-24 07:49:33 +00:00
Ian Lepore
14243f8de7 Distinguish between "no partition" and "choose best partition" with a constant.
The values of the d_slice and d_partition fields of a disk_devdesc have a
few values with special meanings in the disk_open() routine. Through various
evolutions of the loader code over time, a d_partition value of -1 has
meant both "use the first ufs partition found in the bsd label" and "don't
open a bsd partition at all, open the raw slice."

This defines a new special value of -2 to mean open the raw slice, and it
gives symbolic names to all the special values used in d_slice and
d_partition, and adjusts all existing uses of those fields to use the new
constants.

The phab review for this timed out without being accepted, but I'm still
citing it below because there is useful commentary there.

Differential Revision:	https://reviews.freebsd.org/D19262
2019-03-24 18:51:52 +00:00
Kyle Evans
7325df02c5 stand: Improve some debugging experience
Some of these files using <FOO>_DEBUG defined a DEBUG() macro to serve as a
debug-printf. -DDEBUG is useful to enable some debugging output across
multiple ELF/common parts, so switch the DEBUG-as-printf macros over to
something more like DPRINTF that is more commonly used for this kind of
thing and less likely to conflict.

userboot/elf64_freebsd debugging also assumed %llx for uint64; use PRIx64
instead.

MFC after:	1 week
2019-03-12 16:21:39 +00:00
Matt Macy
fbeb31a26b MK_ZFS -> {MK_ZFS|MK_LOADER_ZFS}, this is so we can diable userland / kernel
ZFS but keep the boot-loaders when using ZoL port.

MFC after: 1 week
Reviewed by: rgrimes
Differential Revision: https://reviews.freebsd.org/D18739
2019-01-05 22:45:20 +00:00
Kyle Evans
d3d381b2b1 userboot: handle guest interpreter mismatches more intelligently
The switch to lualoader creates a problem with userboot: the host is
inclined to build userboot with Lua, but the host userboot's interpreter
must match what's available on the guest. For almost all FreeBSD guests in
the wild, Lua is not yet available and a Lua-based userboot will fail.

This revision updates userboot protocol to version 5, which adds a
swap_interpreter callback to request a different interpreter, and tries to
determine the proper interpreter to be used based on how the guest
/boot/loader is compiled. This is still a bit of a guess, but it's likely
the best possible guess we can make in order to get it right. The
interpreter is now embedded in the resulting executable, so we can open
/boot/loader on the guest and hunt that down to derive the interpreter it
was built with.

Using -l with bhyveload will not allow an intepreter swap, even if the
loader specified happens to be a userboot with the wrong interpreter. We'll
simply complain about the mismatch and bail out.

For legacy guests without the interpreter marker, we assume they're 4th.
For new guests with the interpreter marker, we'll read it and swap over
to the proper interpreter if it doesn't match what the userboot we're using
was compiled with.

Both flavors of userboot are installed by default, userboot_4th.so and
userboot_lua.so. This fixes the build WITHOUT_FORTH as a coincidence, which
was broken by userboot being forced to 4th.

Reviewed by:	imp, jhb, araujo (earlier version)
Approved by:	re (gjb)
Differential Revision:	https://reviews.freebsd.org/D16945
2018-09-01 02:23:45 +00:00
Warner Losh
295506bf9c Turn back the clock just a little: make userboot.so always be 4th
Turns out there was a hidden dependency we hasn't counted upon.  The
host load /boot/userboot.so to boot the VMs it runs. This means that
the change to lua meant suddently that nobody could run their older
VMs because LUA wasn't in 10.0, last month's HardenedBSD, 11.2 or
whatever.  Even more than for the /boot/loader* binaries, we need a
good coexistance strategy for this. While that's being designed and
implemented, drop back to always 4th for userboot.so. This will fail
safe in all but the most extreme environments (but lua-only hacks
to .lua files won't be processes in VMs until we fix it).

Differential Review: https://reviews.freebsd.org/D16805
2018-08-19 18:18:19 +00:00
Ian Lepore
c1418270b2 Extend loader(8) geli support to all architectures and all disk-like devices.
This moves the bulk of the geli support from lib386/biosdisk.c into a new
geli/gelidev.c which implements a devsw-type device whose dv_strategy()
function handles geli decryption. Support for all arches comes from moving
the taste-and-attach code to the devopen() function in libsa.

After opening any DEVT_DISK device, devopen() calls the new function
geli_probe_and_attach(), which will "attach" the geli code to the open_file
struct by creating a geli_devdesc instance to replace the disk_devdesc
instance in the open_file. That routes all IO for the device through the
geli code.

A new public geli_add_key() function is added, to allow arch/vendor-specific
code to add keys obtained from custom hardware or other sources.

With these changes, geli support will be compiled into all variations of
loader(8) on all arches because the default is WITH_LOADER_GELI.

