multiboot: validate multiboot header address values
[qemu/ar7.git] / hw / i386 / multiboot.c
blobc7b70c91d51df58eab67dd804377773abcc2cc04
1 /*
2 * QEMU PC System Emulator
4 * Copyright (c) 2003-2004 Fabrice Bellard
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
25 #include "qemu/osdep.h"
26 #include "qemu-common.h"
27 #include "cpu.h"
28 #include "hw/hw.h"
29 #include "hw/nvram/fw_cfg.h"
30 #include "multiboot.h"
31 #include "hw/loader.h"
32 #include "elf.h"
33 #include "sysemu/sysemu.h"
35 /* Show multiboot debug output */
36 //#define DEBUG_MULTIBOOT
38 #ifdef DEBUG_MULTIBOOT
39 #define mb_debug(a...) fprintf(stderr, ## a)
40 #else
41 #define mb_debug(a...)
42 #endif
44 #define MULTIBOOT_STRUCT_ADDR 0x9000
46 #if MULTIBOOT_STRUCT_ADDR > 0xf0000
47 #error multiboot struct needs to fit in 16 bit real mode
48 #endif
50 enum {
51 /* Multiboot info */
52 MBI_FLAGS = 0,
53 MBI_MEM_LOWER = 4,
54 MBI_MEM_UPPER = 8,
55 MBI_BOOT_DEVICE = 12,
56 MBI_CMDLINE = 16,
57 MBI_MODS_COUNT = 20,
58 MBI_MODS_ADDR = 24,
59 MBI_MMAP_ADDR = 48,
60 MBI_BOOTLOADER = 64,
62 MBI_SIZE = 88,
64 /* Multiboot modules */
65 MB_MOD_START = 0,
66 MB_MOD_END = 4,
67 MB_MOD_CMDLINE = 8,
69 MB_MOD_SIZE = 16,
71 /* Region offsets */
72 ADDR_E820_MAP = MULTIBOOT_STRUCT_ADDR + 0,
73 ADDR_MBI = ADDR_E820_MAP + 0x500,
75 /* Multiboot flags */
76 MULTIBOOT_FLAGS_MEMORY = 1 << 0,
77 MULTIBOOT_FLAGS_BOOT_DEVICE = 1 << 1,
78 MULTIBOOT_FLAGS_CMDLINE = 1 << 2,
79 MULTIBOOT_FLAGS_MODULES = 1 << 3,
80 MULTIBOOT_FLAGS_MMAP = 1 << 6,
81 MULTIBOOT_FLAGS_BOOTLOADER = 1 << 9,
84 typedef struct {
85 /* buffer holding kernel, cmdlines and mb_infos */
86 void *mb_buf;
87 /* address in target */
88 hwaddr mb_buf_phys;
89 /* size of mb_buf in bytes */
90 unsigned mb_buf_size;
91 /* offset of mb-info's in bytes */
92 hwaddr offset_mbinfo;
93 /* offset in buffer for cmdlines in bytes */
94 hwaddr offset_cmdlines;
95 /* offset in buffer for bootloader name in bytes */
96 hwaddr offset_bootloader;
97 /* offset of modules in bytes */
98 hwaddr offset_mods;
99 /* available slots for mb modules infos */
100 int mb_mods_avail;
101 /* currently used slots of mb modules */
102 int mb_mods_count;
103 } MultibootState;
105 const char *bootloader_name = "qemu";
107 static uint32_t mb_add_cmdline(MultibootState *s, const char *cmdline)
109 hwaddr p = s->offset_cmdlines;
110 char *b = (char *)s->mb_buf + p;
112 memcpy(b, cmdline, strlen(cmdline) + 1);
113 s->offset_cmdlines += strlen(b) + 1;
114 return s->mb_buf_phys + p;
117 static uint32_t mb_add_bootloader(MultibootState *s, const char *bootloader)
119 hwaddr p = s->offset_bootloader;
120 char *b = (char *)s->mb_buf + p;
122 memcpy(b, bootloader, strlen(bootloader) + 1);
123 s->offset_bootloader += strlen(b) + 1;
124 return s->mb_buf_phys + p;
127 static void mb_add_mod(MultibootState *s,
128 hwaddr start, hwaddr end,
129 hwaddr cmdline_phys)
131 char *p;
132 assert(s->mb_mods_count < s->mb_mods_avail);
134 p = (char *)s->mb_buf + s->offset_mbinfo + MB_MOD_SIZE * s->mb_mods_count;
136 stl_p(p + MB_MOD_START, start);
137 stl_p(p + MB_MOD_END, end);
138 stl_p(p + MB_MOD_CMDLINE, cmdline_phys);
140 mb_debug("mod%02d: "TARGET_FMT_plx" - "TARGET_FMT_plx"\n",
141 s->mb_mods_count, start, end);
143 s->mb_mods_count++;
