xref: /openbsd-src/usr.sbin/vmd/loadfile_elf.c (revision 097a140d792de8b2bbe59ad827d39eabf9b4280a)
1 /* $NetBSD: loadfile.c,v 1.10 2000/12/03 02:53:04 tsutsui Exp $ */
2 /* $OpenBSD: loadfile_elf.c,v 1.38 2021/04/05 18:09:48 dv Exp $ */
3 
4 /*-
5  * Copyright (c) 1997 The NetBSD Foundation, Inc.
6  * All rights reserved.
7  *
8  * This code is derived from software contributed to The NetBSD Foundation
9  * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility,
10  * NASA Ames Research Center and by Christos Zoulas.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
23  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
24  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
25  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
26  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
27  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
28  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
29  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
30  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
31  * POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 /*
35  * Copyright (c) 1992, 1993
36  *	The Regents of the University of California.  All rights reserved.
37  *
38  * This code is derived from software contributed to Berkeley by
39  * Ralph Campbell.
40  *
41  * Redistribution and use in source and binary forms, with or without
42  * modification, are permitted provided that the following conditions
43  * are met:
44  * 1. Redistributions of source code must retain the above copyright
45  *    notice, this list of conditions and the following disclaimer.
46  * 2. Redistributions in binary form must reproduce the above copyright
47  *    notice, this list of conditions and the following disclaimer in the
48  *    documentation and/or other materials provided with the distribution.
49  * 3. Neither the name of the University nor the names of its contributors
50  *    may be used to endorse or promote products derived from this software
51  *    without specific prior written permission.
52  *
53  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
54  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
57  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
58  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
59  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
60  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
61  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
62  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
63  * SUCH DAMAGE.
64  *
65  *	@(#)boot.c	8.1 (Berkeley) 6/10/93
66  */
67 
68 /*
69  * Copyright (c) 2015 Mike Larkin <mlarkin@openbsd.org>
70  *
71  * Permission to use, copy, modify, and distribute this software for any
72  * purpose with or without fee is hereby granted, provided that the above
73  * copyright notice and this permission notice appear in all copies.
74  *
75  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
76  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
77  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
78  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
79  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
80  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
81  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
82  */
83 
84 #include <sys/param.h>	/* PAGE_SIZE PAGE_MASK roundup */
85 #include <sys/ioctl.h>
86 #include <sys/reboot.h>
87 #include <sys/exec.h>
88 
89 #include <elf.h>
90 #include <stdio.h>
91 #include <string.h>
92 #include <errno.h>
93 #include <stdlib.h>
94 #include <unistd.h>
95 #include <fcntl.h>
96 #include <err.h>
97 #include <errno.h>
98 #include <stddef.h>
99 
100 #include <machine/vmmvar.h>
101 #include <machine/biosvar.h>
102 #include <machine/segments.h>
103 #include <machine/specialreg.h>
104 #include <machine/pte.h>
105 
106 #include "loadfile.h"
107 #include "vmd.h"
108 
109 #define LOADADDR(a)            ((((u_long)(a)) + offset)&0xfffffff)
110 
111 union {
112 	Elf32_Ehdr elf32;
113 	Elf64_Ehdr elf64;
114 } hdr;
115 
116 static void setsegment(struct mem_segment_descriptor *, uint32_t,
117     size_t, int, int, int, int);
118 static int elf32_exec(gzFile, Elf32_Ehdr *, u_long *, int);
119 static int elf64_exec(gzFile, Elf64_Ehdr *, u_long *, int);
120 static size_t create_bios_memmap(struct vm_create_params *, bios_memmap_t *);
121 static uint32_t push_bootargs(bios_memmap_t *, size_t);
122 static size_t push_stack(uint32_t, uint32_t);
123 static void push_gdt(void);
124 static void push_pt_32(void);
125 static void push_pt_64(void);
126 static void marc4random_buf(paddr_t, int);
127 static void mbzero(paddr_t, int);
128 static void mbcopy(void *, paddr_t, int);
129 
130 extern char *__progname;
131 extern int vm_id;
132 
133 /*
134  * setsegment
135  *
136  * Initializes a segment selector entry with the provided descriptor.
137  * For the purposes of the bootloader mimiced by vmd(8), we only need
138  * memory-type segment descriptor support.
139  *
140  * This function was copied from machdep.c
141  *
142  * Parameters:
143  *  sd: Address of the entry to initialize
144  *  base: base of the segment
145  *  limit: limit of the segment
146  *  type: type of the segment
147  *  dpl: privilege level of the egment
148  *  def32: default 16/32 bit size of the segment
149  *  gran: granularity of the segment (byte/page)
150  */
151 static void
152 setsegment(struct mem_segment_descriptor *sd, uint32_t base, size_t limit,
153     int type, int dpl, int def32, int gran)
154 {
155 	sd->sd_lolimit = (int)limit;
156 	sd->sd_lobase = (int)base;
157 	sd->sd_type = type;
158 	sd->sd_dpl = dpl;
159 	sd->sd_p = 1;
160 	sd->sd_hilimit = (int)limit >> 16;
161 	sd->sd_avl = 0;
162 	sd->sd_long = 0;
163 	sd->sd_def32 = def32;
164 	sd->sd_gran = gran;
165 	sd->sd_hibase = (int)base >> 24;
166 }
167 
168 /*
169  * push_gdt
170  *
171  * Allocates and populates a page in the guest phys memory space to hold
172  * the boot-time GDT. Since vmd(8) is acting as the bootloader, we need to
173  * create the same GDT that a real bootloader would have created.
