loader: Check access size when calling rom_ptr() to avoid crashes
[qemu.git] / hw / s390x / ipl.c
1 /*
2 * bootloader support
3 *
4 * Copyright IBM, Corp. 2012
5 *
6 * Authors:
7 * Christian Borntraeger <borntraeger@de.ibm.com>
8 *
9 * This work is licensed under the terms of the GNU GPL, version 2 or (at your
10 * option) any later version. See the COPYING file in the top-level directory.
11 *
12 */
13
14 #include "qemu/osdep.h"
15 #include "qapi/error.h"
16 #include "sysemu/sysemu.h"
17 #include "cpu.h"
18 #include "elf.h"
19 #include "hw/loader.h"
20 #include "hw/boards.h"
21 #include "hw/s390x/virtio-ccw.h"
22 #include "hw/s390x/css.h"
23 #include "hw/s390x/ebcdic.h"
24 #include "ipl.h"
25 #include "qemu/error-report.h"
26 #include "qemu/config-file.h"
27 #include "qemu/cutils.h"
28 #include "qemu/option.h"
29 #include "exec/exec-all.h"
30
31 #define KERN_IMAGE_START 0x010000UL
32 #define LINUX_MAGIC_ADDR 0x010008UL
33 #define KERN_PARM_AREA 0x010480UL
34 #define INITRD_START 0x800000UL
35 #define INITRD_PARM_START 0x010408UL
36 #define PARMFILE_START 0x001000UL
37 #define ZIPL_IMAGE_START 0x009000UL
38 #define IPL_PSW_MASK (PSW_MASK_32 | PSW_MASK_64)
39
40 static bool iplb_extended_needed(void *opaque)
41 {
42 S390IPLState *ipl = S390_IPL(object_resolve_path(TYPE_S390_IPL, NULL));
43
44 return ipl->iplbext_migration;
45 }
46
47 static const VMStateDescription vmstate_iplb_extended = {
48 .name = "ipl/iplb_extended",
49 .version_id = 0,
50 .minimum_version_id = 0,
51 .needed = iplb_extended_needed,
52 .fields = (VMStateField[]) {
53 VMSTATE_UINT8_ARRAY(reserved_ext, IplParameterBlock, 4096 - 200),
54 VMSTATE_END_OF_LIST()
55 }
56 };
57
58 static const VMStateDescription vmstate_iplb = {
59 .name = "ipl/iplb",
60 .version_id = 0,
61 .minimum_version_id = 0,
62 .fields = (VMStateField[]) {
63 VMSTATE_UINT8_ARRAY(reserved1, IplParameterBlock, 110),
64 VMSTATE_UINT16(devno, IplParameterBlock),
65 VMSTATE_UINT8_ARRAY(reserved2, IplParameterBlock, 88),
66 VMSTATE_END_OF_LIST()
67 },
68 .subsections = (const VMStateDescription*[]) {
69 &vmstate_iplb_extended,
70 NULL
71 }
72 };
73
74 static const VMStateDescription vmstate_ipl = {
75 .name = "ipl",
76 .version_id = 0,
77 .minimum_version_id = 0,
78 .fields = (VMStateField[]) {
79 VMSTATE_UINT64(compat_start_addr, S390IPLState),
80 VMSTATE_UINT64(compat_bios_start_addr, S390IPLState),
81 VMSTATE_STRUCT(iplb, S390IPLState, 0, vmstate_iplb, IplParameterBlock),
82 VMSTATE_BOOL(iplb_valid, S390IPLState),
83 VMSTATE_UINT8(cssid, S390IPLState),
84 VMSTATE_UINT8(ssid, S390IPLState),
85 VMSTATE_UINT16(devno, S390IPLState),
86 VMSTATE_END_OF_LIST()
87 }
88 };
89
90 static S390IPLState *get_ipl_device(void)
91 {
92 return S390_IPL(object_resolve_path_type("", TYPE_S390_IPL, NULL));
93 }
94
95 static uint64_t bios_translate_addr(void *opaque, uint64_t srcaddr)
96 {
97 uint64_t dstaddr = *(uint64_t *) opaque;
98 /*
99 * Assuming that our s390-ccw.img was linked for starting at address 0,
100 * we can simply add the destination address for the final location
101 */
102 return srcaddr + dstaddr;
103 }
104
105 static void s390_ipl_realize(DeviceState *dev, Error **errp)
106 {
107 S390IPLState *ipl = S390_IPL(dev);
108 uint32_t *ipl_psw;
109 uint64_t pentry;
110 char *magic;
111 int kernel_size;
112 Error *err = NULL;
113
114 int bios_size;
115 char *bios_filename;
116
117 /*
118 * Always load the bios if it was enforced,
119 * even if an external kernel has been defined.
