1 /*
2  * Linux Boot Option ROM for fw_cfg DMA
3  *
4  * This program is free software; you can redistribute it and/or modify
5  * it under the terms of the GNU General Public License as published by
6  * the Free Software Foundation; either version 2 of the License, or
7  * (at your option) any later version.
8  *
9  * This program is distributed in the hope that it will be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12  * GNU General Public License for more details.
13  *
14  * You should have received a copy of the GNU General Public License
15  * along with this program; if not, see <http://www.gnu.org/licenses/>.
16  *
17  * Copyright (c) 2015-2016 Red Hat Inc.
18  *   Authors:
19  *     Marc Marí <marc.mari.barcelo@gmail.com>
20  *     Richard W.M. Jones <rjones@redhat.com>
21  */
22 
23 asm(
24 ".text\n"
25 ".global _start\n"
26 "_start:\n"
27 "   .short 0xaa55\n"
28 "   .byte 3\n" /* desired size in 512 units; signrom.py adds padding */
29 "   .byte 0xcb\n" /* far return without prefix */
30 "   .org 0x18\n"
31 "   .short 0\n"
32 "   .short _pnph\n"
33 "_pnph:\n"
34 "   .ascii \"$PnP\"\n"
35 "   .byte 0x01\n"
36 "   .byte (_pnph_len / 16)\n"
37 "   .short 0x0000\n"
38 "   .byte 0x00\n"
39 "   .byte 0x00\n"
40 "   .long 0x00000000\n"
41 "   .short _manufacturer\n"
42 "   .short _product\n"
43 "   .long 0x00000000\n"
44 "   .short 0x0000\n"
45 "   .short 0x0000\n"
46 "   .short _bev\n"
47 "   .short 0x0000\n"
48 "   .short 0x0000\n"
49 "   .equ _pnph_len, . - _pnph\n"
50 "_manufacturer:\n"
51 "   .asciz \"QEMU\"\n"
52 "_product:\n"
53 "   .asciz \"Linux loader DMA\"\n"
54 "   .align 4, 0\n"
55 "_bev:\n"
56 "   cli\n"
57 "   cld\n"
58 "   jmp load_kernel\n"
59 );
60 
61 #include "../../include/hw/nvram/fw_cfg_keys.h"
62 
63 /* QEMU_CFG_DMA_CONTROL bits */
64 #define BIOS_CFG_DMA_CTL_ERROR   0x01
65 #define BIOS_CFG_DMA_CTL_READ    0x02
66 #define BIOS_CFG_DMA_CTL_SKIP    0x04
67 #define BIOS_CFG_DMA_CTL_SELECT  0x08
68 
69 #define BIOS_CFG_DMA_ADDR_HIGH 0x514
70 #define BIOS_CFG_DMA_ADDR_LOW  0x518
71 
72 #define uint64_t unsigned long long
73 #define uint32_t unsigned int
74 #define uint16_t unsigned short
75 
76 #define barrier() asm("" : : : "memory")
77 
78 typedef struct FWCfgDmaAccess {
79     uint32_t control;
80     uint32_t length;
81     uint64_t address;
82 } __attribute__((packed)) FWCfgDmaAccess;
83 
84 static inline void outl(uint32_t value, uint16_t port)
85 {
86     asm("outl %0, %w1" : : "a"(value), "Nd"(port));
87 }
88 
89 static inline void set_es(void *addr)
90 {
91     uint32_t seg = (uint32_t)addr >> 4;
92     asm("movl %0, %%es" : : "r"(seg));
93 }
94 
95 #ifdef __clang__
96 #define ADDR32
97 #else
98 #define ADDR32 "addr32 "
99 #endif
100 
101 static inline uint16_t readw_es(uint16_t offset)
102 {
103     uint16_t val;
104     asm(ADDR32 "movw %%es:(%1), %0" : "=r"(val) : "r"((uint32_t)offset));
105     barrier();
106     return val;
107 }
108 
109 static inline uint32_t readl_es(uint16_t offset)
110 {
111     uint32_t val;
112     asm(ADDR32 "movl %%es:(%1), %0" : "=r"(val) : "r"((uint32_t)offset));