174  * This is loaded into the guest phys RAM space at address GDT_PAGE.
175  */
176 static void
177 push_gdt(void)
178 {
179 	uint8_t gdtpage[PAGE_SIZE];
180 	struct mem_segment_descriptor *sd;
181 
182 	memset(&gdtpage, 0, sizeof(gdtpage));
183 
184 	sd = (struct mem_segment_descriptor *)&gdtpage;
185 
186 	/*
187 	 * Create three segment descriptors:
188 	 *
189 	 * GDT[0] : null desriptor. "Created" via memset above.
190 	 * GDT[1] (selector @ 0x8): Executable segment, for CS
191 	 * GDT[2] (selector @ 0x10): RW Data segment, for DS/ES/SS
192 	 */
193 	setsegment(&sd[1], 0, 0xffffffff, SDT_MEMERA, SEL_KPL, 1, 1);
194 	setsegment(&sd[2], 0, 0xffffffff, SDT_MEMRWA, SEL_KPL, 1, 1);
195 
196 	write_mem(GDT_PAGE, gdtpage, PAGE_SIZE);
197 }
198 
199 /*
200  * push_pt_32
201  *
202  * Create an identity-mapped page directory hierarchy mapping the first
203  * 4GB of physical memory. This is used during bootstrapping i386 VMs on
204  * CPUs without unrestricted guest capability.
205  */
206 static void
207 push_pt_32(void)
208 {
209 	uint32_t ptes[1024], i;
210 
211 	memset(ptes, 0, sizeof(ptes));
212 	for (i = 0 ; i < 1024; i++) {
213 		ptes[i] = PG_V | PG_RW | PG_u | PG_PS | ((4096 * 1024) * i);
214 	}
215 	write_mem(PML3_PAGE, ptes, PAGE_SIZE);
216 }
217 
218 /*
219  * push_pt_64
220  *
221  * Create an identity-mapped page directory hierarchy mapping the first
222  * 1GB of physical memory. This is used during bootstrapping 64 bit VMs on
223  * CPUs without unrestricted guest capability.
224  */
225 static void
226 push_pt_64(void)
227 {
228 	uint64_t ptes[512], i;
229 
230 	/* PDPDE0 - first 1GB */
231 	memset(ptes, 0, sizeof(ptes));
232 	ptes[0] = PG_V | PML3_PAGE;
233 	write_mem(PML4_PAGE, ptes, PAGE_SIZE);
234 
235 	/* PDE0 - first 1GB */
236 	memset(ptes, 0, sizeof(ptes));
237 	ptes[0] = PG_V | PG_RW | PG_u | PML2_PAGE;
238 	write_mem(PML3_PAGE, ptes, PAGE_SIZE);
239 
240 	/* First 1GB (in 2MB pages) */
241 	memset(ptes, 0, sizeof(ptes));
242 	for (i = 0 ; i < 512; i++) {
243 		ptes[i] = PG_V | PG_RW | PG_u | PG_PS | ((2048 * 1024) * i);
244 	}
245 	write_mem(PML2_PAGE, ptes, PAGE_SIZE);
246 }
247 
248 /*
249  * loadfile_elf
250  *
251  * Loads an ELF kernel to it's defined load address in the guest VM.
252  * The kernel is loaded to its defined start point as set in the ELF header.
