/* Create the appropriate mappings for the initramfs */
static int map_initramfs(struct syslinux_movelist **fraglist,
struct syslinux_memmap **mmap,
struct initramfs *initramfs, addr_t addr)
{
struct initramfs *ip;
addr_t next_addr, len, pad;
for (ip = initramfs->next; ip->len; ip = ip->next) {
len = ip->len;
next_addr = addr + len;
/* If this isn't the last entry, extend the zero-pad region
to enforce the alignment of the next chunk. */
if (ip->next->len) {
pad = -next_addr & (ip->next->align - 1);
len += pad;
next_addr += pad;
}
if (ip->data_len) {
if (syslinux_add_movelist(fraglist, addr, (addr_t) ip->data, len))
return -1;
}
if (len > ip->data_len) {
if (syslinux_add_memmap(mmap, addr + ip->data_len,
len - ip->data_len, SMT_ZERO))
return -1;
}
addr = next_addr;
}
return 0;
}
struct syslinux_memmap *test_build_mmap(struct test_memmap_entry *entries,
size_t nr_entries)
{
struct syslinux_memmap *mmap;
int i;
mmap = syslinux_init_memmap();
if (!mmap)
goto bail;
for (i = 0; i < nr_entries; i++) {
enum syslinux_memmap_types type = entries[i].type;
addr_t start = entries[i].start;
addr_t size = entries[i].size;
if (syslinux_add_memmap(&mmap, start, size, type))
goto bail;
}
return mmap;
bail:
syslinux_free_memmap(mmap);
return NULL;
}
/*
* Set up a stack. This isn't actually required by the spec, but it seems
* like a prudent thing to do. Also, put enough zeros at the top of the
* stack that something that looks for an ELF invocation record will know
* there isn't one.
*/
static void mboot_map_stack(void)
{
addr_t start, len;
if (syslinux_memmap_largest(amap, SMT_FREE, &start, &len) || len < 64)
return; /* Not much we can do, here... */
regs.esp = (start + len - 32) & ~15;
dprintf("Mapping stack at 0x%08x\n", regs.esp);
syslinux_add_memmap(&mmap, regs.esp, 32, SMT_ZERO);
}
/*
* Note: although there is no such thing in the spec, at least Xen makes
* assumptions as to where in the memory space Grub would have loaded
* certain things. To support that, if "high" is set, then allocate this
* at an address strictly above any previous allocations.
*
* As a precaution, this also pads the data with zero up to the next
* alignment datum.
*/
addr_t map_data(const void *data, size_t len, size_t align, int flags)
{
addr_t start = (flags & MAP_HIGH) ? mboot_high_water_mark : 0x2000;
addr_t pad = (flags & MAP_NOPAD) ? 0 : -len & (align - 1);
addr_t xlen = len + pad;
if (syslinux_memmap_find(amap, SMT_FREE, &start, &xlen, align) ||
syslinux_add_memmap(&amap, start, len + pad, SMT_ALLOC) ||
syslinux_add_movelist(&ml, start, (addr_t) data, len) ||
(pad && syslinux_add_memmap(&mmap, start + len, pad, SMT_ZERO))) {
printf("Cannot map %zu bytes\n", len + pad);
return 0;
}
dprintf("Mapping 0x%08x bytes (%#x pad) at 0x%08x\n", len, pad, start);
if (start + len + pad > mboot_high_water_mark)
mboot_high_water_mark = start + len + pad;
return start;
}
/*
* Common helper routine: takes a memory map and blots out the
* zones which are used in the destination of a fraglist
*/
struct syslinux_memmap *syslinux_target_memmap(struct syslinux_movelist
*fraglist,
struct syslinux_memmap *memmap)
{
struct syslinux_memmap *tmap;
struct syslinux_movelist *mp;
tmap = syslinux_dup_memmap(memmap);
if (!tmap)
return NULL;
for (mp = fraglist; mp; mp = mp->next) {
if (syslinux_add_memmap(&tmap, mp->dst, mp->len, SMT_ALLOC)) {
syslinux_free_memmap(tmap);
return NULL;
}
}
return tmap;
}
int syslinux_do_shuffle(struct syslinux_movelist *fraglist,
struct syslinux_memmap *memmap,
addr_t entry_point, addr_t entry_type,
uint16_t bootflags)
{
int rv = -1;
struct syslinux_movelist *moves = NULL, *mp;
struct syslinux_memmap *rxmap = NULL, *ml;
struct shuffle_descriptor *dp, *dbuf;
int np;
int desc_blocks, need_blocks;
int need_ptrs;
addr_t desczone, descfree, descaddr;
int nmoves, nzero;
com32sys_t ireg;
descaddr = 0;
dp = dbuf = NULL;
/* Count the number of zero operations */
nzero = 0;
for (ml = memmap; ml->type != SMT_END; ml = ml->next) {
if (ml->type == SMT_ZERO)
nzero++;
}
/* Find the largest contiguous region unused by input *and* output;
this is where we put the move descriptor list and safe area */
rxmap = syslinux_dup_memmap(memmap);
if (!rxmap)
goto bail;
/* Avoid using the low 1 MB for the shuffle area -- this avoids
possible interference with the real mode code or stack */
if (syslinux_add_memmap(&rxmap, 0, 1024 * 1024, SMT_RESERVED))
goto bail;