113     barrier();
114     return val;
115 }
116 
117 static inline void writel_es(uint16_t offset, uint32_t val)
118 {
119     barrier();
120     asm(ADDR32 "movl %0, %%es:(%1)" : : "r"(val), "r"((uint32_t)offset));
121 }
122 
123 static inline uint32_t bswap32(uint32_t x)
124 {
125     return
126         ((x & 0x000000ffU) << 24) |
127         ((x & 0x0000ff00U) <<  8) |
128         ((x & 0x00ff0000U) >>  8) |
129         ((x & 0xff000000U) >> 24);
130 }
131 
132 static inline uint64_t bswap64(uint64_t x)
133 {
134     return
135         ((x & 0x00000000000000ffULL) << 56) |
136         ((x & 0x000000000000ff00ULL) << 40) |
137         ((x & 0x0000000000ff0000ULL) << 24) |
138         ((x & 0x00000000ff000000ULL) <<  8) |
139         ((x & 0x000000ff00000000ULL) >>  8) |
140         ((x & 0x0000ff0000000000ULL) >> 24) |
141         ((x & 0x00ff000000000000ULL) >> 40) |
142         ((x & 0xff00000000000000ULL) >> 56);
143 }
144 
145 static inline uint64_t cpu_to_be64(uint64_t x)
146 {
147     return bswap64(x);
148 }
149 
150 static inline uint32_t cpu_to_be32(uint32_t x)
151 {
152     return bswap32(x);
153 }
154 
155 static inline uint32_t be32_to_cpu(uint32_t x)
156 {
157     return bswap32(x);
158 }
159 
160 /* clang is happy to inline this function, and bloats the
161  * ROM.
162  */
163 static __attribute__((__noinline__))
164 void bios_cfg_read_entry(void *buf, uint16_t entry, uint32_t len)
165 {
166     FWCfgDmaAccess access;
167     uint32_t control = (entry << 16) | BIOS_CFG_DMA_CTL_SELECT
168                         | BIOS_CFG_DMA_CTL_READ;
169 
170     access.address = cpu_to_be64((uint64_t)(uint32_t)buf);
171     access.length = cpu_to_be32(len);
172     access.control = cpu_to_be32(control);
173 
174     barrier();
175 
176     outl(cpu_to_be32((uint32_t)&access), BIOS_CFG_DMA_ADDR_LOW);
177 
178     while (be32_to_cpu(access.control) & ~BIOS_CFG_DMA_CTL_ERROR) {
179         barrier();
180     }
181 }
182 
183 /* Return top of memory using BIOS function E801. */
184 static uint32_t get_e801_addr(void)
185 {
186     uint16_t ax, bx, cx, dx;
187     uint32_t ret;
188 
189     asm("int $0x15\n"
190         : "=a"(ax), "=b"(bx), "=c"(cx), "=d"(dx)
191         : "a"(0xe801), "b"(0), "c"(0), "d"(0));
192 
193     /* Not SeaBIOS, but in theory a BIOS could return CX=DX=0 in which
194      * case we need to use the result from AX & BX instead.
195      */
196     if (cx == 0 && dx == 0) {
197         cx = ax;
198         dx = bx;
199     }
200 
201     if (dx) {
202         /* DX = extended memory above 16M, in 64K units.
203          * Convert it to bytes and return.
204          */
205         ret = ((uint32_t)dx + 256 /* 16M in 64K units */) << 16;
206     } else {
207         /* This is a fallback path for machines with <= 16MB of RAM,
208          * which probably would never be the case, but deal with it
209          * anyway.
210          *
211          * CX = extended memory between 1M and 16M, in kilobytes
212          * Convert it to bytes and return.