253  *
254  * Parameters:
255  *  fp: file of a kernel file to load
256  *  vcp: the VM create parameters, holding the exact memory map
257  *  (out) vrs: register state to set on init for this kernel
258  *  bootdev: the optional non-default boot device
259  *  howto: optional boot flags for the kernel
260  *
261  * Return values:
262  *  0 if successful
263  *  various error codes returned from gzread(3) or loadelf functions
264  */
265 int
266 loadfile_elf(gzFile fp, struct vm_create_params *vcp,
267     struct vcpu_reg_state *vrs)
268 {
269 	int r, is_i386 = 0;
270 	uint32_t bootargsz;
271 	size_t n, stacksize;
272 	u_long marks[MARK_MAX];
273 	bios_memmap_t memmap[VMM_MAX_MEM_RANGES + 1];
274 
275 	if ((r = gzread(fp, &hdr, sizeof(hdr))) != sizeof(hdr))
276 		return 1;
277 
278 	memset(&marks, 0, sizeof(marks));
279 	if (memcmp(hdr.elf32.e_ident, ELFMAG, SELFMAG) == 0 &&
280 	    hdr.elf32.e_ident[EI_CLASS] == ELFCLASS32) {
281 		r = elf32_exec(fp, &hdr.elf32, marks, LOAD_ALL);
282 		is_i386 = 1;
283 	} else if (memcmp(hdr.elf64.e_ident, ELFMAG, SELFMAG) == 0 &&
284 	    hdr.elf64.e_ident[EI_CLASS] == ELFCLASS64) {
285 		r = elf64_exec(fp, &hdr.elf64, marks, LOAD_ALL);
286 	} else
287 		errno = ENOEXEC;
288 
289 	if (r)
290 		return (r);
291 
292 	push_gdt();
293 
294 	if (is_i386) {
295 		push_pt_32();
296 		/* Reconfigure the default flat-64 register set for 32 bit */
297 		vrs->vrs_crs[VCPU_REGS_CR3] = PML3_PAGE;
298 		vrs->vrs_crs[VCPU_REGS_CR4] = CR4_PSE;
299 		vrs->vrs_msrs[VCPU_REGS_EFER] = 0ULL;
300 	}
301 	else
302 		push_pt_64();
303 
304 	n = create_bios_memmap(vcp, memmap);
305 	bootargsz = push_bootargs(memmap, n);
306 	stacksize = push_stack(bootargsz, marks[MARK_END]);
307 
308 	vrs->vrs_gprs[VCPU_REGS_RIP] = (uint64_t)marks[MARK_ENTRY];
309 	vrs->vrs_gprs[VCPU_REGS_RSP] = (uint64_t)(STACK_PAGE + PAGE_SIZE) - stacksize;
310 	vrs->vrs_gdtr.vsi_base = GDT_PAGE;
311 
312 	log_debug("%s: loaded ELF kernel", __func__);
313 
314 	return (0);
315 }
316 
317 /*
318  * create_bios_memmap
319  *
320  * Construct a memory map as returned by the BIOS INT 0x15, e820 routine.
321  *
322  * Parameters:
323  *  vcp: the VM create parameters, containing the memory map passed to vmm(4)
324  *   memmap (out): the BIOS memory map
325  *
326  * Return values:
327  * Number of bios_memmap_t entries, including the terminating nul-entry.
328  */
329 static size_t
330 create_bios_memmap(struct vm_create_params *vcp, bios_memmap_t *memmap)
331 {
332 	size_t i, n = 0, sz;
333 	paddr_t gpa;
334 	struct vm_mem_range *vmr;
335 
336 	for (i = 0; i < vcp->vcp_nmemranges; i++) {
337 		vmr = &vcp->vcp_memranges[i];
338 		gpa = vmr->vmr_gpa;
339 		sz = vmr->vmr_size;
340 
341 		/*
342 		 * Make sure that we do not mark the ROM/video RAM area in the
343 		 * low memory as physcal memory available to the kernel.
344 		 */
345 		if (gpa < 0x100000 && gpa + sz > LOWMEM_KB * 1024) {
346 			if (gpa >= LOWMEM_KB * 1024)
347 				sz = 0;
348 			else
349 				sz = LOWMEM_KB * 1024 - gpa;
350 		}
351 
352 		if (sz != 0) {
353 			memmap[n].addr = gpa;
354 			memmap[n].size = sz;
355 			memmap[n].type = 0x1;	/* Type 1 : Normal memory */
356 			n++;
357 		}
358 	}
359 
360 	/* Null mem map entry to denote the end of the ranges */
361 	memmap[n].addr = 0x0;
362 	memmap[n].size = 0x0;
363 	memmap[n].type = 0x0;
364 	n++;
365 
366 	return (n);
367 }
368 
369 /*
370  * push_bootargs
371  *
372  * Creates the boot arguments page in the guest address space.
373  * Since vmd(8) is acting as the bootloader, we need to create the same boot
374  * arguments page that a real bootloader would have created. This is loaded
375  * into the guest phys RAM space at address BOOTARGS_PAGE.
376  *
377  * Parameters:
378  *  memmap: the BIOS memory map
379  *  n: number of entries in memmap
380  *
381  * Return values:
382  *  The size of the bootargs
383  */
384 static uint32_t
385 push_bootargs(bios_memmap_t *memmap, size_t n)
386 {
387 	uint32_t memmap_sz, consdev_sz, i;
388 	bios_consdev_t consdev;
389 	uint32_t ba[1024];
390 
391 	memmap_sz = 3 * sizeof(int) + n * sizeof(bios_memmap_t);
392 	ba[0] = 0x0;    /* memory map */
393 	ba[1] = memmap_sz;
394 	ba[2] = memmap_sz;	/* next */
395 	memcpy(&ba[3], memmap, n * sizeof(bios_memmap_t));
396 	i = memmap_sz / sizeof(int);
397 
398 	/* Serial console device, COM1 @ 0x3f8 */
399 	consdev.consdev = makedev(8, 0);	/* com1 @ 0x3f8 */
400 	consdev.conspeed = 115200;
401 	consdev.consaddr = 0x3f8;
402 	consdev.consfreq = 0;
403 
404 	consdev_sz = 3 * sizeof(int) + sizeof(bios_consdev_t);
405 	ba[i] = 0x5;   /* consdev */
406 	ba[i + 1] = consdev_sz;
407 	ba[i + 2] = consdev_sz;
408 	memcpy(&ba[i + 3], &consdev, sizeof(bios_consdev_t));
409 	i += consdev_sz / sizeof(int);
410 
411 	ba[i++] = 0xFFFFFFFF; /* BOOTARG_END */
412 
413 	write_mem(BOOTARGS_PAGE, ba, PAGE_SIZE);
414 
415 	return (i * sizeof(int));
416 }
417 
418 /*
419  * push_stack
420  *
421  * Creates the boot stack page in the guest address space. When using a real
422  * bootloader, the stack will be prepared using the following format before
423  * transitioning to kernel start, so vmd(8) needs to mimic the same stack
424  * layout. The stack content is pushed to the guest phys RAM at address
425  * STACK_PAGE. The bootloader operates in 32 bit mode; each stack entry is
426  * 4 bytes.
