]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/blob - sys/arm/arm/elf_trampoline.c
Fix bhyve privilege escalation via VMCS access.
[FreeBSD/FreeBSD.git] / sys / arm / arm / elf_trampoline.c
1 /*-
2  * Copyright (c) 2005 Olivier Houchard.  All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  * 1. Redistributions of source code must retain the above copyright
8  *    notice, this list of conditions and the following disclaimer.
9  * 2. Redistributions in binary form must reproduce the above copyright
10  *    notice, this list of conditions and the following disclaimer in the
11  *    documentation and/or other materials provided with the distribution.
12  *
13  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23  */
24
25 /*
26  * Since we are compiled outside of the normal kernel build process, we
27  * need to include opt_global.h manually.
28  */
29 #include "opt_global.h"
30 #include "opt_kernname.h"
31
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34 #include <machine/asm.h>
35 #include <sys/param.h>
36 #include <sys/elf32.h>
37 #include <sys/inflate.h>
38 #include <machine/elf.h>
39 #include <machine/pte-v4.h>
40 #include <machine/cpufunc.h>
41 #include <machine/armreg.h>
42 #include <machine/vmparam.h>    /* For KERNVIRTADDR */
43 #include <machine/cpu.h>
44
45 extern char kernel_start[];
46 extern char kernel_end[];
47
48 extern void *_end;
49
50 void _start(void);
51 void __start(void);
52 void __startC(unsigned r0, unsigned r1, unsigned r2, unsigned r3);
53
54 extern unsigned int cpu_ident(void);
55 extern void armv6_idcache_wbinv_all(void);
56 extern void armv7_idcache_wbinv_all(void);
57 extern void do_call(void *, void *, void *, int);
58
59 #define GZ_HEAD 0xa
60
61 #if defined(CPU_ARM9)
62 #define cpu_idcache_wbinv_all   arm9_idcache_wbinv_all
63 extern void arm9_idcache_wbinv_all(void);
64 #elif defined(CPU_FA526)
65 #define cpu_idcache_wbinv_all   fa526_idcache_wbinv_all
66 extern void fa526_idcache_wbinv_all(void);
67 #elif defined(CPU_ARM9E)
68 #define cpu_idcache_wbinv_all   armv5_ec_idcache_wbinv_all
69 extern void armv5_ec_idcache_wbinv_all(void);
70 #elif defined(CPU_ARM1176)
71 #define cpu_idcache_wbinv_all   armv6_idcache_wbinv_all
72 #elif defined(CPU_XSCALE_PXA2X0) || defined(CPU_XSCALE_IXP425)
73 #define cpu_idcache_wbinv_all   xscale_cache_purgeID
74 extern void xscale_cache_purgeID(void);
75 #elif defined(CPU_XSCALE_81342)
76 #define cpu_idcache_wbinv_all   xscalec3_cache_purgeID
77 extern void xscalec3_cache_purgeID(void);
78 #elif defined(CPU_MV_PJ4B)
79 #if !defined(SOC_MV_ARMADAXP)
80 #define cpu_idcache_wbinv_all   armv6_idcache_wbinv_all
81 extern void armv6_idcache_wbinv_all(void);
82 #else
83 #define cpu_idcache_wbinv_all() armadaxp_idcache_wbinv_all
84 #endif
85 #endif /* CPU_MV_PJ4B */
86 #ifdef CPU_XSCALE_81342
87 #define cpu_l2cache_wbinv_all   xscalec3_l2cache_purge
88 extern void xscalec3_l2cache_purge(void);
89 #elif defined(SOC_MV_KIRKWOOD) || defined(SOC_MV_DISCOVERY)
90 #define cpu_l2cache_wbinv_all   sheeva_l2cache_wbinv_all
91 extern void sheeva_l2cache_wbinv_all(void);
92 #elif defined(CPU_CORTEXA) || defined(CPU_KRAIT)
93 #define cpu_idcache_wbinv_all   armv7_idcache_wbinv_all
94 #define cpu_l2cache_wbinv_all()
95 #else
96 #define cpu_l2cache_wbinv_all()
97 #endif
98
99 static void armadaxp_idcache_wbinv_all(void);
100
101 int     arm_picache_size;
102 int     arm_picache_line_size;
103 int     arm_picache_ways;
104
105 int     arm_pdcache_size;       /* and unified */
