1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/string.h> 3 #include <linux/elf.h> 4 #include <asm/page-states.h> 5 #include <asm/boot_data.h> 6 #include <asm/extmem.h> 7 #include <asm/sections.h> 8 #include <asm/maccess.h> 9 #include <asm/cpu_mf.h> 10 #include <asm/setup.h> 11 #include <asm/kasan.h> 12 #include <asm/kexec.h> 13 #include <asm/sclp.h> 14 #include <asm/diag.h> 15 #include <asm/uv.h> 16 #include <asm/abs_lowcore.h> 17 #include <asm/physmem_info.h> 18 #include "decompressor.h" 19 #include "boot.h" 20 #include "uv.h" 21 22 struct vm_layout __bootdata_preserved(vm_layout); 23 unsigned long __bootdata_preserved(__abs_lowcore); 24 unsigned long __bootdata_preserved(__memcpy_real_area); 25 pte_t *__bootdata_preserved(memcpy_real_ptep); 26 unsigned long __bootdata_preserved(VMALLOC_START); 27 unsigned long __bootdata_preserved(VMALLOC_END); 28 struct page *__bootdata_preserved(vmemmap); 29 unsigned long __bootdata_preserved(vmemmap_size); 30 unsigned long __bootdata_preserved(MODULES_VADDR); 31 unsigned long __bootdata_preserved(MODULES_END); 32 unsigned long __bootdata_preserved(max_mappable); 33 unsigned long __bootdata_preserved(page_noexec_mask); 34 unsigned long __bootdata_preserved(segment_noexec_mask); 35 unsigned long __bootdata_preserved(region_noexec_mask); 36 int __bootdata_preserved(relocate_lowcore); 37 38 u64 __bootdata_preserved(stfle_fac_list[16]); 39 struct oldmem_data __bootdata_preserved(oldmem_data); 40 41 struct machine_info machine; 42 43 void error(char *x) 44 { 45 boot_printk("\n\n%s\n\n -- System halted", x); 46 disabled_wait(); 47 } 48 49 static void detect_facilities(void) 50 { 51 if (test_facility(8)) { 52 machine.has_edat1 = 1; 53 local_ctl_set_bit(0, CR0_EDAT_BIT); 54 } 55 if (test_facility(78)) 56 machine.has_edat2 = 1; 57 page_noexec_mask = -1UL; 58 segment_noexec_mask = -1UL; 59 region_noexec_mask = -1UL; 60 if (!test_facility(130)) { 61 page_noexec_mask &= ~_PAGE_NOEXEC; 62 segment_noexec_mask &= ~_SEGMENT_ENTRY_NOEXEC; 63 region_noexec_mask &= ~_REGION_ENTRY_NOEXEC; 64 } 65 } 66 67 static int cmma_test_essa(void) 68 { 69 unsigned long reg1, reg2, tmp = 0; 70 int rc = 1; 71 psw_t old; 72 73 /* Test ESSA_GET_STATE */ 74 asm volatile( 75 " mvc 0(16,%[psw_old]),0(%[psw_pgm])\n" 76 " epsw %[reg1],%[reg2]\n" 77 " st %[reg1],0(%[psw_pgm])\n" 78 " st %[reg2],4(%[psw_pgm])\n" 79 " larl %[reg1],1f\n" 80 " stg %[reg1],8(%[psw_pgm])\n" 81 " .insn rrf,0xb9ab0000,%[tmp],%[tmp],%[cmd],0\n" 82 " la %[rc],0\n" 83 "1: mvc 0(16,%[psw_pgm]),0(%[psw_old])\n" 84 : [reg1] "=&d" (reg1), 85 [reg2] "=&a" (reg2), 86 [rc] "+&d" (rc), 87 [tmp] "=&d" (tmp), 88 "+Q" (get_lowcore()->program_new_psw), 89 "=Q" (old) 90 : [psw_old] "a" (&old), 91 [psw_pgm] "a" (&get_lowcore()->program_new_psw), 92 [cmd] "i" (ESSA_GET_STATE) 93 : "cc", "memory"); 94 return rc; 95 } 96 97 static void cmma_init(void) 98 { 99 if (!cmma_flag) 100 return; 101 if (cmma_test_essa()) { 102 cmma_flag = 0; 103 return; 104 } 105 if (test_facility(147)) 106 cmma_flag = 2; 107 } 108 109 static void setup_lpp(void) 110 { 111 get_lowcore()->current_pid = 0; 112 get_lowcore()->lpp = LPP_MAGIC; 113 if (test_facility(40)) 114 lpp(&get_lowcore()->lpp); 115 } 116 117 #ifdef CONFIG_KERNEL_UNCOMPRESSED 118 static unsigned long mem_safe_offset(void) 