427  *
428  * Stack Layout: (TOS == Top Of Stack)
429  *  TOS		location of boot arguments page
430  *  TOS - 0x4	size of the content in the boot arguments page
431  *  TOS - 0x8	size of low memory (biosbasemem: kernel uses BIOS map only if 0)
432  *  TOS - 0xc	size of high memory (biosextmem, not used by kernel at all)
433  *  TOS - 0x10	kernel 'end' symbol value
434  *  TOS - 0x14	version of bootarg API
435  *
436  * Parameters:
437  *  bootargsz: size of boot arguments
438  *  end: kernel 'end' symbol value
439  *  bootdev: the optional non-default boot device
440  *  howto: optional boot flags for the kernel
441  *
442  * Return values:
443  *  size of the stack
444  */
445 static size_t
446 push_stack(uint32_t bootargsz, uint32_t end)
447 {
448 	uint32_t stack[1024];
449 	uint16_t loc;
450 
451 	memset(&stack, 0, sizeof(stack));
452 	loc = 1024;
453 
454 	stack[--loc] = BOOTARGS_PAGE;
455 	stack[--loc] = bootargsz;
456 	stack[--loc] = 0; /* biosbasemem */
457 	stack[--loc] = 0; /* biosextmem */
458 	stack[--loc] = end;
459 	stack[--loc] = 0x0e;
460 	stack[--loc] = MAKEBOOTDEV(0x4, 0, 0, 0, 0); /* bootdev: sd0a */
461 	stack[--loc] = 0;
462 
463 	write_mem(STACK_PAGE, &stack, PAGE_SIZE);
464 
465 	return (1024 - (loc - 1)) * sizeof(uint32_t);
466 }
467 
468 /*
469  * mread
470  *
471  * Reads 'sz' bytes from the file whose descriptor is provided in 'fd'
472  * into the guest address space at paddr 'addr'.
473  *
474  * Parameters:
475  *  fp: kernel image file to read from.
476  *  addr: guest paddr_t to load to
477  *  sz: number of bytes to load
478  *
479  * Return values:
480  *  returns 'sz' if successful, or 0 otherwise.
481  */
482 size_t
483 mread(gzFile fp, paddr_t addr, size_t sz)
484 {
485 	size_t ct;
486 	size_t i, rd, osz;
487 	char buf[PAGE_SIZE];
488 
489 	/*
490 	 * break up the 'sz' bytes into PAGE_SIZE chunks for use with
491 	 * write_mem
492 	 */
493 	ct = 0;
494 	rd = 0;
495 	osz = sz;
496 	if ((addr & PAGE_MASK) != 0) {
497 		memset(buf, 0, sizeof(buf));
498 		if (sz > PAGE_SIZE)
499 			ct = PAGE_SIZE - (addr & PAGE_MASK);
500 		else
501 			ct = sz;
502 
503 		if ((size_t)gzread(fp, buf, ct) != ct) {
504 			log_warn("%s: error %d in mread", __progname, errno);
505 			return (0);
506 		}
507 		rd += ct;
508 
509 		if (write_mem(addr, buf, ct))
510 			return (0);
511 
512 		addr += ct;
513 	}
514 
515 	sz = sz - ct;
516 
517 	if (sz == 0)
518 		return (osz);
519 
520 	for (i = 0; i < sz; i += PAGE_SIZE, addr += PAGE_SIZE) {
521 		memset(buf, 0, sizeof(buf));
522 		if (i + PAGE_SIZE > sz)
523 			ct = sz - i;
524 		else
525 			ct = PAGE_SIZE;
526 
527 		if ((size_t)gzread(fp, buf, ct) != ct) {
528 			log_warn("%s: error %d in mread", __progname, errno);
529 			return (0);
530 		}
531 		rd += ct;
532 
533 		if (write_mem(addr, buf, ct))
534 			return (0);
535 	}
536 
537 	return (osz);
538 }
539 
540 /*
541  * marc4random_buf
542  *
543  * load 'sz' bytes of random data into the guest address space at paddr
544  * 'addr'.