106 int     arm_pdcache_line_size = 32;
107 int     arm_pdcache_ways;
108
109 int     arm_pcache_type;
110 int     arm_pcache_unified;
111
112 int     arm_dcache_align;
113 int     arm_dcache_align_mask;
114
115 int     arm_dcache_min_line_size = 32;
116 int     arm_icache_min_line_size = 32;
117 int     arm_idcache_min_line_size = 32;
118
119 u_int   arm_cache_level;
120 u_int   arm_cache_type[14];
121 u_int   arm_cache_loc;
122
123 /* Additional cache information local to this file.  Log2 of some of the
124       above numbers.  */
125 static int      arm_dcache_l2_nsets;
126 static int      arm_dcache_l2_assoc;
127 static int      arm_dcache_l2_linesize;
128
129 /*
130  * Boot parameters
131  */
132 static struct arm_boot_params s_boot_params;
133
134 extern int arm9_dcache_sets_inc;
135 extern int arm9_dcache_sets_max;
136 extern int arm9_dcache_index_max;
137 extern int arm9_dcache_index_inc;
138
139 static __inline void *
140 memcpy(void *dst, const void *src, int len)
141 {
142         const char *s = src;
143         char *d = dst;
144
145         while (len) {
146                 if (0 && len >= 4 && !((vm_offset_t)d & 3) &&
147                     !((vm_offset_t)s & 3)) {
148                         *(uint32_t *)d = *(uint32_t *)s;
149                         s += 4;
150                         d += 4;
151                         len -= 4;
152                 } else {
153                         *d++ = *s++;
154                         len--;
155                 }
156         }
157         return (dst);
158 }
159
160 static __inline void
161 bzero(void *addr, int count)
162 {
163         char *tmp = (char *)addr;
164
165         while (count > 0) {
166                 if (count >= 4 && !((vm_offset_t)tmp & 3)) {
167                         *(uint32_t *)tmp = 0;
168                         tmp += 4;
169                         count -= 4;
170                 } else {
171                         *tmp = 0;
172                         tmp++;
173                         count--;
174                 }
175         }
176 }
177
178 static void arm9_setup(void);
179
180 void
181 _startC(unsigned r0, unsigned r1, unsigned r2, unsigned r3)
182 {
183         int tmp1;
184         unsigned int sp = ((unsigned int)&_end & ~3) + 4;
185         unsigned int pc, kernphysaddr;
186
187         s_boot_params.abp_r0 = r0;
188         s_boot_params.abp_r1 = r1;
189         s_boot_params.abp_r2 = r2;
190         s_boot_params.abp_r3 = r3;
191         
192         /*
193          * Figure out the physical address the kernel was loaded at.  This
194          * assumes the entry point (this code right here) is in the first page,
195          * which will always be the case for this trampoline code.
196          */
197         __asm __volatile("mov %0, pc\n"
198             : "=r" (pc));
199         kernphysaddr = pc & ~PAGE_MASK;
200
201 #if defined(FLASHADDR) && defined(PHYSADDR) && defined(LOADERRAMADDR)
202         if ((FLASHADDR > LOADERRAMADDR && pc >= FLASHADDR) ||
203             (FLASHADDR < LOADERRAMADDR && pc < LOADERRAMADDR)) {
204                 /*
205                  * We're running from flash, so just copy the whole thing
206                  * from flash to memory.
207                  * This is far from optimal, we could do the relocation or
208                  * the unzipping directly from flash to memory to avoid this
209                  * needless copy, but it would require to know the flash
210                  * physical address.