for (mp = fraglist; mp; mp = mp->next) {
if (syslinux_add_memmap(&rxmap, mp->src, mp->len, SMT_ALLOC) ||
syslinux_add_memmap(&rxmap, mp->dst, mp->len, SMT_ALLOC))
goto bail;
}
if (syslinux_memmap_largest(rxmap, SMT_FREE, &desczone, &descfree))
goto bail;
syslinux_free_memmap(rxmap);
dprintf("desczone = 0x%08x, descfree = 0x%08x\n", desczone, descfree);
rxmap = syslinux_dup_memmap(memmap);
if (!rxmap)
goto bail;
__syslinux_get_shuffer_size();
desc_blocks = (nzero + DESC_BLOCK_SIZE - 1) / DESC_BLOCK_SIZE;
for (;;) {
/* We want (desc_blocks) allocation blocks, plus the terminating
descriptor, plus the shuffler safe area. */
addr_t descmem = desc_blocks *
sizeof(struct shuffle_descriptor) * DESC_BLOCK_SIZE
+ sizeof(struct shuffle_descriptor) + shuffler_size;
descaddr = (desczone + descfree - descmem) & ~3;
if (descaddr < desczone)
goto bail; /* No memory block large enough */
/* Mark memory used by shuffle descriptors as reserved */
if (syslinux_add_memmap(&rxmap, descaddr, descmem, SMT_RESERVED))
goto bail;
#if DEBUG > 1
syslinux_dump_movelist(fraglist);
#endif
if (syslinux_compute_movelist(&moves, fraglist, rxmap))
goto bail;
nmoves = 0;
for (mp = moves; mp; mp = mp->next)
nmoves++;
need_blocks = (nmoves + nzero + DESC_BLOCK_SIZE - 1) / DESC_BLOCK_SIZE;
if (desc_blocks >= need_blocks)
break; /* Sufficient memory, yay */
desc_blocks = need_blocks; /* Try again... */
}
#if DEBUG > 1
dprintf("Final movelist:\n");
syslinux_dump_movelist(moves);
#endif
syslinux_free_memmap(rxmap);
rxmap = NULL;
need_ptrs = nmoves + nzero + 1;
dbuf = malloc(need_ptrs * sizeof(struct shuffle_descriptor));
if (!dbuf)
goto bail;
#if DEBUG
{
addr_t descoffs = descaddr - (addr_t) dbuf;
dprintf("nmoves = %d, nzero = %d, dbuf = %p, offs = 0x%08x\n",
nmoves, nzero, dbuf, descoffs);
}
#endif
/* Copy the move sequence into the descriptor buffer */
np = 0;
dp = dbuf;
for (mp = moves; mp; mp = mp->next) {
dp->dst = mp->dst;
dp->src = mp->src;
dp->len = mp->len;
dprintf2("[ %08x %08x %08x ]\n", dp->dst, dp->src, dp->len);
dp++;
np++;
}
/* Copy bzero operations into the descriptor buffer */
for (ml = memmap; ml->type != SMT_END; ml = ml->next) {
if (ml->type == SMT_ZERO) {
dp->dst = ml->start;
dp->src = (addr_t) - 1; /* bzero region */
dp->len = ml->next->start - ml->start;
dprintf2("[ %08x %08x %08x ]\n", dp->dst, dp->src, dp->len);
dp++;
np++;
}
}
/* Finally, record the termination entry */
dp->dst = entry_point;
dp->src = entry_type;
dp->len = 0;
dp++;
np++;
if (np != need_ptrs) {
dprintf("!!! np = %d : nmoves = %d, nzero = %d, desc_blocks = %d\n",
np, nmoves, nzero, desc_blocks);
}
rv = 0;
bail:
/* This is safe only because free() doesn't use the bounce buffer!!!! */
if (moves)
syslinux_free_movelist(moves);
if (rxmap)
syslinux_free_memmap(rxmap);
if (rv)
return rv;
/* Actually do it... */
memset(&ireg, 0, sizeof ireg);
ireg.edi.l = descaddr;
ireg.esi.l = (addr_t) dbuf;
ireg.ecx.l = (addr_t) dp - (addr_t) dbuf;
ireg.edx.w[0] = bootflags;
ireg.eax.w[0] = 0x0024;
__intcall(0x22, &ireg, NULL);
return -1; /* Shouldn't have returned! */
}
static void do_boot(struct data_area *data, int ndata)
{
struct syslinux_memmap *mmap;
struct syslinux_movelist *mlist = NULL;
addr_t endimage;
uint8_t driveno = opt.regs.edx.b[0];
uint8_t swapdrive = driveno & 0x80;
int i;
mmap = syslinux_memory_map();
if (!mmap) {
error("Cannot read system memory map.");
return;
}
endimage = 0;
for (i = 0; i < ndata; i++) {
if (data[i].base + data[i].size > endimage)
endimage = data[i].base + data[i].size;
}
if (endimage > dosmax)
goto too_big;
for (i = 0; i < ndata; i++) {
if (syslinux_add_movelist(&mlist, data[i].base,
(addr_t) data[i].data, data[i].size))
goto enomem;
}
if (opt.swap && driveno != swapdrive) {
static const uint8_t swapstub_master[] = {
/* The actual swap code */
0x53, /* 00: push bx */
0x0f, 0xb6, 0xda, /* 01: movzx bx,dl */
0x2e, 0x8a, 0x57, 0x60, /* 04: mov dl,[cs:bx+0x60] */
0x5b, /* 08: pop bx */
0xea, 0, 0, 0, 0, /* 09: jmp far 0:0 */
0x90, 0x90, /* 0E: nop; nop */
/* Code to install this in the right location */
/* Entry with DS = CS; ES = SI = 0; CX = 256 */
0x26, 0x66, 0x8b, 0x7c, 0x4c, /* 10: mov edi,[es:si+4*0x13] */
0x66, 0x89, 0x3e, 0x0a, 0x00, /* 15: mov [0x0A],edi */
0x26, 0x8b, 0x3e, 0x13, 0x04, /* 1A: mov di,[es:0x413] */
0x4f, /* 1F: dec di */
0x26, 0x89, 0x3e, 0x13, 0x04, /* 20: mov [es:0x413],di */
0x66, 0xc1, 0xe7, 0x16, /* 25: shl edi,16+6 */
