xref: /openbmc/linux/arch/x86/boot/compressed/head_64.S (revision aa5b395b)
1/* SPDX-License-Identifier: GPL-2.0 */
2/*
3 *  linux/boot/head.S
4 *
5 *  Copyright (C) 1991, 1992, 1993  Linus Torvalds
6 */
7
8/*
9 *  head.S contains the 32-bit startup code.
10 *
11 * NOTE!!! Startup happens at absolute address 0x00001000, which is also where
12 * the page directory will exist. The startup code will be overwritten by
13 * the page directory. [According to comments etc elsewhere on a compressed
14 * kernel it will end up at 0x1000 + 1Mb I hope so as I assume this. - AC]
15 *
16 * Page 0 is deliberately kept safe, since System Management Mode code in
17 * laptops may need to access the BIOS data stored there.  This is also
18 * useful for future device drivers that either access the BIOS via VM86
19 * mode.
20 */
21
22/*
23 * High loaded stuff by Hans Lermen & Werner Almesberger, Feb. 1996
24 */
25	.code32
26	.text
27
28#include <linux/init.h>
29#include <linux/linkage.h>
30#include <asm/segment.h>
31#include <asm/boot.h>
32#include <asm/msr.h>
33#include <asm/processor-flags.h>
34#include <asm/asm-offsets.h>
35#include <asm/bootparam.h>
36#include "pgtable.h"
37
38/*
39 * Locally defined symbols should be marked hidden:
40 */
41	.hidden _bss
42	.hidden _ebss
43	.hidden _got
44	.hidden _egot
45
46	__HEAD
47	.code32
48SYM_FUNC_START(startup_32)
49	/*
50	 * 32bit entry is 0 and it is ABI so immutable!
51	 * If we come here directly from a bootloader,
52	 * kernel(text+data+bss+brk) ramdisk, zero_page, command line
53	 * all need to be under the 4G limit.
54	 */
55	cld
56	/*
57	 * Test KEEP_SEGMENTS flag to see if the bootloader is asking
58	 * us to not reload segments
59	 */
60	testb $KEEP_SEGMENTS, BP_loadflags(%esi)
61	jnz 1f
62
63	cli
64	movl	$(__BOOT_DS), %eax
65	movl	%eax, %ds
66	movl	%eax, %es
67	movl	%eax, %ss
681:
69
70/*
71 * Calculate the delta between where we were compiled to run
72 * at and where we were actually loaded at.  This can only be done
73 * with a short local call on x86.  Nothing  else will tell us what
74 * address we are running at.  The reserved chunk of the real-mode
75 * data at 0x1e4 (defined as a scratch field) are used as the stack
76 * for this calculation. Only 4 bytes are needed.
77 */
78	leal	(BP_scratch+4)(%esi), %esp
79	call	1f
801:	popl	%ebp
81	subl	$1b, %ebp
82
83/* setup a stack and make sure cpu supports long mode. */
84	movl	$boot_stack_end, %eax
85	addl	%ebp, %eax
86	movl	%eax, %esp
87
88	call	verify_cpu
89	testl	%eax, %eax
90	jnz	.Lno_longmode
91
92/*
93 * Compute the delta between where we were compiled to run at
94 * and where the code will actually run at.
95 *
96 * %ebp contains the address we are loaded at by the boot loader and %ebx
97 * contains the address where we should move the kernel image temporarily
98 * for safe in-place decompression.
99 */
100
101#ifdef CONFIG_RELOCATABLE
102	movl	%ebp, %ebx
103	movl	BP_kernel_alignment(%esi), %eax
104	decl	%eax
105	addl	%eax, %ebx
106	notl	%eax
107	andl	%eax, %ebx
108	cmpl	$LOAD_PHYSICAL_ADDR, %ebx
109	jge	1f
110#endif
111	movl	$LOAD_PHYSICAL_ADDR, %ebx
1121:
113
114	/* Target address to relocate to for decompression */
115	movl	BP_init_size(%esi), %eax
116	subl	$_end, %eax
117	addl	%eax, %ebx
118
119/*
120 * Prepare for entering 64 bit mode
121 */
122
123	/* Load new GDT with the 64bit segments using 32bit descriptor */
124	addl	%ebp, gdt+2(%ebp)
125	lgdt	gdt(%ebp)
126
127	/* Enable PAE mode */
128	movl	%cr4, %eax
129	orl	$X86_CR4_PAE, %eax
130	movl	%eax, %cr4
131
132 /*
133  * Build early 4G boot pagetable
134  */
135	/*
136	 * If SEV is active then set the encryption mask in the page tables.