211                  */
212                 unsigned int target_addr;
213                 unsigned int tmp_sp;
214                 uint32_t src_addr = (uint32_t)&_start - PHYSADDR + FLASHADDR
215                     + (pc - FLASHADDR - ((uint32_t)&_startC - PHYSADDR)) & 0xfffff000;
216
217                 target_addr = (unsigned int)&_start - PHYSADDR + LOADERRAMADDR;
218                 tmp_sp = target_addr + 0x100000 +
219                     (unsigned int)&_end - (unsigned int)&_start;
220                 memcpy((char *)target_addr, (char *)src_addr,
221                     (unsigned int)&_end - (unsigned int)&_start);
222                 /* Temporary set the sp and jump to the new location. */
223                 __asm __volatile(
224                     "mov sp, %1\n"
225                     "mov r0, %2\n"
226                     "mov r1, %3\n"
227                     "mov r2, %4\n"
228                     "mov r3, %5\n"
229                     "mov pc, %0\n"
230                     : : "r" (target_addr), "r" (tmp_sp),
231                     "r" (s_boot_params.abp_r0), "r" (s_boot_params.abp_r1),
232                     "r" (s_boot_params.abp_r2), "r" (s_boot_params.abp_r3)
233                     : "r0", "r1", "r2", "r3");
234
235         }
236 #endif
237 #ifdef KZIP
238         sp += KERNSIZE + 0x100;
239         sp &= ~(L1_TABLE_SIZE - 1);
240         sp += 2 * L1_TABLE_SIZE;
241 #endif
242         sp += 1024 * 1024; /* Should be enough for a stack */
243
244         __asm __volatile("adr %0, 2f\n"
245                          "bic %0, %0, #0xff000000\n"
246                          "and %1, %1, #0xff000000\n"
247                          "orr %0, %0, %1\n"
248                          "mrc p15, 0, %1, c1, c0, 0\n" /* CP15_SCTLR(%1)*/
249                          "bic %1, %1, #1\n" /* Disable MMU */
250                          "orr %1, %1, #(4 | 8)\n" /* Add DC enable,
251                                                      WBUF enable */
252                          "orr %1, %1, #0x1000\n" /* Add IC enable */
253                          "orr %1, %1, #(0x800)\n" /* BPRD enable */
254
255                          "mcr p15, 0, %1, c1, c0, 0\n" /* CP15_SCTLR(%1)*/
256                          "nop\n"
257                          "nop\n"
258                          "nop\n"
259                          "mov pc, %0\n"
260                          "2: nop\n"
261                          "mov sp, %2\n"
262                          : "=r" (tmp1), "+r" (kernphysaddr), "+r" (sp));
263 #ifndef KZIP
264 #ifdef CPU_ARM9
265         /* So that idcache_wbinv works; */
266         if ((cpu_ident() & 0x0000f000) == 0x00009000)
267                 arm9_setup();
268 #endif
269 #endif
270         __start();
271 }
272
273 static void
274 get_cachetype_cp15()
275 {
276         u_int ctype, isize, dsize, cpuid;
277         u_int clevel, csize, i, sel;
278         u_int multiplier;
279         u_char type;
280
281         __asm __volatile("mrc p15, 0, %0, c0, c0, 1"
282                 : "=r" (ctype));
283
284         cpuid = cpu_ident();
285         /*
286          * ...and thus spake the ARM ARM:
287          *
288          * If an <opcode2> value corresponding to an unimplemented or
289          * reserved ID register is encountered, the System Control
290          * processor returns the value of the main ID register.
291          */
292         if (ctype == cpuid)
293                 goto out;
294
295         if (CPU_CT_FORMAT(ctype) == CPU_CT_ARMV7) {
296                 /* Resolve minimal cache line sizes */
297                 arm_dcache_min_line_size = 1 << (CPU_CT_DMINLINE(ctype) + 2);
298                 arm_icache_min_line_size = 1 << (CPU_CT_IMINLINE(ctype) + 2);
299                 arm_idcache_min_line_size =
300                     (arm_dcache_min_line_size > arm_icache_min_line_size ?
301                     arm_icache_min_line_size : arm_dcache_min_line_size);
302
303                 __asm __volatile("mrc p15, 1, %0, c0, c0, 1"
304                     : "=r" (clevel));
305                 arm_cache_level = clevel;
306                 arm_cache_loc = CPU_CLIDR_LOC(arm_cache_level) + 1;
307                 i = 0;
308                 while ((type = (clevel & 0x7)) && i < 7) {
309                         if (type == CACHE_DCACHE || type == CACHE_UNI_CACHE ||
310                             type == CACHE_SEP_CACHE) {
311                                 sel = i << 1;
312                                 __asm __volatile("mcr p15, 2, %0, c0, c0, 0"
313                                     : : "r" (sel));
314                                 __asm __volatile("mrc p15, 1, %0, c0, c0, 0"
315                                     : "=r" (csize));
316                                 arm_cache_type[sel] = csize;
317                         }
318                         if (type == CACHE_ICACHE || type == CACHE_SEP_CACHE) {
319                                 sel = (i << 1) | 1;
320                                 __asm __volatile("mcr p15, 2, %0, c0, c0, 0"
321                                     : : "r" (sel));
322                                 __asm __volatile("mrc p15, 1, %0, c0, c0, 0"
323                                     : "=r" (csize));
324                                 arm_cache_type[sel] = csize;
325                         }
326                         i++;
327                         clevel >>= 3;
328                 }
329         } else {
330                 if ((ctype & CPU_CT_S) == 0)
331                         arm_pcache_unified = 1;
332
333                 /*
334                  * If you want to know how this code works, go read the ARM ARM.
