1 /* 2 * Linux Boot Option ROM for fw_cfg DMA 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License as published by 6 * the Free Software Foundation; either version 2 of the License, or 7 * (at your option) any later version. 8 * 9 * This program is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * 14 * You should have received a copy of the GNU General Public License 15 * along with this program; if not, see <http://www.gnu.org/licenses/>. 16 * 17 * Copyright (c) 2015-2016 Red Hat Inc. 18 * Authors: 19 * Marc Marí <marc.mari.barcelo@gmail.com> 20 * Richard W.M. Jones <rjones@redhat.com> 21 */ 22 23 asm( 24 ".text\n" 25 ".global _start\n" 26 "_start:\n" 27 " .short 0xaa55\n" 28 " .byte 0\n" /* size in 512 units, filled in by signrom.py */ 29 " .byte 0xcb\n" /* far return without prefix */ 30 " .org 0x18\n" 31 " .short 0\n" 32 " .short _pnph\n" 33 "_pnph:\n" 34 " .ascii \"$PnP\"\n" 35 " .byte 0x01\n" 36 " .byte (_pnph_len / 16)\n" 37 " .short 0x0000\n" 38 " .byte 0x00\n" 39 " .byte 0x00\n" 40 " .long 0x00000000\n" 41 " .short _manufacturer\n" 42 " .short _product\n" 43 " .long 0x00000000\n" 44 " .short 0x0000\n" 45 " .short 0x0000\n" 46 " .short _bev\n" 47 " .short 0x0000\n" 48 " .short 0x0000\n" 49 " .equ _pnph_len, . - _pnph\n" 50 "_manufacturer:\n" 51 " .asciz \"QEMU\"\n" 52 "_product:\n" 53 " .asciz \"Linux loader DMA\"\n" 54 " .align 4, 0\n" 55 "_bev:\n" 56 " cli\n" 57 " cld\n" 58 " jmp load_kernel\n" 59 ); 60 61 #include "../../include/hw/nvram/fw_cfg_keys.h" 62 63 /* QEMU_CFG_DMA_CONTROL bits */ 64 #define BIOS_CFG_DMA_CTL_ERROR 0x01 65 #define BIOS_CFG_DMA_CTL_READ 0x02 66 #define BIOS_CFG_DMA_CTL_SKIP 0x04 67 #define BIOS_CFG_DMA_CTL_SELECT 0x08 68 69 #define BIOS_CFG_DMA_ADDR_HIGH 0x514 70 #define BIOS_CFG_DMA_ADDR_LOW 0x518 71 72 #define uint64_t unsigned long long 73 #define uint32_t unsigned int 74 #define uint16_t unsigned short 75 76 #define barrier() asm("" : : : "memory") 77 78 typedef struct FWCfgDmaAccess { 79 uint32_t control; 80 uint32_t length; 81 uint64_t address; 82 } __attribute__((packed)) FWCfgDmaAccess; 83 84 static inline void outl(uint32_t value, uint16_t port) 85 { 86 asm("outl %0, %w1" : : "a"(value), "Nd"(port)); 87 } 88 89 static inline void set_es(void *addr) 90 { 91 uint32_t seg = (uint32_t)addr >> 4; 92 asm("movl %0, %%es" : : "r"(seg)); 93 } 94 95 #ifdef __clang__ 96 #define ADDR32 97 #else 98 #define ADDR32 "addr32 " 99 #endif 100 101 static inline uint16_t readw_es(uint16_t offset) 102 { 103 uint16_t val; 104 asm(ADDR32 "movw %%es:(%1), %0" : "=r"(val) : "r"((uint32_t)offset)); 105 barrier(); 106 return val; 107 } 108 109 static inline uint32_t readl_es(uint16_t offset) 110 { 111 uint32_t val; 112 asm(ADDR32 "movl %%es:(%1), %0" : "=r"(val) : "r"((uint32_t)offset)); 113 barrier(); 114 return val; 115 } 116 117 static inline void writel_es(uint16_t offset, uint32_t val) 118 { 119 barrier(); 120 asm(ADDR32 "movl %0, %%es:(%1)" : : "r"(val), "r"((uint32_t)offset)); 121 } 122 123 static inline uint32_t bswap32(uint32_t x) 124 { 125 return 126 ((x & 0x000000ffU) << 24) | 127 ((x & 0x0000ff00U) << 8) | 128 ((x & 0x00ff0000U) >> 8) | 129 ((x & 0xff000000U) >> 24); 130 } 131 132 static inline uint64_t bswap64(uint64_t x) 133 { 134 return 135 ((x & 0x00000000000000ffULL) << 56) | 136 ((x & 0x000000000000ff00ULL) << 40) | 137 ((x & 0x0000000000ff0000ULL) << 24) | 138 ((x & 0x00000000ff000000ULL) << 8) | 139 ((x & 0x000000ff00000000ULL) >> 8) | 140 ((x & 0x0000ff0000000000ULL) >> 24) | 141 ((x & 0x00ff000000000000ULL) >> 40) | 142 ((x & 0xff00000000000000ULL) >> 56); 143 } 144 145 static inline uint64_t cpu_to_be64(uint64_t x) 146 { 147 return bswap64(x); 148 } 149 150 static inline uint32_t cpu_to_be32(uint32_t x) 151 { 152 return bswap32(x); 153 } 154 155 static inline uint32_t be32_to_cpu(uint32_t x) 156 { 157 return bswap32(x); 158 } 159 160 static void bios_cfg_read_entry(void *buf, uint16_t entry, uint32_t len) 161 { 162 FWCfgDmaAccess access; 163 uint32_t control = (entry << 