0x26, 0x66, 0x89, 0x7c, 0x4c, /* 29: mov [es:si+4*0x13],edi */
0x66, 0xc1, 0xef, 0x10, /* 2E: shr edi,16 */
0x8e, 0xc7, /* 32: mov es,di */
0x31, 0xff, /* 34: xor di,di */
0xf3, 0x66, 0xa5, /* 36: rep movsd */
0xbe, 0, 0, /* 39: mov si,0 */
0xbf, 0, 0, /* 3C: mov di,0 */
0x8e, 0xde, /* 3F: mov ds,si */
0x8e, 0xc7, /* 41: mov es,di */
0x66, 0xb9, 0, 0, 0, 0, /* 43: mov ecx,0 */
0x66, 0xbe, 0, 0, 0, 0, /* 49: mov esi,0 */
0x66, 0xbf, 0, 0, 0, 0, /* 4F: mov edi,0 */
0xea, 0, 0, 0, 0, /* 55: jmp 0:0 */
/* pad out to segment boundary */
0x90, 0x90, /* 5A: ... */
0x90, 0x90, 0x90, 0x90, /* 5C: ... */
};
static uint8_t swapstub[1024];
uint8_t *p;
/* Note: we can't rely on either INT 13h nor the dosmax
vector to be correct at this stage, so we have to use an
installer stub to put things in the right place.
Round the installer location to a 1K boundary so the only
possible overlap is the identity mapping. */
endimage = (endimage + 1023u) & ~1023u;
/* Create swap stub */
memcpy(swapstub, swapstub_master, sizeof swapstub_master);
*(uint16_t *) & swapstub[0x3a] = opt.regs.ds;
*(uint16_t *) & swapstub[0x3d] = opt.regs.es;
*(uint32_t *) & swapstub[0x45] = opt.regs.ecx.l;
*(uint32_t *) & swapstub[0x4b] = opt.regs.esi.l;
*(uint32_t *) & swapstub[0x51] = opt.regs.edi.l;
*(uint16_t *) & swapstub[0x56] = opt.regs.ip;
*(uint16_t *) & swapstub[0x58] = opt.regs.cs;
p = &swapstub[sizeof swapstub_master];
/* Mapping table; start out with identity mapping everything */
for (i = 0; i < 256; i++)
p[i] = i;
/* And the actual swap */
p[driveno] = swapdrive;
p[swapdrive] = driveno;
/* Adjust registers */
opt.regs.ds = opt.regs.cs = endimage >> 4;
opt.regs.esi.l = opt.regs.es = 0;
opt.regs.ecx.l = sizeof swapstub >> 2;
opt.regs.ip = 0x10; /* Installer offset */
opt.regs.ebx.b[0] = opt.regs.edx.b[0] = swapdrive;
if (syslinux_add_movelist(&mlist, endimage, (addr_t) swapstub,
sizeof swapstub))
goto enomem;
endimage += sizeof swapstub;
}
/* Tell the shuffler not to muck with this area... */
syslinux_add_memmap(&mmap, endimage, 0xa0000 - endimage, SMT_RESERVED);
/* Force text mode */
syslinux_force_text_mode();
puts("Booting...");
syslinux_shuffle_boot_rm(mlist, mmap, opt.keeppxe, &opt.regs);
error("Chainboot failed !");
return;
too_big:
error("Loader file too large.");
return;
enomem:
error("Out of memory.");
return;
}
int boot_raw(void *ptr, size_t len, addr_t where, char **argv)
{
struct syslinux_movelist *ml = NULL;
struct syslinux_memmap *mmap = NULL, *amap = NULL;
struct syslinux_pm_regs regs;
int argc;
addr_t argsize;
char **argp;
addr_t lstart, llen;
char *stack_frame = NULL;
addr_t stack_frame_size;
addr_t stack_pointer;
uint32_t *spp;
char *sfp;
addr_t sfa;
memset(®s, 0, sizeof regs);
mmap = syslinux_memory_map();
amap = syslinux_dup_memmap(mmap);
if (!mmap || !amap)
goto bail;
dprintf("Initial memory map:\n");
syslinux_dump_memmap(mmap);
dprintf("Segment at 0x%08x len 0x%08x\n", where, len);
if (syslinux_memmap_type(amap, where, len) != SMT_FREE) {
printf("Memory segment at 0x%08x (len 0x%08x) is unavailable\n",
where, len);
goto bail; /* Memory region unavailable */
}
/* Mark this region as allocated in the available map */
if (syslinux_add_memmap(&amap, where, len, SMT_ALLOC))
goto bail;
/* Data present region. Create a move entry for it. */
if (syslinux_add_movelist(&ml, where, (addr_t) ptr, len))
goto bail;
/* Create the invocation record (initial stack frame) */
argsize = argc = 0;
for (argp = argv; *argp; argp++) {
dprintf("argv[%2d] = \"%s\"\n", argc, *argp);
argc++;
argsize += strlen(*argp) + 1;
}
/* We need the argument strings, argument pointers,
argc, plus four zero-word terminators. */
stack_frame_size = argsize + argc * sizeof(char *) + 5 * sizeof(long);
stack_frame_size = (stack_frame_size + 15) & ~15;
stack_frame = calloc(stack_frame_size, 1);
if (!stack_frame)
goto bail;
dprintf("Right before syslinux_memmap_largest()...\n");
syslinux_dump_memmap(amap);
if (syslinux_memmap_largest(amap, SMT_FREE, &lstart, &llen))
goto bail; /* NO free memory?! */
if (llen < stack_frame_size + MIN_STACK + 16)
goto bail; /* Insufficient memory */
/* Initial stack pointer address */
stack_pointer = (lstart + llen - stack_frame_size) & ~15;
dprintf("Stack frame at 0x%08x len 0x%08x\n",
stack_pointer, stack_frame_size);
/* Create the stack frame. sfp is the pointer in current memory for
the next argument string, sfa is the address in its final resting place.