146 int load_multiboot(FWCfgState *fw_cfg,
147 FILE *f,
148 const char *kernel_filename,
149 const char *initrd_filename,
150 const char *kernel_cmdline,
151 int kernel_file_size,
152 uint8_t *header)
154 int i, is_multiboot = 0;
155 uint32_t flags = 0;
156 uint32_t mh_entry_addr;
157 uint32_t mh_load_addr;
158 uint32_t mb_kernel_size;
159 MultibootState mbs;
160 uint8_t bootinfo[MBI_SIZE];
161 uint8_t *mb_bootinfo_data;
162 uint32_t cmdline_len;
164 /* Ok, let's see if it is a multiboot image.
165 The header is 12x32bit long, so the latest entry may be 8192 - 48. */
166 for (i = 0; i < (8192 - 48); i += 4) {
167 if (ldl_p(header+i) == 0x1BADB002) {
168 uint32_t checksum = ldl_p(header+i+8);
169 flags = ldl_p(header+i+4);
170 checksum += flags;
171 checksum += (uint32_t)0x1BADB002;
172 if (!checksum) {
173 is_multiboot = 1;
174 break;
179 if (!is_multiboot)
180 return 0; /* no multiboot */
182 mb_debug("qemu: I believe we found a multiboot image!\n");
183 memset(bootinfo, 0, sizeof(bootinfo));
184 memset(&mbs, 0, sizeof(mbs));
186 if (flags & 0x00000004) { /* MULTIBOOT_HEADER_HAS_VBE */
187 fprintf(stderr, "qemu: multiboot knows VBE. we don't.\n");
189 if (!(flags & 0x00010000)) { /* MULTIBOOT_HEADER_HAS_ADDR */
190 uint64_t elf_entry;
191 uint64_t elf_low, elf_high;
192 int kernel_size;
193 fclose(f);
195 if (((struct elf64_hdr*)header)->e_machine == EM_X86_64) {
196 fprintf(stderr, "Cannot load x86-64 image, give a 32bit one.\n");
197 exit(1);
200 kernel_size = load_elf(kernel_filename, NULL, NULL, &elf_entry,
201 &elf_low, &elf_high, 0, I386_ELF_MACHINE,
202 0, 0);
203 if (kernel_size < 0) {
204 fprintf(stderr, "Error while loading elf kernel\n");
205 exit(1);
207 mh_load_addr = elf_low;
208 mb_kernel_size = elf_high - elf_low;
209 mh_entry_addr = elf_entry;
211 mbs.mb_buf = g_malloc(mb_kernel_size);
212 if (rom_copy(mbs.mb_buf, mh_load_addr, mb_kernel_size) != mb_kernel_size) {
213 fprintf(stderr, "Error while fetching elf kernel from rom\n");
214 exit(1);
217 mb_debug("qemu: loading multiboot-elf kernel (%#x bytes) with entry %#zx\n",
218 mb_kernel_size, (size_t)mh_entry_addr);
219 } else {
220 /* Valid if mh_flags sets MULTIBOOT_HEADER_HAS_ADDR. */
221 uint32_t mh_header_addr = ldl_p(header+i+12);
222 uint32_t mh_load_end_addr = ldl_p(header+i+20);
223 uint32_t mh_bss_end_addr = ldl_p(header+i+24);
225 mh_load_addr = ldl_p(header+i+16);
226 if (mh_header_addr < mh_load_addr) {
227 fprintf(stderr, "invalid mh_load_addr address\n");
228 exit(1);
231 uint32_t mb_kernel_text_offset = i - (mh_header_addr - mh_load_addr);
232 uint32_t mb_load_size = 0;
233 mh_entry_addr = ldl_p(header+i+28);
235 if (mh_load_end_addr) {
236 if (mh_bss_end_addr < mh_load_addr) {
237 fprintf(stderr, "invalid mh_bss_end_addr address\n");
238 exit(1);
240 mb_kernel_size = mh_bss_end_addr - mh_load_addr;
242 if (mh_load_end_addr < mh_load_addr) {
243 fprintf(stderr, "invalid mh_load_end_addr address\n");
244 exit(1);
246 mb_load_size = mh_load_end_addr - mh_load_addr;
247 } else {
248 if (kernel_file_size < mb_kernel_text_offset) {
249 fprintf(stderr, "invalid kernel_file_size\n");
250 exit(1);
252 mb_kernel_size = kernel_file_size - mb_kernel_text_offset;
253 mb_load_size = mb_kernel_size;
256 /* Valid if mh_flags sets MULTIBOOT_HEADER_HAS_VBE.