120 */
121 if (!ipl->kernel || ipl->enforce_bios) {
122 uint64_t fwbase = (MIN(ram_size, 0x80000000U) - 0x200000) & ~0xffffUL;
123
124 if (bios_name == NULL) {
125 bios_name = ipl->firmware;
126 }
127
128 bios_filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
129 if (bios_filename == NULL) {
130 error_setg(&err, "could not find stage1 bootloader");
131 goto error;
132 }
133
134 bios_size = load_elf(bios_filename, bios_translate_addr, &fwbase,
135 &ipl->bios_start_addr, NULL, NULL, 1,
136 EM_S390, 0, 0);
137 if (bios_size > 0) {
138 /* Adjust ELF start address to final location */
139 ipl->bios_start_addr += fwbase;
140 } else {
141 /* Try to load non-ELF file */
142 bios_size = load_image_targphys(bios_filename, ZIPL_IMAGE_START,
143 4096);
144 ipl->bios_start_addr = ZIPL_IMAGE_START;
145 }
146 g_free(bios_filename);
147
148 if (bios_size == -1) {
149 error_setg(&err, "could not load bootloader '%s'", bios_name);
150 goto error;
151 }
152
153 /* default boot target is the bios */
154 ipl->start_addr = ipl->bios_start_addr;
155 }
156
157 if (ipl->kernel) {
158 kernel_size = load_elf(ipl->kernel, NULL, NULL, &pentry, NULL,
159 NULL, 1, EM_S390, 0, 0);
160 if (kernel_size < 0) {
161 kernel_size = load_image_targphys(ipl->kernel, 0, ram_size);
162 if (kernel_size < 0) {
163 error_setg(&err, "could not load kernel '%s'", ipl->kernel);
164 goto error;
165 }
166 /* if this is Linux use KERN_IMAGE_START */
167 magic = rom_ptr(LINUX_MAGIC_ADDR, 6);
168 if (magic && !memcmp(magic, "S390EP", 6)) {
169 pentry = KERN_IMAGE_START;
170 } else {
171 /* if not Linux load the address of the (short) IPL PSW */
172 ipl_psw = rom_ptr(4, 4);
173 if (ipl_psw) {
174 pentry = be32_to_cpu(*ipl_psw) & 0x7fffffffUL;
175 } else {
176 error_setg(&err, "Could not get IPL PSW");
177 goto error;
178 }
179 }
180 }
181 /*
182 * Is it a Linux kernel (starting at 0x10000)? If yes, we fill in the
183 * kernel parameters here as well. Note: For old kernels (up to 3.2)
184 * we can not rely on the ELF entry point - it was 0x800 (the SALIPL
185 * loader) and it won't work. For this case we force it to 0x10000, too.
186 */
187 if (pentry == KERN_IMAGE_START || pentry == 0x800) {
188 char *parm_area = rom_ptr(KERN_PARM_AREA, strlen(ipl->cmdline) + 1);
189 ipl->start_addr = KERN_IMAGE_START;
190 /* Overwrite parameters in the kernel image, which are "rom" */
191 if (parm_area) {
192 strcpy(parm_area, ipl->cmdline);
193 }
194 } else {
195 ipl->start_addr = pentry;
196 }
197
198 if (ipl->initrd) {
199 ram_addr_t initrd_offset;
200 int initrd_size;
201 uint64_t *romptr;
202
203 initrd_offset = INITRD_START;
204 while (kernel_size + 0x100000 > initrd_offset) {
205 initrd_offset += 0x100000;
206 }
207 initrd_size = load_image_targphys(ipl->initrd, initrd_offset,
208 ram_size - initrd_offset);
209 if (initrd_size == -1) {
210 error_setg(&err, "could not load initrd '%s'", ipl->initrd);
211 goto error;
212 }
213
214 /*
215 * we have to overwrite values in the kernel image,
216 * which are "rom"
217 */
218 romptr = rom_ptr(INITRD_PARM_START, 16);
219 if (romptr) {
220 stq_p(romptr, initrd_offset);
221 stq_p(romptr + 1, initrd_size);
222 }
223 }
224 }
225 /*
226 * Don't ever use the migrated values, they could come from a different
227 * BIOS and therefore don't work. But still migrate the values, so
228 * QEMUs relying on it don't break.