spp is the pointer into the argument array in current memory. */
spp = (uint32_t *) stack_frame;
sfp = stack_frame + argc * sizeof(char *) + 5 * sizeof(long);
sfa = stack_pointer + argc * sizeof(char *) + 5 * sizeof(long);
*spp++ = argc;
for (argp = argv; *argp; argp++) {
int bytes = strlen(*argp) + 1; /* Including final null */
*spp++ = sfa;
memcpy(sfp, *argp, bytes);
sfp += bytes;
sfa += bytes;
}
/* Zero fields are aready taken care of by calloc() */
/* ... and we'll want to move it into the right place... */
#if DEBUG
if (syslinux_memmap_type(amap, stack_pointer, stack_frame_size)
!= SMT_FREE) {
dprintf("Stack frame area not free (how did that happen?)!\n");
goto bail; /* Memory region unavailable */
}
#endif
if (syslinux_add_memmap(&amap, stack_pointer, stack_frame_size, SMT_ALLOC))
goto bail;
if (syslinux_add_movelist(&ml, stack_pointer, (addr_t) stack_frame,
stack_frame_size))
goto bail;
memset(®s, 0, sizeof regs);
regs.eip = where;
regs.esp = stack_pointer;
dprintf("Final memory map:\n");
syslinux_dump_memmap(mmap);
dprintf("Final available map:\n");
syslinux_dump_memmap(amap);
dprintf("Movelist:\n");
syslinux_dump_movelist(ml);
/* This should not return... */
fputs("Booting...\n", stdout);
syslinux_shuffle_boot_pm(ml, mmap, 0, ®s);
bail:
if (stack_frame)
free(stack_frame);
syslinux_free_memmap(amap);
syslinux_free_memmap(mmap);
syslinux_free_movelist(ml);
return -1;
}
int syslinux_boot_linux(void *kernel_buf, size_t kernel_size,
struct initramfs *initramfs, char *cmdline)
{
struct linux_header hdr, *whdr;
size_t real_mode_size, prot_mode_size;
addr_t real_mode_base, prot_mode_base;
addr_t irf_size;
size_t cmdline_size, cmdline_offset;
struct syslinux_rm_regs regs;
struct syslinux_movelist *fraglist = NULL;
struct syslinux_memmap *mmap = NULL;
struct syslinux_memmap *amap = NULL;
bool ok;
uint32_t memlimit = 0;
uint16_t video_mode = 0;
const char *arg;
cmdline_size = strlen(cmdline) + 1;
if (kernel_size < 2 * 512)
goto bail;
/* Look for specific command-line arguments we care about */
if ((arg = find_argument(cmdline, "mem=")))
memlimit = saturate32(suffix_number(arg));
if ((arg = find_argument(cmdline, "vga="))) {
switch (arg[0] | 0x20) {
case 'a': /* "ask" */
video_mode = 0xfffd;
break;
case 'e': /* "ext" */
video_mode = 0xfffe;
break;
case 'n': /* "normal" */
video_mode = 0xffff;
break;
case 'c': /* "current" */
video_mode = 0x0f04;
break;
default:
video_mode = strtoul(arg, NULL, 0);
break;
}
}
/* Copy the header into private storage */
/* Use whdr to modify the actual kernel header */
memcpy(&hdr, kernel_buf, sizeof hdr);
whdr = (struct linux_header *)kernel_buf;
if (hdr.boot_flag != BOOT_MAGIC)
goto bail;
if (hdr.header != LINUX_MAGIC) {
hdr.version = 0x0100; /* Very old kernel */
hdr.loadflags = 0;
}
whdr->vid_mode = video_mode;
if (!hdr.setup_sects)
hdr.setup_sects = 4;
if (hdr.version < 0x0203)
hdr.initrd_addr_max = 0x37ffffff;
if (!memlimit && memlimit - 1 > hdr.initrd_addr_max)
memlimit = hdr.initrd_addr_max + 1; /* Zero for no limit */
if (hdr.version < 0x0205 || !(hdr.loadflags & LOAD_HIGH))
hdr.relocatable_kernel = 0;
if (hdr.version < 0x0206)
hdr.cmdline_max_len = 256;
if (cmdline_size > hdr.cmdline_max_len) {
cmdline_size = hdr.cmdline_max_len;
cmdline[cmdline_size - 1] = '\0';
}
if (hdr.version < 0x0202 || !(hdr.loadflags & 0x01))
cmdline_offset = (0x9ff0 - cmdline_size) & ~15;
else
cmdline_offset = 0x10000;
real_mode_size = (hdr.setup_sects + 1) << 9;
real_mode_base = (hdr.loadflags & LOAD_HIGH) ? 0x10000 : 0x90000;
prot_mode_base = (hdr.loadflags & LOAD_HIGH) ? 0x100000 : 0x10000;
prot_mode_size = kernel_size - real_mode_size;
if (!(hdr.loadflags & LOAD_HIGH) && prot_mode_size > 512 * 1024)