335                  */
336
337                 arm_pcache_type = CPU_CT_CTYPE(ctype);
338
339                 if (arm_pcache_unified == 0) {
340                         isize = CPU_CT_ISIZE(ctype);
341                         multiplier = (isize & CPU_CT_xSIZE_M) ? 3 : 2;
342                         arm_picache_line_size = 1U << (CPU_CT_xSIZE_LEN(isize) + 3);
343                         if (CPU_CT_xSIZE_ASSOC(isize) == 0) {
344                                 if (isize & CPU_CT_xSIZE_M)
345                                         arm_picache_line_size = 0; /* not present */
346                                 else
347                                         arm_picache_ways = 1;
348                         } else {
349                                 arm_picache_ways = multiplier <<
350                                     (CPU_CT_xSIZE_ASSOC(isize) - 1);
351                         }
352                         arm_picache_size = multiplier << (CPU_CT_xSIZE_SIZE(isize) + 8);
353                 }
354
355                 dsize = CPU_CT_DSIZE(ctype);
356                 multiplier = (dsize & CPU_CT_xSIZE_M) ? 3 : 2;
357                 arm_pdcache_line_size = 1U << (CPU_CT_xSIZE_LEN(dsize) + 3);
358                 if (CPU_CT_xSIZE_ASSOC(dsize) == 0) {
359                         if (dsize & CPU_CT_xSIZE_M)
360                                 arm_pdcache_line_size = 0; /* not present */
361                         else
362                                 arm_pdcache_ways = 1;
363                 } else {
364                         arm_pdcache_ways = multiplier <<
365                             (CPU_CT_xSIZE_ASSOC(dsize) - 1);
366                 }
367                 arm_pdcache_size = multiplier << (CPU_CT_xSIZE_SIZE(dsize) + 8);
368
369                 arm_dcache_align = arm_pdcache_line_size;
370
371                 arm_dcache_l2_assoc = CPU_CT_xSIZE_ASSOC(dsize) + multiplier - 2;
372                 arm_dcache_l2_linesize = CPU_CT_xSIZE_LEN(dsize) + 3;
373                 arm_dcache_l2_nsets = 6 + CPU_CT_xSIZE_SIZE(dsize) -
374                     CPU_CT_xSIZE_ASSOC(dsize) - CPU_CT_xSIZE_LEN(dsize);
375
376         out:
377                 arm_dcache_align_mask = arm_dcache_align - 1;
378         }
379 }
380
381 static void
382 arm9_setup(void)
383 {
384
385         get_cachetype_cp15();
386         arm9_dcache_sets_inc = 1U << arm_dcache_l2_linesize;
387         arm9_dcache_sets_max = (1U << (arm_dcache_l2_linesize +
388             arm_dcache_l2_nsets)) - arm9_dcache_sets_inc;
389         arm9_dcache_index_inc = 1U << (32 - arm_dcache_l2_assoc);
390         arm9_dcache_index_max = 0U - arm9_dcache_index_inc;
391 }
392
393 static void
394 armadaxp_idcache_wbinv_all(void)
395 {
396         uint32_t feat;
397
398         __asm __volatile("mrc p15, 0, %0, c0, c1, 0" : "=r" (feat));
399         if (feat & ARM_PFR0_THUMBEE_MASK)
400                 armv7_idcache_wbinv_all();
401         else
402                 armv6_idcache_wbinv_all();
403
404 }
405 #ifdef KZIP
406 static  unsigned char *orig_input, *i_input, *i_output;
407
408
409 static u_int memcnt;            /* Memory allocated: blocks */
410 static size_t memtot;           /* Memory allocated: bytes */
411 /*
412  * Library functions required by inflate().