119 { 120 return (unsigned long)_compressed_start; 121 } 122 123 static void deploy_kernel(void *output) 124 { 125 void *uncompressed_start = (void *)_compressed_start; 126 127 if (output == uncompressed_start) 128 return; 129 memmove(output, uncompressed_start, vmlinux.image_size); 130 memset(uncompressed_start, 0, vmlinux.image_size); 131 } 132 #endif 133 134 static void rescue_initrd(unsigned long min, unsigned long max) 135 { 136 unsigned long old_addr, addr, size; 137 138 if (!IS_ENABLED(CONFIG_BLK_DEV_INITRD)) 139 return; 140 if (!get_physmem_reserved(RR_INITRD, &addr, &size)) 141 return; 142 if (addr >= min && addr + size <= max) 143 return; 144 old_addr = addr; 145 physmem_free(RR_INITRD); 146 addr = physmem_alloc_top_down(RR_INITRD, size, 0); 147 memmove((void *)addr, (void *)old_addr, size); 148 } 149 150 static void copy_bootdata(void) 151 { 152 if (__boot_data_end - __boot_data_start != vmlinux.bootdata_size) 153 error(".boot.data section size mismatch"); 154 memcpy((void *)vmlinux.bootdata_off, __boot_data_start, vmlinux.bootdata_size); 155 if (__boot_data_preserved_end - __boot_data_preserved_start != vmlinux.bootdata_preserved_size) 156 error(".boot.preserved.data section size mismatch"); 157 memcpy((void *)vmlinux.bootdata_preserved_off, __boot_data_preserved_start, vmlinux.bootdata_preserved_size); 158 } 159 160 static void kaslr_adjust_relocs(unsigned long min_addr, unsigned long max_addr, 161 unsigned long offset, unsigned long phys_offset) 162 { 163 int *reloc; 164 long loc; 165 166 /* Adjust R_390_64 relocations */ 167 for (reloc = (int *)__vmlinux_relocs_64_start; reloc < (int *)__vmlinux_relocs_64_end; reloc++) { 168 loc = (long)*reloc + phys_offset; 169 if (loc < min_addr || loc > max_addr) 170 error("64-bit relocation outside of kernel!\n"); 171 *(u64 *)loc += offset; 172 } 173 } 174 175 static void kaslr_adjust_got(unsigned long offset) 176 { 177 u64 *entry; 178 179 /* 180 * Adjust GOT entries, except for ones for undefined weak symbols 181 * that resolved to zero. This also skips the first three reserved 182 * entries on s390x that are zero. 183 */ 184 for (entry = (u64 *)vmlinux.got_start; entry < (u64 *)vmlinux.got_end; entry++) { 185 if (*entry) 186 *entry += offset; 187 } 188 } 189 190 /* 191 * Merge information from several sources into a single ident_map_size value. 192 * "ident_map_size" represents the upper limit of physical memory we may ever 193 * reach. It might not be all online memory, but also include standby (offline) 194 * memory or memory areas reserved for other means (e.g., memory devices such as 195 * virtio-mem). 196 * 197 * "ident_map_size" could be lower then actual standby/reserved or even online 198 * memory present, due to limiting factors. We should never go above this limit. 199 * It is the size of our identity mapping. 200 * 201 * Consider the following factors: 202 * 1. max_physmem_end - end of physical memory online, standby or reserved. 203 * Always >= end of the last online memory range (get_physmem_online_end()). 204 * 2. CONFIG_MAX_PHYSMEM_BITS - the maximum size of physical memory the 205 * kernel is able to support. 206 * 3. "mem=" kernel command line option which limits physical memory usage. 207 * 4. OLDMEM_BASE which is a kdump memory limit when the kernel is executed as 208 * crash kernel. 