goto bail; /* Kernel cannot be loaded low */
if (initramfs && hdr.version < 0x0200)
goto bail; /* initrd/initramfs not supported */
if (hdr.version >= 0x0200) {
whdr->type_of_loader = 0x30; /* SYSLINUX unknown module */
if (hdr.version >= 0x0201) {
whdr->heap_end_ptr = cmdline_offset - 0x0200;
whdr->loadflags |= CAN_USE_HEAP;
}
if (hdr.version >= 0x0202) {
whdr->cmd_line_ptr = real_mode_base + cmdline_offset;
} else {
whdr->old_cmd_line_magic = OLD_CMDLINE_MAGIC;
whdr->old_cmd_line_offset = cmdline_offset;
/* Be paranoid and round up to a multiple of 16 */
whdr->setup_move_size = (cmdline_offset + cmdline_size + 15) & ~15;
}
}
/* Get the memory map */
mmap = syslinux_memory_map(); /* Memory map for shuffle_boot */
amap = syslinux_dup_memmap(mmap); /* Keep track of available memory */
if (!mmap || !amap)
goto bail;
#if DEBUG
dprintf("Initial memory map:\n");
syslinux_dump_memmap(stdout, mmap);
#endif
/* If the user has specified a memory limit, mark that as unavailable.
Question: should we mark this off-limit in the mmap as well (meaning
it's unavailable to the boot loader, which probably has already touched
some of it), or just in the amap? */
if (memlimit)
if (syslinux_add_memmap(&amap, memlimit, -memlimit, SMT_RESERVED))
goto bail;
/* Place the kernel in memory */
/* First, find a suitable place for the protected-mode code */
if (syslinux_memmap_type(amap, prot_mode_base, prot_mode_size)
!= SMT_FREE) {
const struct syslinux_memmap *mp;
if (!hdr.relocatable_kernel)
goto bail; /* Can't relocate - no hope */
ok = false;
for (mp = amap; mp; mp = mp->next) {
addr_t start, end;
start = mp->start;
end = mp->next->start;
if (mp->type != SMT_FREE)
continue;
if (end <= prot_mode_base)
continue; /* Only relocate upwards */
if (start <= prot_mode_base)
start = prot_mode_base;
start = ALIGN_UP(start, hdr.kernel_alignment);
if (start >= end)
continue;
/* The 3* here is a total fudge factor... it's supposed to
account for the fact that the kernel needs to be decompressed,
and then followed by the BSS and BRK regions. This doesn't,
however, account for the fact that the kernel is decompressed
into a whole other place, either. */
if (end - start >= 3 * prot_mode_size) {
whdr->code32_start += start - prot_mode_base;
prot_mode_base = start;
ok = true;
break;
}
}
if (!ok)
goto bail;
}
/* Real mode code */
if (syslinux_memmap_type(amap, real_mode_base,
cmdline_offset + cmdline_size) != SMT_FREE) {
const struct syslinux_memmap *mp;
ok = false;
for (mp = amap; mp; mp = mp->next) {
addr_t start, end;
start = mp->start;
end = mp->next->start;
if (mp->type != SMT_FREE)
continue;
if (start < real_mode_base)
start = real_mode_base; /* Lowest address we'll use */
if (end > 640 * 1024)
end = 640 * 1024;
start = ALIGN_UP(start, 16);
if (start > 0x90000 || start >= end)
continue;
if (end - start >= cmdline_offset + cmdline_size) {
real_mode_base = start;
ok = true;
break;
}
}
}
if (syslinux_add_movelist(&fraglist, real_mode_base, (addr_t) kernel_buf,
real_mode_size))
goto bail;
if (syslinux_add_memmap
(&amap, real_mode_base, cmdline_offset + cmdline_size, SMT_ALLOC))
goto bail;
/* Zero region between real mode code and cmdline */
if (syslinux_add_memmap(&mmap, real_mode_base + real_mode_size,
cmdline_offset - real_mode_size, SMT_ZERO))
goto bail;
/* Command line */
if (syslinux_add_movelist(&fraglist, real_mode_base + cmdline_offset,
(addr_t) cmdline, cmdline_size))
goto bail;
/* Protected-mode code */
if (syslinux_add_movelist(&fraglist, prot_mode_base,
(addr_t) kernel_buf + real_mode_size,
prot_mode_size))
goto bail;
if (syslinux_add_memmap(&amap, prot_mode_base, prot_mode_size, SMT_ALLOC))
goto bail;
/* Figure out the size of the initramfs, and where to put it.