229 */
230 ipl->compat_start_addr = ipl->start_addr;
231 ipl->compat_bios_start_addr = ipl->bios_start_addr;
232 qemu_register_reset(qdev_reset_all_fn, dev);
233 error:
234 error_propagate(errp, err);
235 }
236
237 static Property s390_ipl_properties[] = {
238 DEFINE_PROP_STRING("kernel", S390IPLState, kernel),
239 DEFINE_PROP_STRING("initrd", S390IPLState, initrd),
240 DEFINE_PROP_STRING("cmdline", S390IPLState, cmdline),
241 DEFINE_PROP_STRING("firmware", S390IPLState, firmware),
242 DEFINE_PROP_STRING("netboot_fw", S390IPLState, netboot_fw),
243 DEFINE_PROP_BOOL("enforce_bios", S390IPLState, enforce_bios, false),
244 DEFINE_PROP_BOOL("iplbext_migration", S390IPLState, iplbext_migration,
245 true),
246 DEFINE_PROP_END_OF_LIST(),
247 };
248
249 static void s390_ipl_set_boot_menu(S390IPLState *ipl)
250 {
251 QemuOptsList *plist = qemu_find_opts("boot-opts");
252 QemuOpts *opts = QTAILQ_FIRST(&plist->head);
253 uint8_t *flags = &ipl->qipl.qipl_flags;
254 uint32_t *timeout = &ipl->qipl.boot_menu_timeout;
255 const char *tmp;
256 unsigned long splash_time = 0;
257
258 if (!get_boot_device(0)) {
259 if (boot_menu) {
260 error_report("boot menu requires a bootindex to be specified for "
261 "the IPL device");
262 }
263 return;
264 }
265
266 switch (ipl->iplb.pbt) {
267 case S390_IPL_TYPE_CCW:
268 /* In the absence of -boot menu, use zipl parameters */
269 if (!qemu_opt_get(opts, "menu")) {
270 *flags |= QIPL_FLAG_BM_OPTS_ZIPL;
271 return;
272 }
273 break;
274 case S390_IPL_TYPE_QEMU_SCSI:
275 break;
276 default:
277 if (boot_menu) {
278 error_report("boot menu is not supported for this device type");
279 }
280 return;
281 }
282
283 if (!boot_menu) {
284 return;
285 }
286
287 *flags |= QIPL_FLAG_BM_OPTS_CMD;
288
289 tmp = qemu_opt_get(opts, "splash-time");
290
291 if (tmp && qemu_strtoul(tmp, NULL, 10, &splash_time)) {
292 error_report("splash-time is invalid, forcing it to 0");
293 *timeout = 0;
294 return;
295 }
296
297 if (splash_time > 0xffffffff) {
298 error_report("splash-time is too large, forcing it to max value");
299 *timeout = 0xffffffff;
300 return;
301 }
302
303 *timeout = cpu_to_be32(splash_time);
304 }
305
306 static CcwDevice *s390_get_ccw_device(DeviceState *dev_st)
307 {
308 CcwDevice *ccw_dev = NULL;
309
310 if (dev_st) {
311 VirtioCcwDevice *virtio_ccw_dev = (VirtioCcwDevice *)
312 object_dynamic_cast(OBJECT(qdev_get_parent_bus(dev_st)->parent),
313 TYPE_VIRTIO_CCW_DEVICE);
314 if (virtio_ccw_dev) {
315 ccw_dev = CCW_DEVICE(virtio_ccw_dev);
316 } else {
317 SCSIDevice *sd = (SCSIDevice *)
318 object_dynamic_cast(OBJECT(dev_st),
319 TYPE_SCSI_DEVICE);
320 if (sd) {
321 SCSIBus *bus = scsi_bus_from_device(sd);
322 VirtIOSCSI *vdev = container_of(bus, VirtIOSCSI, bus);
323 VirtIOSCSICcw *scsi_ccw = container_of(vdev, VirtIOSCSICcw,
324 vdev);
325
326 ccw_dev = (CcwDevice *)object_dynamic_cast(OBJECT(scsi_ccw),
327 TYPE_CCW_DEVICE);
328 }
329 }
330 }
331 return ccw_dev;
332 }
333
334 static bool s390_gen_initial_iplb(S390IPLState *ipl)
335 {
336 DeviceState *dev_st;
337 CcwDevice *ccw_dev = NULL;
338
339 dev_st = get_boot_device(0);
340 if (dev_st) {
341 ccw_dev = s390_get_ccw_device(dev_st);
342 }
343
344 /*
345 * Currently allow IPL only from CCW devices.