Relnotes:	yes
Sponsored by:	Microchip Technology Inc
Differential Revision:	https://reviews.freebsd.org/D15743
2018-07-13 17:50:25 +00:00
Warner Losh
c96ac12e5c Transition to boot_env_to_howto and boot_howto_to_env in the boot
loader.

Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D16205
2018-07-13 16:43:29 +00:00
Warner Losh
4569e91328 Eliminate boot loader copies of boot arg parsing.
Eliminate 4 of the copies of the arg parsing in /boot/laoder
by using boot_parse_cmdline.

Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D16205
2018-07-13 16:43:23 +00:00
Warner Losh
007b82d7ab Stop using ../zfs/libzfs.h but instead use libzfs.h.
While ../zfs/libzfs.h mostly works, there are a few situations where
it does not. Eliminate the problem by using plain libzfs.h, like we do
for ufs support. This fixes the weird cases, and is easier to
understand. It also follows the general style convetion of avoiding
../ in #includes.
2018-07-08 07:42:58 +00:00
Warner Losh
b8902de147 Move ZFS files into libsa
Move the libzfs stuff into libsa. There's no need for it to be a
separate library. The separate library adds to the issues of build
ordering that we see from time to time. Move the filesystem support
into libsa, like all the other filesystem support rather than making
zfs the odd-duck out.

Discussed with: allanjude@
2018-07-08 07:42:49 +00:00
Warner Losh
5f88ee4479 bootprog_info is generated in vers.c. Move it's definition to
bootstrap.h and remove all the redundant copies.

Sponsored by: Netflix
2018-06-14 06:41:33 +00:00
Kyle Evans
3db6d179e8 stand: One more trivial consolidation (setting environment from howto) 2018-06-09 15:52:29 +00:00
Kyle Evans
593e2c6ece stand: Consolidate checking for boot flags driven by environment vars
e.g. boot_mute, boot_single, boot_verbose, and friends; we checked for these
in multiple places, consolidate into common/ and allow a setting of "NO" for
any of these to turn them off. This allows systems with multiple
loader.conf(5) or loader.conf(5) overlay systems to easily turn off
variables in later processed files by setting it to NO.

Reported by:	Nick Wolff @ iXsystems
Reviewed by:	imp
2018-06-09 15:10:39 +00:00
Ian Lepore
9f6fd8397c Remove comments and assertions that are no longer valid after r330809.
r330809 replaced duplication of devdesc struct fields with an embedded copy
of the devdesc struct, to avoid fragility.  That means all the scattered
comments indicating that structs must match are no longer valid.  Likewise
asserts that attempted to mitigate some of the old fragility.

Reviewed by:	imp@
2018-06-05 22:13:45 +00:00
Warner Losh
3dfe152d8d Pass a struct devdesc to the format commands. Use proper type rather
than doing weird type-punning that happened to work because the size
was right. We copied a zfs devdesc into a disk_devdesc and then after
passing through a NULL pointer reinterpreted it as a
zfs_devdesc. Instead, pass the base devdesc around and 'upcase' when
we know the types are right.

This has the happy side effect of fixing a gcc warning about bad
type punning.

Differential Revision: https://reviews.freebsd.org/D15629
2018-05-31 02:54:11 +00:00
Gleb Smirnoff
695f33df8a Fix typo that misteriously passes compilation. 2018-03-13 22:54:29 +00:00
Warner Losh
56e53cb8ef Prefer uintXX_t to u_intXX_t
A foolish consistency is the hobgoblin of little minds, adored by
little statesmen and philosophers and divines. With consistency a
great soul has simply nothing to do. -- Ralph Waldo Emerson
2018-03-13 16:33:00 +00:00
Warner Losh
ad00892f4c Remove d_type from devdesc. It's not needed as we can fetch it from
d_dev->dv_type when we need it.
2018-03-12 21:39:59 +00:00
Warner Losh
de04d704a9 Use the actual struct devdesc at the start of all *_devdesc structs
The current system is fragile and requires very careful layout of all
*_devdesc structures. It also makes it hard to change the base
devdesc. Take a page from CAM and put the 'header' in all the derived
classes and adjust the code to match.

For OFW, move the iHandle h_handle out of a slot conflicting with
d_opendata. Due to quirks in the alignment rules, this worked.
However changing the code to use d_opendata storage now that it's a
pointer is hard, so just have a separate field for it.