137	 * This will insure that when the kernel is copied and decompressed
138	 * it will be done so encrypted.
139	 */
140	call	get_sev_encryption_bit
141	xorl	%edx, %edx
142	testl	%eax, %eax
143	jz	1f
144	subl	$32, %eax	/* Encryption bit is always above bit 31 */
145	bts	%eax, %edx	/* Set encryption mask for page tables */
1461:
147
148	/* Initialize Page tables to 0 */
149	leal	pgtable(%ebx), %edi
150	xorl	%eax, %eax
151	movl	$(BOOT_INIT_PGT_SIZE/4), %ecx
152	rep	stosl
153
154	/* Build Level 4 */
155	leal	pgtable + 0(%ebx), %edi
156	leal	0x1007 (%edi), %eax
157	movl	%eax, 0(%edi)
158	addl	%edx, 4(%edi)
159
160	/* Build Level 3 */
161	leal	pgtable + 0x1000(%ebx), %edi
162	leal	0x1007(%edi), %eax
163	movl	$4, %ecx
1641:	movl	%eax, 0x00(%edi)
165	addl	%edx, 0x04(%edi)
166	addl	$0x00001000, %eax
167	addl	$8, %edi
168	decl	%ecx
169	jnz	1b
170
171	/* Build Level 2 */
172	leal	pgtable + 0x2000(%ebx), %edi
173	movl	$0x00000183, %eax
174	movl	$2048, %ecx
1751:	movl	%eax, 0(%edi)
176	addl	%edx, 4(%edi)
177	addl	$0x00200000, %eax
178	addl	$8, %edi
179	decl	%ecx
180	jnz	1b
181
182	/* Enable the boot page tables */
183	leal	pgtable(%ebx), %eax
184	movl	%eax, %cr3
185
186	/* Enable Long mode in EFER (Extended Feature Enable Register) */
187	movl	$MSR_EFER, %ecx
188	rdmsr
189	btsl	$_EFER_LME, %eax
190	wrmsr
191
192	/* After gdt is loaded */
193	xorl	%eax, %eax
194	lldt	%ax
195	movl    $__BOOT_TSS, %eax
196	ltr	%ax
197
198	/*
199	 * Setup for the jump to 64bit mode
200	 *
201	 * When the jump is performend we will be in long mode but
202	 * in 32bit compatibility mode with EFER.LME = 1, CS.L = 0, CS.D = 1
203	 * (and in turn EFER.LMA = 1).	To jump into 64bit mode we use
204	 * the new gdt/idt that has __KERNEL_CS with CS.L = 1.
205	 * We place all of the values on our mini stack so lret can
206	 * used to perform that far jump.