209 * 5. "hsa" size which is a memory limit when the kernel is executed during 210 * zfcp/nvme dump. 211 */ 212 static void setup_ident_map_size(unsigned long max_physmem_end) 213 { 214 unsigned long hsa_size; 215 216 ident_map_size = max_physmem_end; 217 if (memory_limit) 218 ident_map_size = min(ident_map_size, memory_limit); 219 ident_map_size = min(ident_map_size, 1UL << MAX_PHYSMEM_BITS); 220 221 #ifdef CONFIG_CRASH_DUMP 222 if (oldmem_data.start) { 223 __kaslr_enabled = 0; 224 ident_map_size = min(ident_map_size, oldmem_data.size); 225 } else if (ipl_block_valid && is_ipl_block_dump()) { 226 __kaslr_enabled = 0; 227 if (!sclp_early_get_hsa_size(&hsa_size) && hsa_size) 228 ident_map_size = min(ident_map_size, hsa_size); 229 } 230 #endif 231 } 232 233 #define FIXMAP_SIZE round_up(MEMCPY_REAL_SIZE + ABS_LOWCORE_MAP_SIZE, sizeof(struct lowcore)) 234 235 static unsigned long get_vmem_size(unsigned long identity_size, 236 unsigned long vmemmap_size, 237 unsigned long vmalloc_size, 238 unsigned long rte_size) 239 { 240 unsigned long max_mappable, vsize; 241 242 max_mappable = max(identity_size, MAX_DCSS_ADDR); 243 vsize = round_up(SZ_2G + max_mappable, rte_size) + 244 round_up(vmemmap_size, rte_size) + 245 FIXMAP_SIZE + MODULES_LEN + KASLR_LEN; 246 if (IS_ENABLED(CONFIG_KMSAN)) 247 vsize += MODULES_LEN * 2; 248 return size_add(vsize, vmalloc_size); 249 } 250 251 static unsigned long setup_kernel_memory_layout(unsigned long kernel_size) 252 { 253 unsigned long vmemmap_start; 254 unsigned long kernel_start; 255 unsigned long asce_limit; 256 unsigned long rte_size; 257 unsigned long pages; 258 unsigned long vsize; 259 unsigned long vmax; 260 261 pages = ident_map_size / PAGE_SIZE; 262 /* vmemmap contains a multiple of PAGES_PER_SECTION struct pages */ 263 vmemmap_size = SECTION_ALIGN_UP(pages) * sizeof(struct page); 264 265 /* choose kernel address space layout: 4 or 3 levels. */ 266 BUILD_BUG_ON(!IS_ALIGNED(TEXT_OFFSET, THREAD_SIZE)); 267 BUILD_BUG_ON(!IS_ALIGNED(__NO_KASLR_START_KERNEL, THREAD_SIZE)); 268 BUILD_BUG_ON(__NO_KASLR_END_KERNEL > _REGION1_SIZE); 269 vsize = get_vmem_size(ident_map_size, vmemmap_size, vmalloc_size, _REGION3_SIZE); 270 if (IS_ENABLED(CONFIG_KASAN) || __NO_KASLR_END_KERNEL > _REGION2_SIZE || 271 (vsize > _REGION2_SIZE && kaslr_enabled())) { 272 asce_limit = _REGION1_SIZE; 273 if (__NO_KASLR_END_KERNEL > _REGION2_SIZE) { 274 rte_size = _REGION2_SIZE; 275 vsize = get_vmem_size(ident_map_size, vmemmap_size, vmalloc_size, _REGION2_SIZE); 276 } else { 277 rte_size = _REGION3_SIZE; 278 } 279 } else { 280 asce_limit = _REGION2_SIZE; 281 rte_size = _REGION3_SIZE; 282 } 283 284 /* 285 * Forcing modules and vmalloc area under the ultravisor 286 * secure storage limit, so that any vmalloc allocation 287 * we do could be used to back secure guest storage. 288 * 289 * Assume the secure storage limit always exceeds _REGION2_SIZE, 290 * otherwise asce_limit and rte_size would have been adjusted. 