We should put it at the highest possible address which is
<= hdr.initrd_addr_max, which fits the entire initramfs. */
irf_size = initramfs_size(initramfs); /* Handles initramfs == NULL */
if (irf_size) {
addr_t best_addr = 0;
struct syslinux_memmap *ml;
const addr_t align_mask = INITRAMFS_MAX_ALIGN - 1;
if (irf_size) {
for (ml = amap; ml->type != SMT_END; ml = ml->next) {
addr_t adj_start = (ml->start + align_mask) & ~align_mask;
addr_t adj_end = ml->next->start & ~align_mask;
if (ml->type == SMT_FREE && adj_end - adj_start >= irf_size)
best_addr = (adj_end - irf_size) & ~align_mask;
}
if (!best_addr)
goto bail; /* Insufficient memory for initramfs */
whdr->ramdisk_image = best_addr;
whdr->ramdisk_size = irf_size;
if (syslinux_add_memmap(&amap, best_addr, irf_size, SMT_ALLOC))
goto bail;
if (map_initramfs(&fraglist, &mmap, initramfs, best_addr))
goto bail;
}
}
/* Set up the registers on entry */
memset(®s, 0, sizeof regs);
regs.es = regs.ds = regs.ss = regs.fs = regs.gs = real_mode_base >> 4;
regs.cs = (real_mode_base >> 4) + 0x20;
/* regs.ip = 0; */
/* Linux is OK with sp = 0 = 64K, but perhaps other things aren't... */
regs.esp.w[0] = min(cmdline_offset, (size_t) 0xfff0);
#if DEBUG
dprintf("Final memory map:\n");
syslinux_dump_memmap(stdout, mmap);
dprintf("Final available map:\n");
syslinux_dump_memmap(stdout, amap);
dprintf("Initial movelist:\n");
syslinux_dump_movelist(stdout, fraglist);
#endif
syslinux_shuffle_boot_rm(fraglist, mmap, 0, ®s);
bail:
syslinux_free_movelist(fraglist);
syslinux_free_memmap(mmap);
syslinux_free_memmap(amap);
return -1;
}
int boot_elf(void *ptr, size_t len, char **argv)
{
char *cptr = ptr;
Elf32_Ehdr *eh = ptr;
Elf32_Phdr *ph;
unsigned int i;
struct syslinux_movelist *ml = NULL;
struct syslinux_memmap *mmap = NULL, *amap = NULL;
struct syslinux_pm_regs regs;
int argc;
addr_t argsize;
char **argp;
addr_t lstart, llen;
char *stack_frame = NULL;
addr_t stack_frame_size;
addr_t stack_pointer;
uint32_t *spp;
char *sfp;
addr_t sfa;
memset(®s, 0, sizeof regs);
/*
* Note: mmap is the memory map (containing free and zeroed regions)
* needed by syslinux_shuffle_boot_pm(); amap is a map where we keep
* track ourselves which target memory ranges have already been
* allocated.
*/
if (len < sizeof(Elf32_Ehdr))
goto bail;
/* Must be ELF, 32-bit, littleendian, version 1 */
if (memcmp(eh->e_ident, "\x7f" "ELF\1\1\1", 6))
goto bail;
/* Is this a worthwhile test? In particular x86-64 normally
would imply ELF64 support, which we could do as long as
the addresses are 32-bit addresses, and entry is 32 bits.
64-bit addresses would take a lot more work. */
if (eh->e_machine != EM_386 && eh->e_machine != EM_486 &&
eh->e_machine != EM_X86_64)
goto bail;
if (eh->e_version != EV_CURRENT)
goto bail;
if (eh->e_ehsize < sizeof(Elf32_Ehdr) || eh->e_ehsize >= len)
goto bail;
if (eh->e_phentsize < sizeof(Elf32_Phdr))
goto bail;
if (!eh->e_phnum)
goto bail;
if (eh->e_phoff + eh->e_phentsize * eh->e_phnum > len)
goto bail;
mmap = syslinux_memory_map();
amap = syslinux_dup_memmap(mmap);
if (!mmap || !amap)
goto bail;
#if DEBUG
dprintf("Initial memory map:\n");
syslinux_dump_memmap(stdout, mmap);
#endif
ph = (Elf32_Phdr *) (cptr + eh->e_phoff);
for (i = 0; i < eh->e_phnum; i++) {
if (ph->p_type == PT_LOAD || ph->p_type == PT_PHDR) {
/* This loads at p_paddr, which is arguably the correct semantics.
The SysV spec says that SysV loads at p_vaddr (and thus Linux does,
too); that is, however, a major brainfuckage in the spec. */
addr_t addr = ph->p_paddr;
addr_t msize = ph->p_memsz;
addr_t dsize = min(msize, ph->p_filesz);
dprintf("Segment at 0x%08x data 0x%08x len 0x%08x\n",
addr, dsize, msize);
if (syslinux_memmap_type(amap, addr, msize) != SMT_FREE) {
printf("Memory segment at 0x%08x (len 0x%08x) is unavailable\n",
addr, msize);
goto bail; /* Memory region unavailable */
}
/* Mark this region as allocated in the available map */
if (syslinux_add_memmap(&amap, addr, dsize, SMT_ALLOC))
goto bail;
if (ph->p_filesz) {
/* Data present region. Create a move entry for it. */
if (syslinux_add_movelist
(&ml, addr, (addr_t) cptr + ph->p_offset, dsize))
goto bail;
}
if (msize > dsize) {
/* Zero-filled region. Mark as a zero region in the memory map. */
if (syslinux_add_memmap
(&mmap, addr + dsize, msize - dsize, SMT_ZERO))
goto bail;
}
} else {
/* Ignore this program header */
}
ph = (Elf32_Phdr *) ((char *)ph + eh->e_phentsize);
}
/* Create the invocation record (initial stack frame) */
argsize = argc = 0;
for (argp = argv; *argp; argp++) {
dprintf("argv[%2d] = \"%s\"\n", argc, *argp);
argc++;
argsize += strlen(*argp) + 1;
}
/* We need the argument strings, argument pointers,
argc, plus four zero-word terminators. */
stack_frame_size = argsize + argc * sizeof(char *) + 5 * sizeof(long);
stack_frame_size = (stack_frame_size + 15) & ~15;
stack_frame = calloc(stack_frame_size, 1);
if (!stack_frame)
goto bail;
#if DEBUG
dprintf("Right before syslinux_memmap_largest()...\n");
syslinux_dump_memmap(stdout, amap);
#endif
if (syslinux_memmap_largest(amap, SMT_FREE, &lstart, &llen))
goto bail; /* NO free memory?! */
if (llen < stack_frame_size + MIN_STACK + 16)
goto bail; /* Insufficient memory */
/* Initial stack pointer address */
stack_pointer = (lstart + llen - stack_frame_size) & ~15;
dprintf("Stack frame at 0x%08x len 0x%08x\n",
stack_pointer, stack_frame_size);
/* Create the stack frame. sfp is the pointer in current memory for
the next argument string, sfa is the address in its final resting place.