346 */
347 if (ccw_dev) {
348 SCSIDevice *sd = (SCSIDevice *) object_dynamic_cast(OBJECT(dev_st),
349 TYPE_SCSI_DEVICE);
350
351 if (sd) {
352 ipl->iplb.len = cpu_to_be32(S390_IPLB_MIN_QEMU_SCSI_LEN);
353 ipl->iplb.blk0_len =
354 cpu_to_be32(S390_IPLB_MIN_QEMU_SCSI_LEN - S390_IPLB_HEADER_LEN);
355 ipl->iplb.pbt = S390_IPL_TYPE_QEMU_SCSI;
356 ipl->iplb.scsi.lun = cpu_to_be32(sd->lun);
357 ipl->iplb.scsi.target = cpu_to_be16(sd->id);
358 ipl->iplb.scsi.channel = cpu_to_be16(sd->channel);
359 ipl->iplb.scsi.devno = cpu_to_be16(ccw_dev->sch->devno);
360 ipl->iplb.scsi.ssid = ccw_dev->sch->ssid & 3;
361 } else {
362 VirtIONet *vn = (VirtIONet *) object_dynamic_cast(OBJECT(dev_st),
363 TYPE_VIRTIO_NET);
364
365 ipl->iplb.len = cpu_to_be32(S390_IPLB_MIN_CCW_LEN);
366 ipl->iplb.blk0_len =
367 cpu_to_be32(S390_IPLB_MIN_CCW_LEN - S390_IPLB_HEADER_LEN);
368 ipl->iplb.pbt = S390_IPL_TYPE_CCW;
369 ipl->iplb.ccw.devno = cpu_to_be16(ccw_dev->sch->devno);
370 ipl->iplb.ccw.ssid = ccw_dev->sch->ssid & 3;
371
372 if (vn) {
373 ipl->netboot = true;
374 }
375 }
376
377 if (!s390_ipl_set_loadparm(ipl->iplb.loadparm)) {
378 ipl->iplb.flags |= DIAG308_FLAGS_LP_VALID;
379 }
380
381 return true;
382 }
383
384 return false;
385 }
386
387 int s390_ipl_set_loadparm(uint8_t *loadparm)
388 {
389 MachineState *machine = MACHINE(qdev_get_machine());
390 char *lp = object_property_get_str(OBJECT(machine), "loadparm", NULL);
391
392 if (lp) {
393 int i;
394
395 /* lp is an uppercase string without leading/embedded spaces */
396 for (i = 0; i < 8 && lp[i]; i++) {
397 loadparm[i] = ascii2ebcdic[(uint8_t) lp[i]];
398 }
399
400 if (i < 8) {
401 memset(loadparm + i, 0x40, 8 - i); /* fill with EBCDIC spaces */
402 }
403
404 g_free(lp);
405 return 0;
406 }
407
408 return -1;
409 }
410
411 static int load_netboot_image(Error **errp)
412 {
413 S390IPLState *ipl = get_ipl_device();
414 char *netboot_filename;
415 MemoryRegion *sysmem = get_system_memory();
416 MemoryRegion *mr = NULL;
417 void *ram_ptr = NULL;
418 int img_size = -1;
419
420 mr = memory_region_find(sysmem, 0, 1).mr;
421 if (!mr) {
422 error_setg(errp, "Failed to find memory region at address 0");
423 return -1;
424 }
425
426 ram_ptr = memory_region_get_ram_ptr(mr);
427 if (!ram_ptr) {
428 error_setg(errp, "No RAM found");
429 goto unref_mr;
430 }
431
432 netboot_filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, ipl->netboot_fw);
433 if (netboot_filename == NULL) {
434 error_setg(errp, "Could not find network bootloader '%s'",
435 ipl->netboot_fw);
436 goto unref_mr;
437 }
438
439 img_size = load_elf_ram(netboot_filename, NULL, NULL, &ipl->start_addr,
440 NULL, NULL, 1, EM_S390, 0, 0, NULL, false);
441
442 if (img_size < 0) {
443 img_size = load_image_size(netboot_filename, ram_ptr, ram_size);