291 */ 292 vmax = adjust_to_uv_max(asce_limit); 293 #ifdef CONFIG_KASAN 294 BUILD_BUG_ON(__NO_KASLR_END_KERNEL > KASAN_SHADOW_START); 295 /* force vmalloc and modules below kasan shadow */ 296 vmax = min(vmax, KASAN_SHADOW_START); 297 #endif 298 vsize = min(vsize, vmax); 299 if (kaslr_enabled()) { 300 unsigned long kernel_end, kaslr_len, slots, pos; 301 302 kaslr_len = max(KASLR_LEN, vmax - vsize); 303 slots = DIV_ROUND_UP(kaslr_len - kernel_size, THREAD_SIZE); 304 if (get_random(slots, &pos)) 305 pos = 0; 306 kernel_end = vmax - pos * THREAD_SIZE; 307 kernel_start = round_down(kernel_end - kernel_size, THREAD_SIZE); 308 } else if (vmax < __NO_KASLR_END_KERNEL || vsize > __NO_KASLR_END_KERNEL) { 309 kernel_start = round_down(vmax - kernel_size, THREAD_SIZE); 310 boot_printk("The kernel base address is forced to %lx\n", kernel_start); 311 } else { 312 kernel_start = __NO_KASLR_START_KERNEL; 313 } 314 __kaslr_offset = kernel_start; 315 316 MODULES_END = round_down(kernel_start, _SEGMENT_SIZE); 317 MODULES_VADDR = MODULES_END - MODULES_LEN; 318 VMALLOC_END = MODULES_VADDR; 319 if (IS_ENABLED(CONFIG_KMSAN)) 320 VMALLOC_END -= MODULES_LEN * 2; 321 322 /* allow vmalloc area to occupy up to about 1/2 of the rest virtual space left */ 323 vsize = (VMALLOC_END - FIXMAP_SIZE) / 2; 324 vsize = round_down(vsize, _SEGMENT_SIZE); 325 vmalloc_size = min(vmalloc_size, vsize); 326 if (IS_ENABLED(CONFIG_KMSAN)) { 327 /* take 2/3 of vmalloc area for KMSAN shadow and origins */ 328 vmalloc_size = round_down(vmalloc_size / 3, _SEGMENT_SIZE); 329 VMALLOC_END -= vmalloc_size * 2; 330 } 331 VMALLOC_START = VMALLOC_END - vmalloc_size; 332 333 __memcpy_real_area = round_down(VMALLOC_START - MEMCPY_REAL_SIZE, PAGE_SIZE); 334 __abs_lowcore = round_down(__memcpy_real_area - ABS_LOWCORE_MAP_SIZE, 335 sizeof(struct lowcore)); 336 337 /* split remaining virtual space between 1:1 mapping & vmemmap array */ 338 pages = __abs_lowcore / (PAGE_SIZE + sizeof(struct page)); 339 pages = SECTION_ALIGN_UP(pages); 340 /* keep vmemmap_start aligned to a top level region table entry */ 341 vmemmap_start = round_down(__abs_lowcore - pages * sizeof(struct page), rte_size); 342 /* make sure identity map doesn't overlay with vmemmap */ 343 ident_map_size = min(ident_map_size, vmemmap_start); 344 vmemmap_size = SECTION_ALIGN_UP(ident_map_size / PAGE_SIZE) * sizeof(struct page); 345 /* make sure vmemmap doesn't overlay with absolute lowcore area */ 346 if (vmemmap_start + vmemmap_size > __abs_lowcore) { 347 vmemmap_size = SECTION_ALIGN_DOWN(ident_map_size / PAGE_SIZE) * sizeof(struct page); 348 ident_map_size = vmemmap_size / sizeof(struct page) * PAGE_SIZE; 349 } 350 vmemmap = (struct page *)vmemmap_start; 351 /* maximum address for which linear mapping could be created (DCSS, memory) */ 352 BUILD_BUG_ON(MAX_DCSS_ADDR > (1UL << MAX_PHYSMEM_BITS)); 353 max_mappable = max(ident_map_size, MAX_DCSS_ADDR); 354 max_mappable = min(max_mappable, vmemmap_start); 355 if (IS_ENABLED(CONFIG_RANDOMIZE_IDENTITY_BASE)) 356 __identity_base = round_down(vmemmap_start - max_mappable, rte_size); 357 358 return asce_limit; 359 } 360 361 /* 362 * This function clears the BSS section of the decompressed Linux kernel and NOT the decompressor's. 363 */ 364 static void clear_bss_section(unsigned long kernel_start) 365 { 366 memset((void *)kernel_start + vmlinux.image_size, 0, vmlinux.bss_size); 367 } 368 369 /* 370 * Set vmalloc area size to an 8th of (potential) physical memory 371 * size, unless size has been set by kernel command line parameter. 