257 uint32_t mh_mode_type = ldl_p(header+i+32);
258 uint32_t mh_width = ldl_p(header+i+36);
259 uint32_t mh_height = ldl_p(header+i+40);
260 uint32_t mh_depth = ldl_p(header+i+44); */
262 mb_debug("multiboot: mh_header_addr = %#x\n", mh_header_addr);
263 mb_debug("multiboot: mh_load_addr = %#x\n", mh_load_addr);
264 mb_debug("multiboot: mh_load_end_addr = %#x\n", mh_load_end_addr);
265 mb_debug("multiboot: mh_bss_end_addr = %#x\n", mh_bss_end_addr);
266 mb_debug("qemu: loading multiboot kernel (%#x bytes) at %#x\n",
267 mb_load_size, mh_load_addr);
269 mbs.mb_buf = g_malloc(mb_kernel_size);
270 fseek(f, mb_kernel_text_offset, SEEK_SET);
271 if (fread(mbs.mb_buf, 1, mb_load_size, f) != mb_load_size) {
272 fprintf(stderr, "fread() failed\n");
273 exit(1);
275 memset(mbs.mb_buf + mb_load_size, 0, mb_kernel_size - mb_load_size);
276 fclose(f);
279 mbs.mb_buf_phys = mh_load_addr;
281 mbs.mb_buf_size = TARGET_PAGE_ALIGN(mb_kernel_size);
282 mbs.offset_mbinfo = mbs.mb_buf_size;
284 /* Calculate space for cmdlines, bootloader name, and mb_mods */
285 cmdline_len = strlen(kernel_filename) + 1;
286 cmdline_len += strlen(kernel_cmdline) + 1;
287 if (initrd_filename) {
288 const char *r = initrd_filename;
289 cmdline_len += strlen(r) + 1;
290 mbs.mb_mods_avail = 1;
291 while (*(r = get_opt_value(NULL, 0, r))) {
292 mbs.mb_mods_avail++;
293 r++;
297 mbs.mb_buf_size += cmdline_len;
298 mbs.mb_buf_size += MB_MOD_SIZE * mbs.mb_mods_avail;
299 mbs.mb_buf_size += strlen(bootloader_name) + 1;
301 mbs.mb_buf_size = TARGET_PAGE_ALIGN(mbs.mb_buf_size);
303 /* enlarge mb_buf to hold cmdlines, bootloader, mb-info structs */
304 mbs.mb_buf = g_realloc(mbs.mb_buf, mbs.mb_buf_size);
305 mbs.offset_cmdlines = mbs.offset_mbinfo + mbs.mb_mods_avail * MB_MOD_SIZE;
306 mbs.offset_bootloader = mbs.offset_cmdlines + cmdline_len;
308 if (initrd_filename) {
309 const char *next_initrd;
310 char not_last, tmpbuf[strlen(initrd_filename) + 1];
312 mbs.offset_mods = mbs.mb_buf_size;
314 do {
315 char *next_space;
316 int mb_mod_length;
317 uint32_t offs = mbs.mb_buf_size;
319 next_initrd = get_opt_value(tmpbuf, sizeof(tmpbuf), initrd_filename);
320 not_last = *next_initrd;
321 /* if a space comes after the module filename, treat everything
322 after that as parameters */
323 hwaddr c = mb_add_cmdline(&mbs, tmpbuf);
324 if ((next_space = strchr(tmpbuf, ' ')))
325 *next_space = '\0';
326 mb_debug("multiboot loading module: %s\n", tmpbuf);
327 mb_mod_length = get_image_size(tmpbuf);
328 if (mb_mod_length < 0) {
329 fprintf(stderr, "Failed to open file '%s'\n", tmpbuf);