16) | BIOS_CFG_DMA_CTL_SELECT 164 | BIOS_CFG_DMA_CTL_READ; 165 166 access.address = cpu_to_be64((uint64_t)(uint32_t)buf); 167 access.length = cpu_to_be32(len); 168 access.control = cpu_to_be32(control); 169 170 barrier(); 171 172 outl(cpu_to_be32((uint32_t)&access), BIOS_CFG_DMA_ADDR_LOW); 173 174 while (be32_to_cpu(access.control) & ~BIOS_CFG_DMA_CTL_ERROR) { 175 barrier(); 176 } 177 } 178 179 /* Return top of memory using BIOS function E801. */ 180 static uint32_t get_e801_addr(void) 181 { 182 uint16_t ax, bx, cx, dx; 183 uint32_t ret; 184 185 asm("int $0x15\n" 186 : "=a"(ax), "=b"(bx), "=c"(cx), "=d"(dx) 187 : "a"(0xe801), "b"(0), "c"(0), "d"(0)); 188 189 /* Not SeaBIOS, but in theory a BIOS could return CX=DX=0 in which 190 * case we need to use the result from AX & BX instead. 191 */ 192 if (cx == 0 && dx == 0) { 193 cx = ax; 194 dx = bx; 195 } 196 197 if (dx) { 198 /* DX = extended memory above 16M, in 64K units. 199 * Convert it to bytes and return. 200 */ 201 ret = ((uint32_t)dx + 256 /* 16M in 64K units */) << 16; 202 } else { 203 /* This is a fallback path for machines with <= 16MB of RAM, 204 * which probably would never be the case, but deal with it 205 * anyway. 206 * 207 * CX = extended memory between 1M and 16M, in kilobytes 208 * Convert it to bytes and return. 209 */ 210 ret = ((uint32_t)cx + 1024 /* 1M in K */) << 10; 211 } 212 213 return ret; 214 } 215 216 /* Force the asm name without leading underscore, even on Win32. */ 217 extern void load_kernel(void) asm("load_kernel"); 218 219 void load_kernel(void) 220 { 221 void *setup_addr; 222 void *initrd_addr; 223 void *kernel_addr; 224 void *cmdline_addr; 225 uint32_t setup_size; 226 uint32_t initrd_size; 227 uint32_t kernel_size; 228 uint32_t cmdline_size; 229 uint32_t initrd_end_page, max_allowed_page; 230 uint32_t segment_addr, stack_addr; 231 232 bios_cfg_read_entry(&setup_addr, FW_CFG_SETUP_ADDR, 4); 233 bios_cfg_read_entry(&setup_size, FW_CFG_SETUP_SIZE, 4); 234 bios_cfg_read_entry(setup_addr, FW_CFG_SETUP_DATA, setup_size); 235 236 set_es(setup_addr); 237 238 /* For protocol < 0x203 we don't have initrd_max ... */ 239 if (readw_es(0x206) < 0x203) { 240 /* ... so we assume initrd_max = 0x37ffffff. */ 241 writel_es(0x22c, 0x37ffffff); 242 } 243 244 bios_cfg_read_entry(&initrd_addr, FW_CFG_INITRD_ADDR, 4); 245 bios_cfg_read_entry(&initrd_size, FW_CFG_INITRD_SIZE, 4); 246 247 initrd_end_page = ((uint32_t)(initrd_addr + initrd_size) & -4096); 248 max_allowed_page = (readl_es(0x22c) & -4096); 249 250 if (initrd_end_page != 0 && max_allowed_page != 0 && 251 initrd_end_page != max_allowed_page) { 252 /* Initrd at the end of memory. Compute better initrd address 253 * based on e801 data 254 */ 255 initrd_addr = (void *)((get_e801_addr() - initrd_size) & -4096); 256 writel_es(0x218, (uint32_t)initrd_addr); 257 258 } 259 260 bios_cfg_read_entry(initrd_addr, FW_CFG_INITRD_DATA, initrd_size); 261 262 bios_cfg_read_entry(&kernel_addr, FW_CFG_KERNEL_ADDR, 4); 263 bios_cfg_read_entry(&kernel_size, FW_CFG_KERNEL_SIZE, 4); 264 bios_cfg_read_entry(kernel_addr, FW_CFG_KERNEL_DATA, kernel_size); 265 266 bios_cfg_read_entry(&cmdline_addr, FW_CFG_CMDLINE_ADDR, 4); 267 bios_cfg_read_entry(&cmdline_size, FW_CFG_CMDLINE_SIZE, 4); 268 bios_cfg_read_entry(cmdline_addr, FW_CFG_CMDLINE_DATA, cmdline_size); 269 270 /* Boot linux */ 271 segment_addr = ((uint32_t)setup_addr >> 4); 272 stack_addr = (uint32_t)(cmdline_addr - setup_addr - 16); 273 274 /* As we are changing critical registers, we cannot leave freedom to the 275 * compiler. 276 */ 277 asm("movw %%ax, %%ds\n" 278 "movw %%ax, %%es\n" 279 "movw %%ax, %%fs\n" 280 "movw %%ax, %%gs\n" 281 "movw %%ax, %%ss\n" 282 "movl %%ebx, %%esp\n" 283 "addw $0x20, %%ax\n" 284 "pushw %%ax\n" /* CS */ 285 "pushw $0\n" /* IP */ 286 /* Clear registers and jump to Linux */ 287 "xor %%ebx, %%ebx\n" 288 "xor %%ecx, %%ecx\n" 289 "xor %%edx, %%edx\n" 290 "xor %%edi, %%edi\n" 291 "xor %%ebp, %%ebp\n" 292 "lretw\n" 293 : : "a"(segment_addr), "b"(stack_addr)); 294 } 295