372 */ 373 static void setup_vmalloc_size(void) 374 { 375 unsigned long size; 376 377 if (vmalloc_size_set) 378 return; 379 size = round_up(ident_map_size / 8, _SEGMENT_SIZE); 380 vmalloc_size = max(size, vmalloc_size); 381 } 382 383 static void kaslr_adjust_vmlinux_info(long offset) 384 { 385 vmlinux.bootdata_off += offset; 386 vmlinux.bootdata_preserved_off += offset; 387 vmlinux.got_start += offset; 388 vmlinux.got_end += offset; 389 vmlinux.init_mm_off += offset; 390 vmlinux.swapper_pg_dir_off += offset; 391 vmlinux.invalid_pg_dir_off += offset; 392 vmlinux.alt_instructions += offset; 393 vmlinux.alt_instructions_end += offset; 394 #ifdef CONFIG_KASAN 395 vmlinux.kasan_early_shadow_page_off += offset; 396 vmlinux.kasan_early_shadow_pte_off += offset; 397 vmlinux.kasan_early_shadow_pmd_off += offset; 398 vmlinux.kasan_early_shadow_pud_off += offset; 399 vmlinux.kasan_early_shadow_p4d_off += offset; 400 #endif 401 } 402 403 void startup_kernel(void) 404 { 405 unsigned long vmlinux_size = vmlinux.image_size + vmlinux.bss_size; 406 unsigned long nokaslr_text_lma, text_lma = 0, amode31_lma = 0; 407 unsigned long kernel_size = TEXT_OFFSET + vmlinux_size; 408 unsigned long kaslr_large_page_offset; 409 unsigned long max_physmem_end; 410 unsigned long asce_limit; 411 unsigned long safe_addr; 412 psw_t psw; 413 414 setup_lpp(); 415 416 /* 417 * Non-randomized kernel physical start address must be _SEGMENT_SIZE 418 * aligned (see blow). 419 */ 420 nokaslr_text_lma = ALIGN(mem_safe_offset(), _SEGMENT_SIZE); 421 safe_addr = PAGE_ALIGN(nokaslr_text_lma + vmlinux_size); 422 423 /* 424 * Reserve decompressor memory together with decompression heap, 425 * buffer and memory which might be occupied by uncompressed kernel 426 * (if KASLR is off or failed). 427 */ 428 physmem_reserve(RR_DECOMPRESSOR, 0, safe_addr); 429 if (IS_ENABLED(CONFIG_BLK_DEV_INITRD) && parmarea.initrd_size) 430 physmem_reserve(RR_INITRD, parmarea.initrd_start, parmarea.initrd_size); 431 oldmem_data.start = parmarea.oldmem_base; 432 oldmem_data.size = parmarea.oldmem_size; 433 434 store_ipl_parmblock(); 435 read_ipl_report(); 436 uv_query_info(); 437 sclp_early_read_info(); 438 setup_boot_command_line(); 439 parse_boot_command_line(); 440 detect_facilities(); 441 cmma_init(); 442 sanitize_prot_virt_host(); 443 max_physmem_end = detect_max_physmem_end(); 444 setup_ident_map_size(max_physmem_end); 445 setup_vmalloc_size(); 446 asce_limit = setup_kernel_memory_layout(kernel_size); 447 /* got final ident_map_size, physmem allocations could be performed now */ 448 physmem_set_usable_limit(ident_map_size); 449 detect_physmem_online_ranges(max_physmem_end); 450 save_ipl_cert_comp_list(); 451 rescue_initrd(safe_addr, ident_map_size); 452 453 /* 454 * __kaslr_offset_phys must be _SEGMENT_SIZE aligned, so the lower 455 * 20 bits (the offset within a large page) are zero. Copy the last 456 * 20 bits of __kaslr_offset, which is THREAD_SIZE aligned, to 457 * __kaslr_offset_phys. 458 * 459 * With this the last 20 bits of __kaslr_offset_phys and __kaslr_offset 460 * are identical, which is required to allow for large mappings of the 461 * kernel image. 