spp is the pointer into the argument array in current memory. */
spp = (uint32_t *) stack_frame;
sfp = stack_frame + argc * sizeof(char *) + 5 * sizeof(long);
sfa = stack_pointer + argc * sizeof(char *) + 5 * sizeof(long);
*spp++ = argc;
for (argp = argv; *argp; argp++) {
int bytes = strlen(*argp) + 1; /* Including final null */
*spp++ = sfa;
memcpy(sfp, *argp, bytes);
sfp += bytes;
sfa += bytes;
}
/* Zero fields are aready taken care of by calloc() */
/* ... and we'll want to move it into the right place... */
#if DEBUG
if (syslinux_memmap_type(amap, stack_pointer, stack_frame_size)
!= SMT_FREE) {
dprintf("Stack frame area not free (how did that happen?)!\n");
goto bail; /* Memory region unavailable */
}
#endif
if (syslinux_add_memmap(&amap, stack_pointer, stack_frame_size, SMT_ALLOC))
goto bail;
if (syslinux_add_movelist(&ml, stack_pointer, (addr_t) stack_frame,
stack_frame_size))
goto bail;
memset(®s, 0, sizeof regs);
regs.eip = eh->e_entry;
regs.esp = stack_pointer;
#if DEBUG
dprintf("Final memory map:\n");
syslinux_dump_memmap(stdout, mmap);
dprintf("Final available map:\n");
syslinux_dump_memmap(stdout, amap);
dprintf("Movelist:\n");
syslinux_dump_movelist(stdout, ml);
#endif
/* This should not return... */
fputs("Booting...\n", stdout);
syslinux_shuffle_boot_pm(ml, mmap, 0, ®s);
bail:
if (stack_frame)
free(stack_frame);
syslinux_free_memmap(amap);
syslinux_free_memmap(mmap);
syslinux_free_movelist(ml);
return -1;
}
struct multiboot_header *map_image(void *ptr, size_t len)
{
struct multiboot_header *mbh;
int mbh_len;
char *cptr = ptr;
Elf32_Ehdr *eh = ptr;
Elf32_Phdr *ph;
Elf32_Shdr *sh;
unsigned int i, mbh_offset;
uint32_t bad_flags;
/*
* Search for the multiboot header...
*/
mbh_len = 0;
for (mbh_offset = 0; mbh_offset < MULTIBOOT_SEARCH; mbh_offset += 4) {
mbh = (struct multiboot_header *)((char *)ptr + mbh_offset);
if (mbh->magic != MULTIBOOT_MAGIC)
continue;
if (mbh->magic + mbh->flags + mbh->checksum)
continue;
if (mbh->flags & MULTIBOOT_VIDEO_MODE)
mbh_len = 48;
else if (mbh->flags & MULTIBOOT_AOUT_KLUDGE)
mbh_len = 32;
else
mbh_len = 12;
if (mbh_offset + mbh_len > len)
mbh_len = 0; /* Invalid... */
else
break; /* Found something... */
}
if (mbh_len) {
bad_flags = mbh->flags & MULTIBOOT_UNSUPPORTED;
if (bad_flags) {
printf("Unsupported Multiboot flags set: %#x\n", bad_flags);
return NULL;
}
}
if (len < sizeof(Elf32_Ehdr) ||
memcmp(eh->e_ident, "\x7f" "ELF\1\1\1", 6) ||
(eh->e_machine != EM_386 && eh->e_machine != EM_486 &&
eh->e_machine != EM_X86_64) ||
eh->e_version != EV_CURRENT ||
eh->e_ehsize < sizeof(Elf32_Ehdr) || eh->e_ehsize >= len ||
eh->e_phentsize < sizeof(Elf32_Phdr) ||
!eh->e_phnum || eh->e_phoff + eh->e_phentsize * eh->e_phnum > len)
eh = NULL; /* No valid ELF header found */
/* Is this a Solaris kernel? */
if (!set.solaris && eh && kernel_is_solaris(eh))
opt.solaris = true;
/*
* Note: the Multiboot Specification implies that AOUT_KLUDGE should
* have precedence over the ELF header. However, Grub disagrees, and
* Grub is "the reference bootloader" for the Multiboot Specification.
* This is insane, since it makes the AOUT_KLUDGE bit functionally
* useless, but at least Solaris apparently depends on this behavior.