444 ipl->start_addr = KERN_IMAGE_START;
445 }
446
447 if (img_size < 0) {
448 error_setg(errp, "Failed to load network bootloader");
449 }
450
451 g_free(netboot_filename);
452
453 unref_mr:
454 memory_region_unref(mr);
455 return img_size;
456 }
457
458 static bool is_virtio_ccw_device_of_type(IplParameterBlock *iplb,
459 int virtio_id)
460 {
461 uint8_t cssid;
462 uint8_t ssid;
463 uint16_t devno;
464 uint16_t schid;
465 SubchDev *sch = NULL;
466
467 if (iplb->pbt != S390_IPL_TYPE_CCW) {
468 return false;
469 }
470
471 devno = be16_to_cpu(iplb->ccw.devno);
472 ssid = iplb->ccw.ssid & 3;
473
474 for (schid = 0; schid < MAX_SCHID; schid++) {
475 for (cssid = 0; cssid < MAX_CSSID; cssid++) {
476 sch = css_find_subch(1, cssid, ssid, schid);
477
478 if (sch && sch->devno == devno) {
479 return sch->id.cu_model == virtio_id;
480 }
481 }
482 }
483 return false;
484 }
485
486 static bool is_virtio_net_device(IplParameterBlock *iplb)
487 {
488 return is_virtio_ccw_device_of_type(iplb, VIRTIO_ID_NET);
489 }
490
491 static bool is_virtio_scsi_device(IplParameterBlock *iplb)
492 {
493 return is_virtio_ccw_device_of_type(iplb, VIRTIO_ID_SCSI);
494 }
495
496 void s390_ipl_update_diag308(IplParameterBlock *iplb)
497 {
498 S390IPLState *ipl = get_ipl_device();
499
500 ipl->iplb = *iplb;
501 ipl->iplb_valid = true;
502 ipl->netboot = is_virtio_net_device(iplb);
503 }
504
505 IplParameterBlock *s390_ipl_get_iplb(void)
506 {
507 S390IPLState *ipl = get_ipl_device();
508
509 if (!ipl->iplb_valid) {
510 return NULL;
511 }
512 return &ipl->iplb;
513 }
514
515 void s390_ipl_reset_request(CPUState *cs, enum s390_reset reset_type)
516 {
517 S390IPLState *ipl = get_ipl_device();
518
519 if (reset_type == S390_RESET_EXTERNAL || reset_type == S390_RESET_REIPL) {
520 /* use CPU 0 for full resets */
521 ipl->reset_cpu_index = 0;
522 } else {
523 ipl->reset_cpu_index = cs->cpu_index;
524 }
525 ipl->reset_type = reset_type;
526
527 if (reset_type == S390_RESET_REIPL &&
528 ipl->iplb_valid &&
529 !ipl->netboot &&
530 ipl->iplb.pbt == S390_IPL_TYPE_CCW &&
531 is_virtio_scsi_device(&ipl->iplb)) {
532 CcwDevice *ccw_dev = s390_get_ccw_device(get_boot_device(0));
533
534 if (ccw_dev &&
535 cpu_to_be16(ccw_dev->sch->devno) == ipl->iplb.ccw.devno &&
536 (ccw_dev->sch->ssid & 3) == ipl->iplb.ccw.ssid) {
537 /*
538 * this is the original boot device's SCSI
539 * so restore IPL parameter info from it
540 */
541 ipl->iplb_valid = s390_gen_initial_iplb(ipl);
542 }
543 }
544 if (reset_type == S390_RESET_MODIFIED_CLEAR ||
545 reset_type == S390_RESET_LOAD_NORMAL) {
546 /* ignore -no-reboot, send no event */
547 qemu_system_reset_request(SHUTDOWN_CAUSE_SUBSYSTEM_RESET);
548 } else {
549 qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