545  *
546  * Parameters:
547  *  addr: guest paddr_t to load random bytes into
548  *  sz: number of random bytes to load
549  *
550  * Return values:
551  *  nothing
552  */
553 static void
554 marc4random_buf(paddr_t addr, int sz)
555 {
556 	int i, ct;
557 	char buf[PAGE_SIZE];
558 
559 	/*
560 	 * break up the 'sz' bytes into PAGE_SIZE chunks for use with
561 	 * write_mem
562 	 */
563 	ct = 0;
564 	if (addr % PAGE_SIZE != 0) {
565 		memset(buf, 0, sizeof(buf));
566 		ct = PAGE_SIZE - (addr % PAGE_SIZE);
567 
568 		arc4random_buf(buf, ct);
569 
570 		if (write_mem(addr, buf, ct))
571 			return;
572 
573 		addr += ct;
574 	}
575 
576 	for (i = 0; i < sz; i+= PAGE_SIZE, addr += PAGE_SIZE) {
577 		memset(buf, 0, sizeof(buf));
578 		if (i + PAGE_SIZE > sz)
579 			ct = sz - i;
580 		else
581 			ct = PAGE_SIZE;
582 
583 		arc4random_buf(buf, ct);
584 
585 		if (write_mem(addr, buf, ct))
586 			return;
587 	}
588 }
589 
590 /*
591  * mbzero
592  *
593  * load 'sz' bytes of zeros into the guest address space at paddr
594  * 'addr'.
595  *
596  * Parameters:
597  *  addr: guest paddr_t to zero
598  *  sz: number of zero bytes to store
599  *
600  * Return values:
601  *  nothing
602  */
603 static void
604 mbzero(paddr_t addr, int sz)
605 {
606 	if (write_mem(addr, NULL, sz))
607 		return;
608 }
609 
610 /*
611  * mbcopy
612  *
613  * copies 'sz' bytes from buffer 'src' to guest paddr 'dst'.
614  *
615  * Parameters:
616  *  src: source buffer to copy from
617  *  dst: destination guest paddr_t to copy to
618  *  sz: number of bytes to copy
619  *
620  * Return values:
621  *  nothing
622  */
623 static void
624 mbcopy(void *src, paddr_t dst, int sz)
625 {
626 	write_mem(dst, src, sz);
627 }
628 
629 /*
630  * elf64_exec
631  *
632  * Load the kernel indicated by 'fp' into the guest physical memory
633  * space, at the addresses defined in the ELF header.
634  *
635  * This function is used for 64 bit kernels.
636  *
637  * Parameters:
638  *  fp: kernel image file to load
639  *  elf: ELF header of the kernel
640  *  marks: array to store the offsets of various kernel structures
641  *      (start, bss, etc)
642  *  flags: flag value to indicate which section(s) to load (usually
643  *      LOAD_ALL)
644  *
645  * Return values:
646  *  0 if successful
647  *  1 if unsuccessful
648  */
649 static int
650 elf64_exec(gzFile fp, Elf64_Ehdr *elf, u_long *marks, int flags)
651 {
652 	Elf64_Shdr *shp;
653 	Elf64_Phdr *phdr;
654 	Elf64_Off off;
655 	int i;
656 	size_t sz;
657 	int first;
658 	int havesyms;
659 	paddr_t minp = ~0, maxp = 0, pos = 0;
660 	paddr_t offset = marks[MARK_START], shpp, elfp;
661 
662 	sz = elf->e_phnum * sizeof(Elf64_Phdr);
663 	phdr = malloc(sz);
664 
665 	if (gzseek(fp, (off_t)elf->e_phoff, SEEK_SET) == -1)  {
666 		free(phdr);
667 		return 1;
668 	}
669 
670 	if ((size_t)gzread(fp, phdr, sz) != sz) {
671 		free(phdr);
672 		return 1;
673 	}
674 
675 	for (first = 1, i = 0; i < elf->e_phnum; i++) {
676 		if (phdr[i].p_type == PT_OPENBSD_RANDOMIZE) {
677 			int m;
678 
679 			/* Fill segment if asked for. */
680 			if (flags & LOAD_RANDOM) {
681 				for (pos = 0; pos < phdr[i].p_filesz;
682 				    pos += m) {
683 					m = phdr[i].p_filesz - pos;
684 					marc4random_buf(phdr[i].p_paddr + pos,
685 					    m);
686 				}
687 			}
688 			if (flags & (LOAD_RANDOM | COUNT_RANDOM)) {
689 				marks[MARK_RANDOM] = LOADADDR(phdr[i].p_paddr);
690 				marks[MARK_ERANDOM] =
691 				    marks[MARK_RANDOM] + phdr[i].p_filesz;
692 			}
693 			continue;
694 		}
695 
696 		if (phdr[i].p_type != PT_LOAD ||
697 		    (phdr[i].p_flags & (PF_W|PF_R|PF_X)) == 0)
698 			continue;
699 
700 #define IS_TEXT(p)	(p.p_flags & PF_X)