213          */
214         ret = ((uint32_t)cx + 1024 /* 1M in K */) << 10;
215     }
216 
217     return ret;
218 }
219 
220 /* Force the asm name without leading underscore, even on Win32. */
221 extern void load_kernel(void) asm("load_kernel");
222 
223 void load_kernel(void)
224 {
225     void *setup_addr;
226     void *initrd_addr;
227     void *kernel_addr;
228     void *cmdline_addr;
229     uint32_t setup_size;
230     uint32_t initrd_size;
231     uint32_t kernel_size;
232     uint32_t cmdline_size;
233     uint32_t initrd_end_page, max_allowed_page;
234     uint32_t segment_addr, stack_addr;
235 
236     bios_cfg_read_entry(&setup_addr, FW_CFG_SETUP_ADDR, 4);
237     bios_cfg_read_entry(&setup_size, FW_CFG_SETUP_SIZE, 4);
238     bios_cfg_read_entry(setup_addr, FW_CFG_SETUP_DATA, setup_size);
239 
240     set_es(setup_addr);
241 
242     /* For protocol < 0x203 we don't have initrd_max ... */
243     if (readw_es(0x206) < 0x203) {
244         /* ... so we assume initrd_max = 0x37ffffff. */
245         writel_es(0x22c, 0x37ffffff);
246     }
247 
248     bios_cfg_read_entry(&initrd_addr, FW_CFG_INITRD_ADDR, 4);
249     bios_cfg_read_entry(&initrd_size, FW_CFG_INITRD_SIZE, 4);
250 
251     initrd_end_page = ((uint32_t)(initrd_addr + initrd_size) & -4096);
252     max_allowed_page = (readl_es(0x22c) & -4096);
253 
254     if (initrd_end_page != 0 && max_allowed_page != 0 &&
255         initrd_end_page != max_allowed_page) {
256         /* Initrd at the end of memory. Compute better initrd address
257          * based on e801 data
258          */
259         initrd_addr = (void *)((get_e801_addr() - initrd_size) & -4096);
260         writel_es(0x218, (uint32_t)initrd_addr);
261 
262     }
263 
264     bios_cfg_read_entry(initrd_addr, FW_CFG_INITRD_DATA, initrd_size);
265 
266     bios_cfg_read_entry(&kernel_addr, FW_CFG_KERNEL_ADDR, 4);
267     bios_cfg_read_entry(&kernel_size, FW_CFG_KERNEL_SIZE, 4);
268     bios_cfg_read_entry(kernel_addr, FW_CFG_KERNEL_DATA, kernel_size);
269 
270     bios_cfg_read_entry(&cmdline_addr, FW_CFG_CMDLINE_ADDR, 4);
271     bios_cfg_read_entry(&cmdline_size, FW_CFG_CMDLINE_SIZE, 4);
272     bios_cfg_read_entry(cmdline_addr, FW_CFG_CMDLINE_DATA, cmdline_size);
273 
274     /* Boot linux */
275     segment_addr = ((uint32_t)setup_addr >> 4);
276     stack_addr = (uint32_t)(cmdline_addr - setup_addr - 16);
277 
278     /* As we are changing critical registers, we cannot leave freedom to the
279      * compiler.
280      */
281     asm("movw %%ax, %%ds\n"
282         "movw %%ax, %%es\n"
283         "movw %%ax, %%fs\n"
284         "movw %%ax, %%gs\n"
285         "movw %%ax, %%ss\n"
286         "movl %%ebx, %%esp\n"
287         "addw $0x20, %%ax\n"
288         "pushw %%ax\n" /* CS */
289         "pushw $0\n" /* IP */
290         /* Clear registers and jump to Linux */
291         "xor %%ebx, %%ebx\n"
292         "xor %%ecx, %%ecx\n"
293         "xor %%edx, %%edx\n"
294         "xor %%edi, %%edi\n"
295         "xor %%ebp, %%ebp\n"
296         "lretw\n"
297         : : "a"(segment_addr), "b"(stack_addr));
298 }
299