550 }
551 /* as this is triggered by a CPU, make sure to exit the loop */
552 if (tcg_enabled()) {
553 cpu_loop_exit(cs);
554 }
555 }
556
557 void s390_ipl_get_reset_request(CPUState **cs, enum s390_reset *reset_type)
558 {
559 S390IPLState *ipl = get_ipl_device();
560
561 *cs = qemu_get_cpu(ipl->reset_cpu_index);
562 if (!*cs) {
563 /* use any CPU */
564 *cs = first_cpu;
565 }
566 *reset_type = ipl->reset_type;
567 }
568
569 void s390_ipl_clear_reset_request(void)
570 {
571 S390IPLState *ipl = get_ipl_device();
572
573 ipl->reset_type = S390_RESET_EXTERNAL;
574 /* use CPU 0 for full resets */
575 ipl->reset_cpu_index = 0;
576 }
577
578 static void s390_ipl_prepare_qipl(S390CPU *cpu)
579 {
580 S390IPLState *ipl = get_ipl_device();
581 uint8_t *addr;
582 uint64_t len = 4096;
583
584 addr = cpu_physical_memory_map(cpu->env.psa, &len, 1);
585 if (!addr || len < QIPL_ADDRESS + sizeof(QemuIplParameters)) {
586 error_report("Cannot set QEMU IPL parameters");
587 return;
588 }
589 memcpy(addr + QIPL_ADDRESS, &ipl->qipl, sizeof(QemuIplParameters));
590 cpu_physical_memory_unmap(addr, len, 1, len);
591 }
592
593 void s390_ipl_prepare_cpu(S390CPU *cpu)
594 {
595 S390IPLState *ipl = get_ipl_device();
596 Error *err = NULL;
597
598 cpu->env.psw.addr = ipl->start_addr;
599 cpu->env.psw.mask = IPL_PSW_MASK;
600
601 if (!ipl->kernel || ipl->iplb_valid) {
602 cpu->env.psw.addr = ipl->bios_start_addr;
603 if (!ipl->iplb_valid) {
604 ipl->iplb_valid = s390_gen_initial_iplb(ipl);
605 }
606 }
607 if (ipl->netboot) {
608 if (load_netboot_image(&err) < 0) {
609 error_report_err(err);
610 exit(1);
611 }
612 ipl->qipl.netboot_start_addr = cpu_to_be64(ipl->start_addr);
613 }
614 s390_ipl_set_boot_menu(ipl);
615 s390_ipl_prepare_qipl(cpu);
616 }
617
618 static void s390_ipl_reset(DeviceState *dev)
619 {
620 S390IPLState *ipl = S390_IPL(dev);
621
622 if (ipl->reset_type != S390_RESET_REIPL) {
623 ipl->iplb_valid = false;
624 memset(&ipl->iplb, 0, sizeof(IplParameterBlock));
625 }
626 }
627
628 static void s390_ipl_class_init(ObjectClass *klass, void *data)
629 {
630 DeviceClass *dc = DEVICE_CLASS(klass);
631
632 dc->realize = s390_ipl_realize;
633 dc->props = s390_ipl_properties;
634 dc->reset = s390_ipl_reset;
635 dc->vmsd = &vmstate_ipl;
636 set_bit(DEVICE_CATEGORY_MISC, dc->categories);
637 /* Reason: Loads the ROMs and thus can only be used one time - internally */
638 dc->user_creatable = false;
639 }
640
641 static const TypeInfo s390_ipl_info = {
642 .class_init = s390_ipl_class_init,
643 .parent = TYPE_DEVICE,
644 .name = TYPE_S390_IPL,
645 .instance_size = sizeof(S390IPLState),
646 };
647
648 static void s390_ipl_register_types(void)
649 {
650 type_register_static(&s390_ipl_info);
651 }
652
653 type_init(s390_ipl_register_types)