701 #define IS_DATA(p)	((p.p_flags & PF_X) == 0)
702 #define IS_BSS(p)	(p.p_filesz < p.p_memsz)
703 		/*
704 		 * XXX: Assume first address is lowest
705 		 */
706 		if ((IS_TEXT(phdr[i]) && (flags & LOAD_TEXT)) ||
707 		    (IS_DATA(phdr[i]) && (flags & LOAD_DATA))) {
708 
709 			/* Read in segment. */
710 			if (gzseek(fp, (off_t)phdr[i].p_offset,
711 			    SEEK_SET) == -1) {
712 				free(phdr);
713 				return 1;
714 			}
715 			if (mread(fp, phdr[i].p_paddr, phdr[i].p_filesz) !=
716 			    phdr[i].p_filesz) {
717 				free(phdr);
718 				return 1;
719 			}
720 
721 			first = 0;
722 		}
723 
724 		if ((IS_TEXT(phdr[i]) && (flags & (LOAD_TEXT | COUNT_TEXT))) ||
725 		    (IS_DATA(phdr[i]) && (flags & (LOAD_DATA | COUNT_TEXT)))) {
726 			pos = phdr[i].p_paddr;
727 			if (minp > pos)
728 				minp = pos;
729 			pos += phdr[i].p_filesz;
730 			if (maxp < pos)
731 				maxp = pos;
732 		}
733 
734 		/* Zero out BSS. */
735 		if (IS_BSS(phdr[i]) && (flags & LOAD_BSS)) {
736 			mbzero((phdr[i].p_paddr + phdr[i].p_filesz),
737 			    phdr[i].p_memsz - phdr[i].p_filesz);
738 		}
739 		if (IS_BSS(phdr[i]) && (flags & (LOAD_BSS|COUNT_BSS))) {
740 			pos += phdr[i].p_memsz - phdr[i].p_filesz;
741 			if (maxp < pos)
742 				maxp = pos;
743 		}
744 	}
745 	free(phdr);
746 
747 	/*
748 	 * Copy the ELF and section headers.
749 	 */
750 	elfp = maxp = roundup(maxp, sizeof(Elf64_Addr));
751 	if (flags & (LOAD_HDR | COUNT_HDR))
752 		maxp += sizeof(Elf64_Ehdr);
753 
754 	if (flags & (LOAD_SYM | COUNT_SYM)) {
755 		if (gzseek(fp, (off_t)elf->e_shoff, SEEK_SET) == -1) {
756 			warn("gzseek section headers");
757 			return 1;
758 		}
759 		sz = elf->e_shnum * sizeof(Elf64_Shdr);
760 		shp = malloc(sz);
761 
762 		if ((size_t)gzread(fp, shp, sz) != sz) {
763 			free(shp);
764 			return 1;
765 		}
766 
767 		shpp = maxp;
768 		maxp += roundup(sz, sizeof(Elf64_Addr));
769 
770 		size_t shstrsz = shp[elf->e_shstrndx].sh_size;
771 		char *shstr = malloc(shstrsz);
772 		if (gzseek(fp, (off_t)shp[elf->e_shstrndx].sh_offset,
773 		    SEEK_SET) == -1) {
774 			free(shstr);
775 			free(shp);
776 			return 1;
777 		}
778 		if ((size_t)gzread(fp, shstr, shstrsz) != shstrsz) {
779 			free(shstr);
780 			free(shp);
781 			return 1;
782 		}
783 
784 		/*
785 		 * Now load the symbol sections themselves. Make sure the
786 		 * sections are aligned. Don't bother with string tables if
787 		 * there are no symbol sections.
788 		 */
789 		off = roundup((sizeof(Elf64_Ehdr) + sz), sizeof(Elf64_Addr));
790 
791 		for (havesyms = i = 0; i < elf->e_shnum; i++)
792 			if (shp[i].sh_type == SHT_SYMTAB)
793 				havesyms = 1;
794 
795 		for (first = 1, i = 0; i < elf->e_shnum; i++) {
796 			if (shp[i].sh_type == SHT_SYMTAB ||
797 			    shp[i].sh_type == SHT_STRTAB ||
798 			    !strcmp(shstr + shp[i].sh_name, ".debug_line") ||
799 			    !strcmp(shstr + shp[i].sh_name, ELF_CTF)) {
800 				if (havesyms && (flags & LOAD_SYM)) {
801 					if (gzseek(fp, (off_t)shp[i].sh_offset,
802 					    SEEK_SET) == -1) {
803 						free(shstr);
804 						free(shp);
805 						return 1;
806 					}
807 					if (mread(fp, maxp,
808 					    shp[i].sh_size) != shp[i].sh_size) {
809 						free(shstr);
810 						free(shp);
811 						return 1;
812 					}
813 				}
814 				maxp += roundup(shp[i].sh_size,
815 				    sizeof(Elf64_Addr));
816 				shp[i].sh_offset = off;
817 				shp[i].sh_flags |= SHF_ALLOC;
818 				off += roundup(shp[i].sh_size,
819 				    sizeof(Elf64_Addr));
820 				first = 0;
821 			}
822 		}
823 		if (flags & LOAD_SYM) {
824 			mbcopy(shp, shpp, sz);
825 		}
826 		free(shstr);
827 		free(shp);
828 	}
829 
830 	/*
831 	 * Frob the copied ELF header to give information relative
832 	 * to elfp.
