From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54889) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WIcog-0000hd-Gh for qemu-devel@nongnu.org; Wed, 26 Feb 2014 06:38:31 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WIcoX-0001tn-6q for qemu-devel@nongnu.org; Wed, 26 Feb 2014 06:38:22 -0500 Received: from e06smtp11.uk.ibm.com ([195.75.94.107]:36892) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WIcoW-0001tC-Ua for qemu-devel@nongnu.org; Wed, 26 Feb 2014 06:38:13 -0500 Received: from /spool/local by e06smtp11.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 26 Feb 2014 11:38:10 -0000 Received: from b06cxnps3075.portsmouth.uk.ibm.com (d06relay10.portsmouth.uk.ibm.com [9.149.109.195]) by d06dlp03.portsmouth.uk.ibm.com (Postfix) with ESMTP id 4C51C1B08066 for ; Wed, 26 Feb 2014 11:37:50 +0000 (GMT) Received: from d06av10.portsmouth.uk.ibm.com (d06av10.portsmouth.uk.ibm.com [9.149.37.251]) by b06cxnps3075.portsmouth.uk.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id s1QBbv4K45940746 for ; Wed, 26 Feb 2014 11:37:57 GMT Received: from d06av10.portsmouth.uk.ibm.com (localhost [127.0.0.1]) by d06av10.portsmouth.uk.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id s1QBc8ZU009556 for ; Wed, 26 Feb 2014 04:38:09 -0700 From: Christian Borntraeger Date: Wed, 26 Feb 2014 12:38:28 +0100 Message-Id: <1393414708-37739-6-git-send-email-borntraeger@de.ibm.com> In-Reply-To: <1393414708-37739-1-git-send-email-borntraeger@de.ibm.com> References: <1393414708-37739-1-git-send-email-borntraeger@de.ibm.com> Subject: [Qemu-devel] [PATCH 5/5] s390x/ipl: Fix crash of ELF images with arbitrary entry points List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel Cc: Peter Maydell , Thomas Huth , Alexander Graf , Christian Borntraeger , Jens Freimann , Anthony Liguori , Cornelia Huck , Richard Henderson From: Thomas Huth When loading S390 kernels, the current code expects an ELF file with the start address 0x10000. Other ELF files cause a segmentation fault. To avoid these crashes, we should get the start address from the ELF file instead of always using a hard-coded address. Signed-off-by: Thomas Huth Acked-by: Cornelia Huck Signed-off-by: Christian Borntraeger --- hw/s390x/ipl.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c index 1a6397b..04fb1a8 100644 --- a/hw/s390x/ipl.c +++ b/hw/s390x/ipl.c @@ -95,7 +95,8 @@ static int s390_ipl_init(SysBusDevice *dev) } return 0; } else { - kernel_size = load_elf(ipl->kernel, NULL, NULL, NULL, NULL, + uint64_t pentry = KERN_IMAGE_START; + kernel_size = load_elf(ipl->kernel, NULL, NULL, &pentry, NULL, NULL, 1, ELF_MACHINE, 0); if (kernel_size == -1) { kernel_size = load_image_targphys(ipl->kernel, 0, ram_size); @@ -104,15 +105,19 @@ static int s390_ipl_init(SysBusDevice *dev) fprintf(stderr, "could not load kernel '%s'\n", ipl->kernel); return -1; } - /* we have to overwrite values in the kernel image, which are "rom" */ - strcpy(rom_ptr(KERN_PARM_AREA), ipl->cmdline); - /* - * we can not rely on the ELF entry point, since up to 3.2 this - * value was 0x800 (the SALIPL loader) and it wont work. For - * all (Linux) cases 0x10000 (KERN_IMAGE_START) should be fine. + * Is it a Linux kernel (starting at 0x10000)? If yes, we fill in the + * kernel parameters here as well. Note: For old kernels (up to 3.2) + * we can not rely on the ELF entry point - it was 0x800 (the SALIPL + * loader) and it won't work. For this case we force it to 0x10000, too. */ - ipl->start_addr = KERN_IMAGE_START; + if (pentry == KERN_IMAGE_START || pentry == 0x800) { + ipl->start_addr = KERN_IMAGE_START; + /* Overwrite parameters in the kernel image, which are "rom" */ + strcpy(rom_ptr(KERN_PARM_AREA), ipl->cmdline); + } else { + ipl->start_addr = pentry; + } } if (ipl->initrd) { ram_addr_t initrd_offset; -- 1.8.4.2