207	 */
208	pushl	$__KERNEL_CS
209	leal	startup_64(%ebp), %eax
210#ifdef CONFIG_EFI_MIXED
211	movl	efi32_boot_args(%ebp), %edi
212	cmp	$0, %edi
213	jz	1f
214	leal	efi64_stub_entry(%ebp), %eax
215	movl	%esi, %edx
216	movl	efi32_boot_args+4(%ebp), %esi
2171:
218#endif
219	pushl	%eax
220
221	/* Enter paged protected Mode, activating Long Mode */
222	movl	$(X86_CR0_PG | X86_CR0_PE), %eax /* Enable Paging and Protected mode */
223	movl	%eax, %cr0
224
225	/* Jump from 32bit compatibility mode into 64bit mode. */
226	lret
227SYM_FUNC_END(startup_32)
228
229#ifdef CONFIG_EFI_MIXED
230	.org 0x190
231SYM_FUNC_START(efi32_stub_entry)
232	add	$0x4, %esp		/* Discard return address */
233	popl	%ecx
234	popl	%edx
235	popl	%esi
236
237	call	1f
2381:	pop	%ebp
239	subl	$1b, %ebp
240
241	movl	%ecx, efi32_boot_args(%ebp)
242	movl	%edx, efi32_boot_args+4(%ebp)
243	sgdtl	efi32_boot_gdt(%ebp)
244	movb	$0, efi_is64(%ebp)
245
246	/* Disable paging */
247	movl	%cr0, %eax
248	btrl	$X86_CR0_PG_BIT, %eax
249	movl	%eax, %cr0
250
251	jmp	startup_32
252SYM_FUNC_END(efi32_stub_entry)
253#endif
254
255	.code64
256	.org 0x200
257SYM_CODE_START(startup_64)
258	/*
259	 * 64bit entry is 0x200 and it is ABI so immutable!
260	 * We come here either from startup_32 or directly from a
261	 * 64bit bootloader.
262	 * If we come here from a bootloader, kernel(text+data+bss+brk),
263	 * ramdisk, zero_page, command line could be above 4G.
264	 * We depend on an identity mapped page table being provided
265	 * that maps our entire kernel(text+data+bss+brk), zero page
266	 * and command line.
267	 */
268
269	/* Setup data segments. */
270	xorl	%eax, %eax
271	movl	%eax, %ds
272	movl	%eax, %es
273	movl	%eax, %ss
274	movl	%eax, %fs
275	movl	%eax, %gs
276
277	/*
278	 * Compute the decompressed kernel start address.  It is where
279	 * we were loaded at aligned to a 2M boundary. %rbp contains the
280	 * decompressed kernel start address.
281	 *
282	 * If it is a relocatable kernel then decompress and run the kernel
283	 * from load address aligned to 2MB addr, otherwise decompress and
284	 * run the kernel from LOAD_PHYSICAL_ADDR
285	 *
286	 * We cannot rely on the calculation done in 32-bit mode, since we
287	 * may have been invoked via the 64-bit entry point.
288	 */
289
290	/* Start with the delta to where the kernel will run at. */
291#ifdef CONFIG_RELOCATABLE
292	leaq	startup_32(%rip) /* - $startup_32 */, %rbp
293	movl	BP_kernel_alignment(%rsi), %eax
294	decl	%eax
295	addq	%rax, %rbp
296	notq	%rax
297	andq	%rax, %rbp
298	cmpq	$LOAD_PHYSICAL_ADDR, %rbp
299	jge	1f
300#endif
301	movq	$LOAD_PHYSICAL_ADDR, %rbp
3021:
303
304	/* Target address to relocate to for decompression */
305	movl	BP_init_size(%rsi), %ebx
306	subl	$_end, %ebx
307	addq	%rbp, %rbx
308
309	/* Set up the stack */
310	leaq	boot_stack_end(%rbx), %rsp
311
312	/*
313	 * paging_prepare() and cleanup_trampoline() below can have GOT
314	 * references. Adjust the table with address we are running at.
315	 *
316	 * Zero RAX for adjust_got: the GOT was not adjusted before;
317	 * there's no adjustment to undo.
318	 */
319	xorq	%rax, %rax
320
321	/*
322	 * Calculate the address the binary is loaded at and use it as
323	 * a GOT adjustment.
324	 */
325	call	1f
3261:	popq	%rdi
327	subq	$1b, %rdi
328
329	call	.Ladjust_got
330
331	/*
332	 * At this point we are in long mode with 4-level paging enabled,
333	 * but we might want to enable 5-level paging or vice versa.
334	 *
335	 * The problem is that we cannot do it directly. Setting or clearing
336	 * CR4.LA57 in long mode would trigger #GP. So we need to switch off
337	 * long mode and paging first.