833 	 */
834 	if (flags & LOAD_HDR) {
835 		elf->e_phoff = 0;
836 		elf->e_shoff = sizeof(Elf64_Ehdr);
837 		elf->e_phentsize = 0;
838 		elf->e_phnum = 0;
839 		mbcopy(elf, elfp, sizeof(*elf));
840 	}
841 
842 	marks[MARK_START] = LOADADDR(minp);
843 	marks[MARK_ENTRY] = LOADADDR(elf->e_entry);
844 	marks[MARK_NSYM] = 1;	/* XXX: Kernel needs >= 0 */
845 	marks[MARK_SYM] = LOADADDR(elfp);
846 	marks[MARK_END] = LOADADDR(maxp);
847 
848 	return 0;
849 }
850 
851 /*
852  * elf32_exec
853  *
854  * Load the kernel indicated by 'fp' into the guest physical memory
855  * space, at the addresses defined in the ELF header.
856  *
857  * This function is used for 32 bit kernels.
858  *
859  * Parameters:
860  *  fp: kernel image file to load
861  *  elf: ELF header of the kernel
862  *  marks: array to store the offsets of various kernel structures
863  *      (start, bss, etc)
864  *  flags: flag value to indicate which section(s) to load (usually
865  *      LOAD_ALL)
866  *
867  * Return values:
868  *  0 if successful
869  *  1 if unsuccessful
870  */
871 static int
872 elf32_exec(gzFile fp, Elf32_Ehdr *elf, u_long *marks, int flags)
873 {
874 	Elf32_Shdr *shp;
875 	Elf32_Phdr *phdr;
876 	Elf32_Off off;
877 	int i;
878 	size_t sz;
879 	int first;
880 	int havesyms;
881 	paddr_t minp = ~0, maxp = 0, pos = 0;
882 	paddr_t offset = marks[MARK_START], shpp, elfp;
883 
884 	sz = elf->e_phnum * sizeof(Elf32_Phdr);
885 	phdr = malloc(sz);
886 
887 	if (gzseek(fp, (off_t)elf->e_phoff, SEEK_SET) == -1)  {
888 		free(phdr);
889 		return 1;
890 	}
891 
892 	if ((size_t)gzread(fp, phdr, sz) != sz) {
893 		free(phdr);
894 		return 1;
895 	}
896 
897 	for (first = 1, i = 0; i < elf->e_phnum; i++) {
898 		if (phdr[i].p_type == PT_OPENBSD_RANDOMIZE) {
899 			int m;
900 
901 			/* Fill segment if asked for. */
902 			if (flags & LOAD_RANDOM) {
903 				for (pos = 0; pos < phdr[i].p_filesz;
904 				    pos += m) {
905 					m = phdr[i].p_filesz - pos;
906 					marc4random_buf(phdr[i].p_paddr + pos,
907 					    m);
908 				}
909 			}
910 			if (flags & (LOAD_RANDOM | COUNT_RANDOM)) {
911 				marks[MARK_RANDOM] = LOADADDR(phdr[i].p_paddr);
912 				marks[MARK_ERANDOM] =
913 				    marks[MARK_RANDOM] + phdr[i].p_filesz;
914 			}
915 			continue;
916 		}
917 
918 		if (phdr[i].p_type != PT_LOAD ||
919 		    (phdr[i].p_flags & (PF_W|PF_R|PF_X)) == 0)
920 			continue;
921 
922 #define IS_TEXT(p)	(p.p_flags & PF_X)
923 #define IS_DATA(p)	((p.p_flags & PF_X) == 0)
924 #define IS_BSS(p)	(p.p_filesz < p.p_memsz)
925 		/*
926 		 * XXX: Assume first address is lowest
927 		 */
928 		if ((IS_TEXT(phdr[i]) && (flags & LOAD_TEXT)) ||
929 		    (IS_DATA(phdr[i]) && (flags & LOAD_DATA))) {
930 
931 			/* Read in segment. */
932 			if (gzseek(fp, (off_t)phdr[i].p_offset,
933 			    SEEK_SET) == -1) {
934 				free(phdr);
935 				return 1;
936 			}
937 			if (mread(fp, phdr[i].p_paddr, phdr[i].p_filesz) !=
938 			    phdr[i].p_filesz) {
939 				free(phdr);
940 				return 1;
941 			}
942 
943 			first = 0;
944 		}
945 
946 		if ((IS_TEXT(phdr[i]) && (flags & (LOAD_TEXT | COUNT_TEXT))) ||
947 		    (IS_DATA(phdr[i]) && (flags & (LOAD_DATA | COUNT_TEXT)))) {
948 			pos = phdr[i].p_paddr;
949 			if (minp > pos)
950 				minp = pos;
951 			pos += phdr[i].p_filesz;
952 			if (maxp < pos)
953 				maxp = pos;
954 		}
955 
956 		/* Zero out BSS. */
957 		if (IS_BSS(phdr[i]) && (flags & LOAD_BSS)) {
958 			mbzero((phdr[i].p_paddr + phdr[i].p_filesz),
959 			    phdr[i].p_memsz - phdr[i].p_filesz);
960 		}
961 		if (IS_BSS(phdr[i]) && (flags & (LOAD_BSS|COUNT_BSS))) {
962 			pos += phdr[i].p_memsz - phdr[i].p_filesz;
963 			if (maxp < pos)
964 				maxp = pos;
965 		}
966 	}
967 	free(phdr);
968 
969 	/*
970 	 * Copy the ELF and section headers.
