cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

jump2ipl.c (2844B)

      1/*
      2 * QEMU s390-ccw firmware - jump to IPL code
      3 *
      4 * This work is licensed under the terms of the GNU GPL, version 2 or (at
      5 * your option) any later version. See the COPYING file in the top-level
      6 * directory.
      7 */
      8
      9#include "libc.h"
     10#include "s390-ccw.h"
     11#include "s390-arch.h"
     12
     13#define KERN_IMAGE_START 0x010000UL
     14#define RESET_PSW_MASK (PSW_MASK_SHORTPSW | PSW_MASK_64)
     15#define RESET_PSW ((uint64_t)&jump_to_IPL_addr | RESET_PSW_MASK)
     16
     17static uint64_t *reset_psw = 0, save_psw, ipl_continue;
     18
     19void write_reset_psw(uint64_t psw)
     20{
     21    *reset_psw = psw;
     22}
     23
     24static void jump_to_IPL_addr(void)
     25{
     26    __attribute__((noreturn)) void (*ipl)(void) = (void *)ipl_continue;
     27
     28    /* Restore reset PSW */
     29    write_reset_psw(save_psw);
     30
     31    ipl();
     32    /* should not return */
     33}
     34
     35void jump_to_IPL_code(uint64_t address)
     36{
     37    /* store the subsystem information _after_ the bootmap was loaded */
     38    write_subsystem_identification();
     39    write_iplb_location();
     40
     41    /* prevent unknown IPL types in the guest */
     42    if (iplb.pbt == S390_IPL_TYPE_QEMU_SCSI) {
     43        iplb.pbt = S390_IPL_TYPE_CCW;
     44        set_iplb(&iplb);
     45    }
     46
     47    /*
     48     * The IPL PSW is at address 0. We also must not overwrite the
     49     * content of non-BIOS memory after we loaded the guest, so we
     50     * save the original content and restore it in jump_to_IPL_2.
     51     */
     52    if (address) {
     53        save_psw = *reset_psw;
     54        write_reset_psw(RESET_PSW);
     55        ipl_continue = address;
     56    }
     57    debug_print_int("set IPL addr to", address ?: *reset_psw & PSW_MASK_SHORT_ADDR);
     58
     59    /* Ensure the guest output starts fresh */
     60    sclp_print("\n");
     61
     62    /*
     63     * HACK ALERT.
     64     * We use the load normal reset to keep r15 unchanged. jump_to_IPL_2
     65     * can then use r15 as its stack pointer.
     66     */
     67    asm volatile("lghi %%r1,1\n\t"
     68                 "diag %%r1,%%r1,0x308\n\t"
     69                 : : : "1", "memory");
     70    panic("\n! IPL returns !\n");
     71}
     72
     73void jump_to_low_kernel(void)
     74{
     75    /*
     76     * If it looks like a Linux binary, i.e. there is the "S390EP" magic from
     77     * arch/s390/kernel/head.S here, then let's jump to the well-known Linux
     78     * kernel start address (when jumping to the PSW-at-zero address instead,
     79     * the kernel startup code fails when we booted from a network device).
     80     */
     81    if (!memcmp((char *)S390EP, "S390EP", 6)) {
     82        jump_to_IPL_code(KERN_IMAGE_START);
     83    }
     84
     85    /* Trying to get PSW at zero address (pointed to by reset_psw) */
     86    if (*reset_psw & RESET_PSW_MASK) {
     87        /*
     88         * Surely nobody will try running directly from lowcore, so
     89         * let's use 0 as an indication that we want to load the reset
     90         * psw at 0x0 and not jump to the entry.
     91         */
     92        jump_to_IPL_code(0);
     93    }
     94
     95    /* No other option left, so use the Linux kernel start address */
     96    jump_to_IPL_code(KERN_IMAGE_START);
     97}