330 exit(1);
333 mbs.mb_buf_size = TARGET_PAGE_ALIGN(mb_mod_length + mbs.mb_buf_size);
334 mbs.mb_buf = g_realloc(mbs.mb_buf, mbs.mb_buf_size);
336 load_image(tmpbuf, (unsigned char *)mbs.mb_buf + offs);
337 mb_add_mod(&mbs, mbs.mb_buf_phys + offs,
338 mbs.mb_buf_phys + offs + mb_mod_length, c);
340 mb_debug("mod_start: %p\nmod_end: %p\n cmdline: "TARGET_FMT_plx"\n",
341 (char *)mbs.mb_buf + offs,
342 (char *)mbs.mb_buf + offs + mb_mod_length, c);
343 initrd_filename = next_initrd+1;
344 } while (not_last);
347 /* Commandline support */
348 char kcmdline[strlen(kernel_filename) + strlen(kernel_cmdline) + 2];
349 snprintf(kcmdline, sizeof(kcmdline), "%s %s",
350 kernel_filename, kernel_cmdline);
351 stl_p(bootinfo + MBI_CMDLINE, mb_add_cmdline(&mbs, kcmdline));
353 stl_p(bootinfo + MBI_BOOTLOADER, mb_add_bootloader(&mbs, bootloader_name));
355 stl_p(bootinfo + MBI_MODS_ADDR, mbs.mb_buf_phys + mbs.offset_mbinfo);
356 stl_p(bootinfo + MBI_MODS_COUNT, mbs.mb_mods_count); /* mods_count */
358 /* the kernel is where we want it to be now */
359 stl_p(bootinfo + MBI_FLAGS, MULTIBOOT_FLAGS_MEMORY
360 | MULTIBOOT_FLAGS_BOOT_DEVICE
361 | MULTIBOOT_FLAGS_CMDLINE
362 | MULTIBOOT_FLAGS_MODULES
363 | MULTIBOOT_FLAGS_MMAP
364 | MULTIBOOT_FLAGS_BOOTLOADER);
365 stl_p(bootinfo + MBI_BOOT_DEVICE, 0x8000ffff); /* XXX: use the -boot switch? */
366 stl_p(bootinfo + MBI_MMAP_ADDR, ADDR_E820_MAP);
368 mb_debug("multiboot: mh_entry_addr = %#x\n", mh_entry_addr);
369 mb_debug(" mb_buf_phys = "TARGET_FMT_plx"\n", mbs.mb_buf_phys);
370 mb_debug(" mod_start = "TARGET_FMT_plx"\n", mbs.mb_buf_phys + mbs.offset_mods);
371 mb_debug(" mb_mods_count = %d\n", mbs.mb_mods_count);
373 /* save bootinfo off the stack */
374 mb_bootinfo_data = g_memdup(bootinfo, sizeof(bootinfo));
376 /* Pass variables to option rom */
377 fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_ENTRY, mh_entry_addr);
378 fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_ADDR, mh_load_addr);
379 fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_SIZE, mbs.mb_buf_size);
380 fw_cfg_add_bytes(fw_cfg, FW_CFG_KERNEL_DATA,
381 mbs.mb_buf, mbs.mb_buf_size);
383 fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_ADDR, ADDR_MBI);
384 fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_SIZE, sizeof(bootinfo));
385 fw_cfg_add_bytes(fw_cfg, FW_CFG_INITRD_DATA, mb_bootinfo_data,
386 sizeof(bootinfo));
388 option_rom[nb_option_roms].name = "multiboot.bin";
389 option_rom[nb_option_roms].bootindex = 0;
390 nb_option_roms++;
392 return 1; /* yes, we are multiboot */