413  */
414
415 #define MEMSIZ 0x8000
416
417 /*
418  * Allocate memory block.
419  */
420 unsigned char *
421 kzipmalloc(int size)
422 {
423         void *ptr;
424         static u_char mem[MEMSIZ];
425
426         if (memtot + size > MEMSIZ)
427                 return NULL;
428         ptr = mem + memtot;
429         memtot += size;
430         memcnt++;
431         return ptr;
432 }
433
434 /*
435  * Free allocated memory block.
436  */
437 void
438 kzipfree(void *ptr)
439 {
440         memcnt--;
441         if (!memcnt)
442                 memtot = 0;
443 }
444
445 void
446 putstr(char *dummy)
447 {
448 }
449
450 static int
451 input(void *dummy)
452 {
453         if ((size_t)(i_input - orig_input) >= KERNCOMPSIZE) {
454                 return (GZ_EOF);
455         }
456         return *i_input++;
457 }
458
459 static int
460 output(void *dummy, unsigned char *ptr, unsigned long len)
461 {
462
463
464         memcpy(i_output, ptr, len);
465         i_output += len;
466         return (0);
467 }
468
469 static void *
470 inflate_kernel(void *kernel, void *startaddr)
471 {
472         struct inflate infl;
473         unsigned char slide[GZ_WSIZE];
474
475         orig_input = kernel;
476         memcnt = memtot = 0;
477         i_input = (unsigned char *)kernel + GZ_HEAD;
478         if (((char *)kernel)[3] & 0x18) {
479                 while (*i_input)
480                         i_input++;
481                 i_input++;
482         }
483         i_output = startaddr;
484         bzero(&infl, sizeof(infl));
485         infl.gz_input = input;
486         infl.gz_output = output;
487         infl.gz_slide = slide;
488         inflate(&infl);
489         return ((char *)(((vm_offset_t)i_output & ~3) + 4));
490 }
491
492 #endif
493
494 void *
495 load_kernel(unsigned int kstart, unsigned int curaddr,unsigned int func_end,
496     int d)
497 {
498         Elf32_Ehdr *eh;
499         Elf32_Phdr phdr[64] /* XXX */, *php;
500         Elf32_Shdr shdr[64] /* XXX */;
501         int i,j;
502         void *entry_point;
503         int symtabindex = -1;
504         int symstrindex = -1;
505         vm_offset_t lastaddr = 0;
506         Elf_Addr ssym = 0;
507         Elf_Dyn *dp;
508         struct arm_boot_params local_boot_params;
509
510         eh = (Elf32_Ehdr *)kstart;
511         ssym = 0;
512         entry_point = (void*)eh->e_entry;
513         memcpy(phdr, (void *)(kstart + eh->e_phoff ),
514             eh->e_phnum * sizeof(phdr[0]));
515
516         /* Determine lastaddr. */
517         for (i = 0; i < eh->e_phnum; i++) {
518                 if (lastaddr < (phdr[i].p_vaddr - KERNVIRTADDR + curaddr
519                     + phdr[i].p_memsz))
520                         lastaddr = phdr[i].p_vaddr - KERNVIRTADDR +
521                             curaddr + phdr[i].p_memsz;
522         }
523
524         /* Save the symbol tables, as there're about to be scratched. */
525         memcpy(shdr, (void *)(kstart + eh->e_shoff),
526             sizeof(*shdr) * eh->e_shnum);
527         if (eh->e_shnum * eh->e_shentsize != 0 &&
528             eh->e_shoff != 0) {
529                 for (i = 0; i < eh->e_shnum; i++) {
530                         if (shdr[i].sh_type == SHT_SYMTAB) {
531                                 for (j = 0; j < eh->e_phnum; j++) {
532                                         if (phdr[j].p_type == PT_LOAD &&
533                                             shdr[i].sh_offset >=
534                                             phdr[j].p_offset &&
535                                             (shdr[i].sh_offset +
536                                              shdr[i].sh_size <=
537                                              phdr[j].p_offset +
538                                              phdr[j].p_filesz)) {
539                                                 shdr[i].sh_offset = 0;
540                                                 shdr[i].sh_size = 0;
541                                                 j = eh->e_phnum;
542                                         }
543                                 }
544                                 if (shdr[i].sh_offset != 0 &&
545                                     shdr[i].sh_size != 0) {
546                                         symtabindex = i;
547                                         symstrindex = shdr[i].sh_link;
548                                 }
549                         }
550                 }
551                 func_end = roundup(func_end, sizeof(long));
552                 if (symtabindex >= 0 && symstrindex >= 0) {
553                         ssym = lastaddr;