338	 *
339	 * We also need a trampoline in lower memory to switch over from
340	 * 4- to 5-level paging for cases when the bootloader puts the kernel
341	 * above 4G, but didn't enable 5-level paging for us.
342	 *
343	 * The same trampoline can be used to switch from 5- to 4-level paging
344	 * mode, like when starting 4-level paging kernel via kexec() when
345	 * original kernel worked in 5-level paging mode.
346	 *
347	 * For the trampoline, we need the top page table to reside in lower
348	 * memory as we don't have a way to load 64-bit values into CR3 in
349	 * 32-bit mode.
350	 *
351	 * We go though the trampoline even if we don't have to: if we're
352	 * already in a desired paging mode. This way the trampoline code gets
353	 * tested on every boot.
354	 */
355
356	/* Make sure we have GDT with 32-bit code segment */
357	leaq	gdt(%rip), %rax
358	movq	%rax, gdt64+2(%rip)
359	lgdt	gdt64(%rip)
360
361	/*
362	 * paging_prepare() sets up the trampoline and checks if we need to
363	 * enable 5-level paging.
364	 *
365	 * paging_prepare() returns a two-quadword structure which lands
366	 * into RDX:RAX:
367	 *   - Address of the trampoline is returned in RAX.
368	 *   - Non zero RDX means trampoline needs to enable 5-level
369	 *     paging.
370	 *
371	 * RSI holds real mode data and needs to be preserved across
372	 * this function call.
373	 */
374	pushq	%rsi
375	movq	%rsi, %rdi		/* real mode address */
376	call	paging_prepare
377	popq	%rsi
378
379	/* Save the trampoline address in RCX */
380	movq	%rax, %rcx
381
382	/*
383	 * Load the address of trampoline_return() into RDI.
384	 * It will be used by the trampoline to return to the main code.
385	 */
386	leaq	trampoline_return(%rip), %rdi
387
388	/* Switch to compatibility mode (CS.L = 0 CS.D = 1) via far return */
389	pushq	$__KERNEL32_CS
390	leaq	TRAMPOLINE_32BIT_CODE_OFFSET(%rax), %rax
391	pushq	%rax
392	lretq
393trampoline_return:
394	/* Restore the stack, the 32-bit trampoline uses its own stack */
395	leaq	boot_stack_end(%rbx), %rsp
396
397	/*
398	 * cleanup_trampoline() would restore trampoline memory.
399	 *
400	 * RDI is address of the page table to use instead of page table
401	 * in trampoline memory (if required).
402	 *
403	 * RSI holds real mode data and needs to be preserved across
404	 * this function call.
405	 */
406	pushq	%rsi
407	leaq	top_pgtable(%rbx), %rdi
408	call	cleanup_trampoline
409	popq	%rsi
410
411	/* Zero EFLAGS */
412	pushq	$0
413	popfq
414
415	/*
416	 * Previously we've adjusted the GOT with address the binary was
417	 * loaded at. Now we need to re-adjust for relocation address.
418	 *
419	 * Calculate the address the binary is loaded at, so that we can
420	 * undo the previous GOT adjustment.
421	 */
422	call	1f
4231:	popq	%rax
424	subq	$1b, %rax
425
426	/* The new adjustment is the relocation address */
427	movq	%rbx, %rdi
428	call	.Ladjust_got
429
430/*
431 * Copy the compressed kernel to the end of our buffer
432 * where decompression in place becomes safe.
433 */
434	pushq	%rsi
435	leaq	(_bss-8)(%rip), %rsi
436	leaq	(_bss-8)(%rbx), %rdi
437	movq	$_bss /* - $startup_32 */, %rcx
438	shrq	$3, %rcx
439	std
440	rep	movsq
441	cld
442	popq	%rsi
443
444/*
445 * Jump to the relocated address.