462 */ 463 kaslr_large_page_offset = __kaslr_offset & ~_SEGMENT_MASK; 464 if (kaslr_enabled()) { 465 unsigned long size = vmlinux_size + kaslr_large_page_offset; 466 467 text_lma = randomize_within_range(size, _SEGMENT_SIZE, TEXT_OFFSET, ident_map_size); 468 } 469 if (!text_lma) 470 text_lma = nokaslr_text_lma; 471 text_lma |= kaslr_large_page_offset; 472 473 /* 474 * [__kaslr_offset_phys..__kaslr_offset_phys + TEXT_OFFSET] region is 475 * never accessed via the kernel image mapping as per the linker script: 476 * 477 * . = TEXT_OFFSET; 478 * 479 * Therefore, this region could be used for something else and does 480 * not need to be reserved. See how it is skipped in setup_vmem(). 481 */ 482 __kaslr_offset_phys = text_lma - TEXT_OFFSET; 483 kaslr_adjust_vmlinux_info(__kaslr_offset_phys); 484 physmem_reserve(RR_VMLINUX, text_lma, vmlinux_size); 485 deploy_kernel((void *)text_lma); 486 487 /* vmlinux decompression is done, shrink reserved low memory */ 488 physmem_reserve(RR_DECOMPRESSOR, 0, (unsigned long)_decompressor_end); 489 490 /* 491 * In case KASLR is enabled the randomized location of .amode31 492 * section might overlap with .vmlinux.relocs section. To avoid that 493 * the below randomize_within_range() could have been called with 494 * __vmlinux_relocs_64_end as the lower range address. However, 495 * .amode31 section is written to by the decompressed kernel - at 496 * that time the contents of .vmlinux.relocs is not needed anymore. 497 * Conversely, .vmlinux.relocs is read only by the decompressor, even 498 * before the kernel started. Therefore, in case the two sections 499 * overlap there is no risk of corrupting any data. 500 */ 501 if (kaslr_enabled()) { 502 unsigned long amode31_min; 503 504 amode31_min = (unsigned long)_decompressor_end; 505 amode31_lma = randomize_within_range(vmlinux.amode31_size, PAGE_SIZE, amode31_min, SZ_2G); 506 } 507 if (!amode31_lma) 508 amode31_lma = text_lma - vmlinux.amode31_size; 509 physmem_reserve(RR_AMODE31, amode31_lma, vmlinux.amode31_size); 510 511 /* 512 * The order of the following operations is important: 513 * 514 * - kaslr_adjust_relocs() must follow clear_bss_section() to establish 515 * static memory references to data in .bss to be used by setup_vmem() 516 * (i.e init_mm.pgd) 517 * 518 * - setup_vmem() must follow kaslr_adjust_relocs() to be able using 519 * static memory references to data in .bss (i.e init_mm.pgd) 520 * 521 * - copy_bootdata() must follow setup_vmem() to propagate changes 522 * to bootdata made by setup_vmem() 523 */ 524 clear_bss_section(text_lma); 525 kaslr_adjust_relocs(text_lma, text_lma + vmlinux.image_size, 526 __kaslr_offset, __kaslr_offset_phys); 527 kaslr_adjust_got(__kaslr_offset); 528 setup_vmem(__kaslr_offset, __kaslr_offset + kernel_size, asce_limit); 529 copy_bootdata(); 530 __apply_alternatives((struct alt_instr *)_vmlinux_info.alt_instructions, 531 (struct alt_instr *)_vmlinux_info.alt_instructions_end, 532 ALT_CTX_EARLY); 533 534 /* 535 * Save KASLR offset for early dumps, before vmcore_info is set. 536 * Mark as uneven to distinguish from real vmcore_info pointer. 537 */ 538 get_lowcore()->vmcore_info = __kaslr_offset_phys ? __kaslr_offset_phys | 0x1UL : 0; 539 540 /* 541 * Jump to the decompressed kernel entry point and switch DAT mode on. 542 */ 543 psw.addr = __kaslr_offset + vmlinux.entry; 544 psw.mask = PSW_KERNEL_BITS; 545 __load_psw(psw); 546 } 547