554                         if (d) {
555                                 memcpy((void *)func_end, (void *)(
556                                     shdr[symtabindex].sh_offset + kstart),
557                                     shdr[symtabindex].sh_size);
558                                 memcpy((void *)(func_end +
559                                     shdr[symtabindex].sh_size),
560                                     (void *)(shdr[symstrindex].sh_offset +
561                                     kstart), shdr[symstrindex].sh_size);
562                         } else {
563                                 lastaddr += shdr[symtabindex].sh_size;
564                                 lastaddr = roundup(lastaddr,
565                                     sizeof(shdr[symtabindex].sh_size));
566                                 lastaddr += sizeof(shdr[symstrindex].sh_size);
567                                 lastaddr += shdr[symstrindex].sh_size;
568                                 lastaddr = roundup(lastaddr,
569                                     sizeof(shdr[symstrindex].sh_size));
570                         }
571
572                 }
573         }
574         if (!d)
575                 return ((void *)lastaddr);
576
577         /*
578          * Now the stack is fixed, copy boot params
579          * before it's overrided
580          */
581         memcpy(&local_boot_params, &s_boot_params, sizeof(local_boot_params));
582
583         j = eh->e_phnum;
584         for (i = 0; i < j; i++) {
585                 volatile char c;
586
587                 if (phdr[i].p_type != PT_LOAD)
588                         continue;
589                 memcpy((void *)(phdr[i].p_vaddr - KERNVIRTADDR + curaddr),
590                     (void*)(kstart + phdr[i].p_offset), phdr[i].p_filesz);
591                 /* Clean space from oversized segments, eg: bss. */
592                 if (phdr[i].p_filesz < phdr[i].p_memsz)
593                         bzero((void *)(phdr[i].p_vaddr - KERNVIRTADDR +
594                             curaddr + phdr[i].p_filesz), phdr[i].p_memsz -
595                             phdr[i].p_filesz);
596         }
597         /* Now grab the symbol tables. */
598         if (symtabindex >= 0 && symstrindex >= 0) {
599                 *(Elf_Size *)lastaddr =
600                     shdr[symtabindex].sh_size;
601                 lastaddr += sizeof(shdr[symtabindex].sh_size);
602                 memcpy((void*)lastaddr,
603                     (void *)func_end,
604                     shdr[symtabindex].sh_size);
605                 lastaddr += shdr[symtabindex].sh_size;
606                 lastaddr = roundup(lastaddr,
607                     sizeof(shdr[symtabindex].sh_size));
608                 *(Elf_Size *)lastaddr =
609                     shdr[symstrindex].sh_size;
610                 lastaddr += sizeof(shdr[symstrindex].sh_size);
611                 memcpy((void*)lastaddr,
612                     (void*)(func_end +
613                             shdr[symtabindex].sh_size),
614                     shdr[symstrindex].sh_size);
615                 lastaddr += shdr[symstrindex].sh_size;
616                 lastaddr = roundup(lastaddr,
617                     sizeof(shdr[symstrindex].sh_size));
618                 *(Elf_Addr *)curaddr = MAGIC_TRAMP_NUMBER;
619                 *((Elf_Addr *)curaddr + 1) = ssym - curaddr + KERNVIRTADDR;
620                 *((Elf_Addr *)curaddr + 2) = lastaddr - curaddr + KERNVIRTADDR;
621         } else
622                 *(Elf_Addr *)curaddr = 0;
623         /* Invalidate the instruction cache. */
624         __asm __volatile("mcr p15, 0, %0, c7, c5, 0\n"
625                          "mcr p15, 0, %0, c7, c10, 4\n"
626                          : : "r" (curaddr));
627         __asm __volatile("mrc p15, 0, %0, c1, c0, 0\n" /* CP15_SCTLR(%0)*/
628             "bic %0, %0, #1\n" /* MMU_ENABLE */
629             "mcr p15, 0, %0, c1, c0, 0\n" /* CP15_SCTLR(%0)*/
630             : "=r" (ssym));
631         /* Jump to the entry point. */
632         ((void(*)(unsigned, unsigned, unsigned, unsigned))
633         (entry_point - KERNVIRTADDR + curaddr))
634         (local_boot_params.abp_r0, local_boot_params.abp_r1,
635         local_boot_params.abp_r2, local_boot_params.abp_r3);
636         __asm __volatile(".globl func_end\n"
637             "func_end:");
638
639         /* NOTREACHED */
640         return NULL;
641 }
642
643 extern char func_end[];
644
645
646 #define PMAP_DOMAIN_KERNEL      0 /*
647                                     * Just define it instead of including the
648                                     * whole VM headers set.