*/
if (eh && !(opt.aout && mbh_len && (mbh->flags & MULTIBOOT_AOUT_KLUDGE))) {
regs.eip = eh->e_entry; /* Can be overridden further down... */
ph = (Elf32_Phdr *) (cptr + eh->e_phoff);
for (i = 0; i < eh->e_phnum; i++) {
if (ph->p_type == PT_LOAD || ph->p_type == PT_PHDR) {
/*
* This loads at p_paddr, which matches Grub. However, if
* e_entry falls within the p_vaddr range of this PHDR, then
* adjust it to match the p_paddr range... this is how Grub
* behaves, so it's by definition correct (it doesn't have to
* make sense...)
*/
addr_t addr = ph->p_paddr;
addr_t msize = ph->p_memsz;
addr_t dsize = min(msize, ph->p_filesz);
if (eh->e_entry >= ph->p_vaddr
&& eh->e_entry < ph->p_vaddr + msize)
regs.eip = eh->e_entry + (ph->p_paddr - ph->p_vaddr);
dprintf("Segment at 0x%08x data 0x%08x len 0x%08x\n",
addr, dsize, msize);
if (syslinux_memmap_type(amap, addr, msize) != SMT_FREE) {
printf
("Memory segment at 0x%08x (len 0x%08x) is unavailable\n",
addr, msize);
return NULL; /* Memory region unavailable */
}
/* Mark this region as allocated in the available map */
if (syslinux_add_memmap(&amap, addr, msize, SMT_ALLOC)) {
error("Overlapping segments found in ELF header\n");
return NULL;
}
if (ph->p_filesz) {
/* Data present region. Create a move entry for it. */
if (syslinux_add_movelist
(&ml, addr, (addr_t) cptr + ph->p_offset, dsize)) {
error("Failed to map PHDR data\n");
return NULL;
}
}
if (msize > dsize) {
/* Zero-filled region. Mark as a zero region in the memory map. */
if (syslinux_add_memmap
(&mmap, addr + dsize, msize - dsize, SMT_ZERO)) {
error("Failed to map PHDR zero region\n");
return NULL;
}
}
if (addr + msize > mboot_high_water_mark)
mboot_high_water_mark = addr + msize;
} else {
/* Ignore this program header */
}
ph = (Elf32_Phdr *) ((char *)ph + eh->e_phentsize);
}
/* Load the ELF symbol table */
if (eh->e_shoff) {
addr_t addr, len;
sh = (Elf32_Shdr *) ((char *)eh + eh->e_shoff);
len = eh->e_shentsize * eh->e_shnum;
/*
* Align this, but don't pad -- in general this means a bunch of
* smaller sections gets packed into a single page.
*/
addr = map_data(sh, len, 4096, MAP_HIGH | MAP_NOPAD);
if (!addr) {
error("Failed to map symbol table\n");
return NULL;
}
mbinfo.flags |= MB_INFO_ELF_SHDR;
mbinfo.syms.e.addr = addr;
mbinfo.syms.e.num = eh->e_shnum;
mbinfo.syms.e.size = eh->e_shentsize;
mbinfo.syms.e.shndx = eh->e_shstrndx;
for (i = 0; i < eh->e_shnum; i++) {
addr_t align;
if (!sh[i].sh_size)
continue; /* Empty section */
if (sh[i].sh_flags & SHF_ALLOC)
continue; /* SHF_ALLOC sections should have PHDRs */
align = sh[i].sh_addralign ? sh[i].sh_addralign : 0;
addr = map_data((char *)ptr + sh[i].sh_offset, sh[i].sh_size,
align, MAP_HIGH);
if (!addr) {
error("Failed to map symbol section\n");
return NULL;
}
sh[i].sh_addr = addr;
}
}
} else if (mbh_len && (mbh->flags & MULTIBOOT_AOUT_KLUDGE)) {
/*
* a.out kludge thing...
*/
char *data_ptr;
addr_t data_len, bss_len;
addr_t bss_addr;
regs.eip = mbh->entry_addr;
data_ptr = (char *)mbh - (mbh->header_addr - mbh->load_addr);
if (mbh->load_end_addr)
data_len = mbh->load_end_addr - mbh->load_addr;
else
data_len = len - mbh_offset + (mbh->header_addr - mbh->load_addr);
bss_addr = mbh->load_addr + data_len;
if (mbh->bss_end_addr)
bss_len = mbh->bss_end_addr - mbh->load_end_addr;
else
bss_len = 0;
if (syslinux_memmap_type(amap, mbh->load_addr, data_len + bss_len)
!= SMT_FREE) {
printf("Memory segment at 0x%08x (len 0x%08x) is unavailable\n",
mbh->load_addr, data_len + bss_len);
return NULL; /* Memory region unavailable */
}
if (syslinux_add_memmap(&amap, mbh->load_addr,
data_len + bss_len, SMT_ALLOC)) {
error("Failed to claim a.out address space!\n");
return NULL;
}
if (data_len)
if (syslinux_add_movelist(&ml, mbh->load_addr, (addr_t) data_ptr,
data_len)) {
error("Failed to map a.out data\n");
return NULL;
}
if (bss_len)
if (syslinux_add_memmap
(&mmap, bss_addr, bss_len, SMT_ZERO)) {
error("Failed to map a.out bss\n");
return NULL;
}
if (bss_addr + bss_len > mboot_high_water_mark)
mboot_high_water_mark = bss_addr + bss_len;
} else {
error
("Invalid Multiboot image: neither ELF header nor a.out kludge found\n");
return NULL;
}
return mbh;
}