446 */
447	leaq	.Lrelocated(%rbx), %rax
448	jmp	*%rax
449SYM_CODE_END(startup_64)
450
451#ifdef CONFIG_EFI_STUB
452	.org 0x390
453SYM_FUNC_START(efi64_stub_entry)
454SYM_FUNC_START_ALIAS(efi_stub_entry)
455	and	$~0xf, %rsp			/* realign the stack */
456	call	efi_main
457	movq	%rax,%rsi
458	movl	BP_code32_start(%esi), %eax
459	leaq	startup_64(%rax), %rax
460	jmp	*%rax
461SYM_FUNC_END(efi64_stub_entry)
462SYM_FUNC_END_ALIAS(efi_stub_entry)
463#endif
464
465	.text
466SYM_FUNC_START_LOCAL_NOALIGN(.Lrelocated)
467
468/*
469 * Clear BSS (stack is currently empty)
470 */
471	xorl	%eax, %eax
472	leaq    _bss(%rip), %rdi
473	leaq    _ebss(%rip), %rcx
474	subq	%rdi, %rcx
475	shrq	$3, %rcx
476	rep	stosq
477
478/*
479 * Do the extraction, and jump to the new kernel..
480 */
481	pushq	%rsi			/* Save the real mode argument */
482	movq	%rsi, %rdi		/* real mode address */
483	leaq	boot_heap(%rip), %rsi	/* malloc area for uncompression */
484	leaq	input_data(%rip), %rdx  /* input_data */
485	movl	$z_input_len, %ecx	/* input_len */
486	movq	%rbp, %r8		/* output target address */
487	movq	$z_output_len, %r9	/* decompressed length, end of relocs */
488	call	extract_kernel		/* returns kernel location in %rax */
489	popq	%rsi
490
491/*
492 * Jump to the decompressed kernel.
493 */
494	jmp	*%rax
495SYM_FUNC_END(.Lrelocated)
496
497/*
498 * Adjust the global offset table
499 *
500 * RAX is the previous adjustment of the table to undo (use 0 if it's the
501 * first time we touch GOT).
502 * RDI is the new adjustment to apply.
503 */
504.Ladjust_got:
505	/* Walk through the GOT adding the address to the entries */
506	leaq	_got(%rip), %rdx
507	leaq	_egot(%rip), %rcx
5081:
509	cmpq	%rcx, %rdx
510	jae	2f
511	subq	%rax, (%rdx)	/* Undo previous adjustment */
512	addq	%rdi, (%rdx)	/* Apply the new adjustment */
513	addq	$8, %rdx
514	jmp	1b
5152:
516	ret
517
518	.code32
519/*
520 * This is the 32-bit trampoline that will be copied over to low memory.
521 *
522 * RDI contains the return address (might be above 4G).
523 * ECX contains the base address of the trampoline memory.
524 * Non zero RDX means trampoline needs to enable 5-level paging.
525 */
526SYM_CODE_START(trampoline_32bit_src)
527	/* Set up data and stack segments */
528	movl	$__KERNEL_DS, %eax
529	movl	%eax, %ds
530	movl	%eax, %ss
531
532	/* Set up new stack */
533	leal	TRAMPOLINE_32BIT_STACK_END(%ecx), %esp
534
535	/* Disable paging */
536	movl	%cr0, %eax
537	btrl	$X86_CR0_PG_BIT, %eax
538	movl	%eax, %cr0
539
540	/* Check what paging mode we want to be in after the trampoline */
541	cmpl	$0, %edx
542	jz	1f
543
544	/* We want 5-level paging: don't touch CR3 if it already points to 5-level page tables */
545	movl	%cr4, %eax
546	testl	$X86_CR4_LA57, %eax
547	jnz	3f
548	jmp	2f
5491:
550	/* We want 4-level paging: don't touch CR3 if it already points to 4-level page tables */
551	movl	%cr4, %eax