971 	 */
972 	elfp = maxp = roundup(maxp, sizeof(Elf32_Addr));
973 	if (flags & (LOAD_HDR | COUNT_HDR))
974 		maxp += sizeof(Elf32_Ehdr);
975 
976 	if (flags & (LOAD_SYM | COUNT_SYM)) {
977 		if (gzseek(fp, (off_t)elf->e_shoff, SEEK_SET) == -1) {
978 			warn("lseek section headers");
979 			return 1;
980 		}
981 		sz = elf->e_shnum * sizeof(Elf32_Shdr);
982 		shp = malloc(sz);
983 
984 		if ((size_t)gzread(fp, shp, sz) != sz) {
985 			free(shp);
986 			return 1;
987 		}
988 
989 		shpp = maxp;
990 		maxp += roundup(sz, sizeof(Elf32_Addr));
991 
992 		size_t shstrsz = shp[elf->e_shstrndx].sh_size;
993 		char *shstr = malloc(shstrsz);
994 		if (gzseek(fp, (off_t)shp[elf->e_shstrndx].sh_offset,
995 		    SEEK_SET) == -1) {
996 			free(shstr);
997 			free(shp);
998 			return 1;
999 		}
1000 		if ((size_t)gzread(fp, shstr, shstrsz) != shstrsz) {
1001 			free(shstr);
1002 			free(shp);
1003 			return 1;
1004 		}
1005 
1006 		/*
1007 		 * Now load the symbol sections themselves. Make sure the
1008 		 * sections are aligned. Don't bother with string tables if
1009 		 * there are no symbol sections.
1010 		 */
1011 		off = roundup((sizeof(Elf32_Ehdr) + sz), sizeof(Elf32_Addr));
1012 
1013 		for (havesyms = i = 0; i < elf->e_shnum; i++)
1014 			if (shp[i].sh_type == SHT_SYMTAB)
1015 				havesyms = 1;
1016 
1017 		for (first = 1, i = 0; i < elf->e_shnum; i++) {
1018 			if (shp[i].sh_type == SHT_SYMTAB ||
1019 			    shp[i].sh_type == SHT_STRTAB ||
1020 			    !strcmp(shstr + shp[i].sh_name, ".debug_line")) {
1021 				if (havesyms && (flags & LOAD_SYM)) {
1022 					if (gzseek(fp, (off_t)shp[i].sh_offset,
1023 					    SEEK_SET) == -1) {
1024 						free(shstr);
1025 						free(shp);
1026 						return 1;
1027 					}
1028 					if (mread(fp, maxp,
1029 					    shp[i].sh_size) != shp[i].sh_size) {
1030 						free(shstr);
1031 						free(shp);
1032 						return 1;
1033 					}
1034 				}
1035 				maxp += roundup(shp[i].sh_size,
1036 				    sizeof(Elf32_Addr));
1037 				shp[i].sh_offset = off;
1038 				shp[i].sh_flags |= SHF_ALLOC;
1039 				off += roundup(shp[i].sh_size,
1040 				    sizeof(Elf32_Addr));
1041 				first = 0;
1042 			}
1043 		}
1044 		if (flags & LOAD_SYM) {
1045 			mbcopy(shp, shpp, sz);
1046 		}
1047 		free(shstr);
1048 		free(shp);
1049 	}
1050 
1051 	/*
1052 	 * Frob the copied ELF header to give information relative
1053 	 * to elfp.
1054 	 */
1055 	if (flags & LOAD_HDR) {
1056 		elf->e_phoff = 0;
1057 		elf->e_shoff = sizeof(Elf32_Ehdr);
1058 		elf->e_phentsize = 0;
1059 		elf->e_phnum = 0;
1060 		mbcopy(elf, elfp, sizeof(*elf));
1061 	}
1062 
1063 	marks[MARK_START] = LOADADDR(minp);
1064 	marks[MARK_ENTRY] = LOADADDR(elf->e_entry);
1065 	marks[MARK_NSYM] = 1;	/* XXX: Kernel needs >= 0 */
1066 	marks[MARK_SYM] = LOADADDR(elfp);
1067 	marks[MARK_END] = LOADADDR(maxp);
1068 
1069 	return 0;
1070 }
1071