All other cleanups were to make the *_devdesc structures match where
they'd taken some liberties that were none-the-less compatible enough
to work.
2018-03-12 21:39:49 +00:00
Conrad Meyer
2e7e6fbce5 libsa: Const-ify buffer argument of write(2) analog
Reported by:	kevans
Reviewed by:	delphij, eadler, imp, kevans
Sponsored by:	Dell EMC Isilon
Differential Revision:	https://reviews.freebsd.org/D14482
2018-02-23 20:18:09 +00:00
Kyle Evans
b0d9fbf070 Fix userboot w/ ZFS after r329725
r329725 cleaned up ZFS commands duplicated in multiple places, but userboot
was not setting HAVE_ZFS when MK_ZFS != "no". This resulted in a failure to
boot (as seen in PR 226118) in bhyve, with the following message:

/boot/userboot.so: Undefined symbol "ldi_get_size"

PR:		226118
Glanced at by:	imp
2018-02-22 18:49:53 +00:00
Warner Losh
4784aef9f5 Consolidate three copies of ZFS commands into a central location.
There's no reason to have multiple copies of lszfs and
reloadbe. Consolidate them into one location. Also ldi_get_size is the
same everywhere (except sparc64). Make it the same everywhere as the
common definition is more general and will work on spar64.
2018-02-21 15:57:36 +00:00
Warner Losh
11421c37f0 Fix build of userboot.so
Since it's not possible to unset a variable easily, create a new
variable 'PIC' to signal that we are creating a shared object that we
want to install. defs.mk refains from defining NO_PIC and ITNERALLIB
when PIC is defined. This unbreaks userboot.so building.
2018-02-08 22:59:51 +00:00
Warner Losh
891b84a3aa Invent new LDR_INTERP for the loader interpreter to use. Use this in
preference to LIBFICL{,32}. LIBFICL{,32} are now always defined, but
LDR_INTERP{,32} is defined empty when building w/o forth (aka the
simple interpreter) and defined to LIBFICL{,32} when we are building
forth.
2018-02-02 15:40:49 +00:00
Warner Losh
8299b37f85 Centralize several variables.
MK_CTF, MK_SSP, MK_PROFILE, NO_PIC, and INTERNALLIB are always the
same, so set them in defs.mk. MAN= is common, so set it here too.
This removes a lot of boring repetition from the Makefiles that added
almost no value.
2018-02-02 06:32:26 +00:00
Warner Losh
6bc860372d Interact is always called with NULL. Simplify code a little by
removing this argument, and expanding when rc is NULL. This
effectively completes the back out of custom scripts for tftp booted
loaders from r269153 that was started in r292344 with the new path
tricks that obsoleted it.

Submitted by: Netflix
2017-12-19 04:05:55 +00:00
Warner Losh
25c2f4cb95 Move loader help file definitions to being 100% inside of loader.mk.
HELP_FILES is a loader only thing, so move it to loader.mk. Only
generate the help file if HELP_FILES is defined. Adjust Makefiles to
new convention. Fix a few cases where ${.CURDIR}/ was missing
resulting in missing bits from the help files.

Sponsored by: Netflix
2017-12-18 04:51:34 +00:00
Warner Losh
ba25195ebf Revert r326792, r326784, r326772, r326712
Something subtle is creating problems for disk access on ubldr. Back
it out unti that can be sorted out.

Sponsored by: Netflix
2017-12-12 22:06:22 +00:00
Warner Losh
c83457486b Fix regression with lua import
Don't print when we can't find a file. Copy it instead to the error
buffer. Higher level routines determine if it's appropriate to print
the error message.

Also, remove dead code (labeled bogusly lost functionality) since we
never used that functionality. Remove unused arg from interact() too.

Sponsored by: Netflix
2017-12-11 16:18:05 +00:00
Warner Losh
e8e6a5f920 Make putenv and getenv match the userland definition of these
functions, tweak man page and one variable that shouldn't be const
anymore.

Sponsored by: Netflix
2017-12-06 02:00:00 +00:00
Warner Losh
253d60eecc Don't inherit CFLAGS. This a specialized test program, and can be
built with mostly default flags. Do so in anticipation of the rest of
stand not building with system headers.

Sponsored by: Netflix
2017-12-05 21:38:14 +00:00
Warner Losh
59d395e062 Undefine _STANDALONE since this is test code. This is unsastifying,
but since we sadly only have one test, put this in as a stopgap.

Sponsored by: Netflix
2017-12-02 00:07:25 +00:00
Warner Losh
d927d443e1 Mark the func pointer as __dead2. It looks up loader_main, which
either aborts or exits, but never returns. Tag it as a non-returning
function rather than supply a bogus return(0) at the end of main.

CID: 1382885
Sponsored by: Netflix
2017-11-24 05:01:00 +00:00
Warner Losh
8a4217aacf Move some more common stuff up to Makefile.inc. In particular, the no
simd / no float stuff is centeralized here. Also centralise
-ffreestanding since it is specified everywhere.

This, along with a change to share/mk/bsd.cpu.mk to include -mno-avx2
in CFLAGS_NO_SIMD should fix building for newer machines (eg with
CPUTYPE=haswell) where clang was generating avx2 instructions.

Sponsored by: Netflix
2017-11-20 22:42:17 +00:00
Warner Losh
ca987d4641 Move sys/boot to stand. Fix all references to new location
Sponsored by:	Netflix
2017-11-14 23:02:19 +00:00