552	testl	$X86_CR4_LA57, %eax
553	jz	3f
5542:
555	/* Point CR3 to the trampoline's new top level page table */
556	leal	TRAMPOLINE_32BIT_PGTABLE_OFFSET(%ecx), %eax
557	movl	%eax, %cr3
5583:
559	/* Set EFER.LME=1 as a precaution in case hypervsior pulls the rug */
560	pushl	%ecx
561	pushl	%edx
562	movl	$MSR_EFER, %ecx
563	rdmsr
564	btsl	$_EFER_LME, %eax
565	wrmsr
566	popl	%edx
567	popl	%ecx
568
569	/* Enable PAE and LA57 (if required) paging modes */
570	movl	$X86_CR4_PAE, %eax
571	cmpl	$0, %edx
572	jz	1f
573	orl	$X86_CR4_LA57, %eax
5741:
575	movl	%eax, %cr4
576
577	/* Calculate address of paging_enabled() once we are executing in the trampoline */
578	leal	.Lpaging_enabled - trampoline_32bit_src + TRAMPOLINE_32BIT_CODE_OFFSET(%ecx), %eax
579
580	/* Prepare the stack for far return to Long Mode */
581	pushl	$__KERNEL_CS
582	pushl	%eax
583
584	/* Enable paging again */
585	movl	$(X86_CR0_PG | X86_CR0_PE), %eax
586	movl	%eax, %cr0
587
588	lret
589SYM_CODE_END(trampoline_32bit_src)
590
591	.code64
592SYM_FUNC_START_LOCAL_NOALIGN(.Lpaging_enabled)
593	/* Return from the trampoline */
594	jmp	*%rdi
595SYM_FUNC_END(.Lpaging_enabled)
596
597	/*
598         * The trampoline code has a size limit.
599         * Make sure we fail to compile if the trampoline code grows
600         * beyond TRAMPOLINE_32BIT_CODE_SIZE bytes.
601	 */
602	.org	trampoline_32bit_src + TRAMPOLINE_32BIT_CODE_SIZE
603
604	.code32
605SYM_FUNC_START_LOCAL_NOALIGN(.Lno_longmode)
606	/* This isn't an x86-64 CPU, so hang intentionally, we cannot continue */
6071:
608	hlt
609	jmp     1b
610SYM_FUNC_END(.Lno_longmode)
611
612#include "../../kernel/verify_cpu.S"
613
614	.data
615SYM_DATA_START_LOCAL(gdt64)
616	.word	gdt_end - gdt
617	.quad   0
618SYM_DATA_END(gdt64)
619	.balign	8
620SYM_DATA_START_LOCAL(gdt)
621	.word	gdt_end - gdt
622	.long	gdt
623	.word	0
624	.quad	0x00cf9a000000ffff	/* __KERNEL32_CS */
625	.quad	0x00af9a000000ffff	/* __KERNEL_CS */
626	.quad	0x00cf92000000ffff	/* __KERNEL_DS */
627	.quad	0x0080890000000000	/* TS descriptor */
628	.quad   0x0000000000000000	/* TS continued */
629SYM_DATA_END_LABEL(gdt, SYM_L_LOCAL, gdt_end)
630
631#ifdef CONFIG_EFI_MIXED
632SYM_DATA_LOCAL(efi32_boot_args, .long 0, 0)
633SYM_DATA(efi_is64, .byte 1)
634#endif
635
636/*
637 * Stack and heap for uncompression
638 */
639	.bss
640	.balign 4
641SYM_DATA_LOCAL(boot_heap,	.fill BOOT_HEAP_SIZE, 1, 0)
642
643SYM_DATA_START_LOCAL(boot_stack)
644	.fill BOOT_STACK_SIZE, 1, 0
645SYM_DATA_END_LABEL(boot_stack, SYM_L_LOCAL, boot_stack_end)
646
647/*
648 * Space for page tables (not in .bss so not zeroed)
649 */
650	.section ".pgtable","a",@nobits
651	.balign 4096
652SYM_DATA_LOCAL(pgtable,		.fill BOOT_PGT_SIZE, 1, 0)
653
654/*
655 * The page table is going to be used instead of page table in the trampoline
656 * memory.
657 */
658SYM_DATA_LOCAL(top_pgtable,	.fill PAGE_SIZE, 1, 0)
659