649                                     */
650 int __hack;
651 static __inline void
652 setup_pagetables(unsigned int pt_addr, vm_paddr_t physstart, vm_paddr_t physend,
653     int write_back)
654 {
655         unsigned int *pd = (unsigned int *)pt_addr;
656         vm_paddr_t addr;
657         int domain = (DOMAIN_CLIENT << (PMAP_DOMAIN_KERNEL * 2)) | DOMAIN_CLIENT;
658         int tmp;
659
660         bzero(pd, L1_TABLE_SIZE);
661         for (addr = physstart; addr < physend; addr += L1_S_SIZE) {
662                 pd[addr >> L1_S_SHIFT] = L1_TYPE_S|L1_S_C|L1_S_AP(AP_KRW)|
663                     L1_S_DOM(PMAP_DOMAIN_KERNEL) | addr;
664                 if (write_back && 0)
665                         pd[addr >> L1_S_SHIFT] |= L1_S_B;
666         }
667         /* XXX: See below */
668         if (0xfff00000 < physstart || 0xfff00000 > physend)
669                 pd[0xfff00000 >> L1_S_SHIFT] = L1_TYPE_S|L1_S_AP(AP_KRW)|
670                     L1_S_DOM(PMAP_DOMAIN_KERNEL)|physstart;
671         __asm __volatile("mcr p15, 0, %1, c2, c0, 0\n" /* set TTB */
672                          "mcr p15, 0, %1, c8, c7, 0\n" /* Flush TTB */
673                          "mcr p15, 0, %2, c3, c0, 0\n" /* Set DAR */
674                          "mrc p15, 0, %0, c1, c0, 0\n" /* CP15_SCTLR(%0)*/
675                          "orr %0, %0, #1\n" /* MMU_ENABLE */
676                          "mcr p15, 0, %0, c1, c0, 0\n" /* CP15_SCTLR(%0)*/
677                          "mrc p15, 0, %0, c2, c0, 0\n" /* CPWAIT */
678                          "mov r0, r0\n"
679                          "sub pc, pc, #4\n" :
680                          "=r" (tmp) : "r" (pd), "r" (domain));
681
682         /*
683          * XXX: This is the most stupid workaround I've ever wrote.
684          * For some reason, the KB9202 won't boot the kernel unless
685          * we access an address which is not in the
686          * 0x20000000 - 0x20ffffff range. I hope I'll understand
687          * what's going on later.
688          */
689         __hack = *(volatile int *)0xfffff21c;
690 }
691
692 void
693 __start(void)
694 {
695         void *curaddr;
696         void *dst, *altdst;
697         char *kernel = (char *)&kernel_start;
698         int sp;
699         int pt_addr;
700
701         __asm __volatile("mov %0, pc"  :
702             "=r" (curaddr));
703         curaddr = (void*)((unsigned int)curaddr & 0xfff00000);
704 #ifdef KZIP
705         if (*kernel == 0x1f && kernel[1] == 0x8b) {
706                 pt_addr = L1_TABLE_SIZE +
707                     rounddown2((int)&_end + KERNSIZE + 0x100, L1_TABLE_SIZE);
708
709 #ifdef CPU_ARM9
710                 /* So that idcache_wbinv works; */
711                 if ((cpu_ident() & 0x0000f000) == 0x00009000)
712                         arm9_setup();
713 #endif
714                 setup_pagetables(pt_addr, (vm_paddr_t)curaddr,
715                     (vm_paddr_t)curaddr + 0x10000000, 1);
716                 /* Gzipped kernel */
717                 dst = inflate_kernel(kernel, &_end);
718                 kernel = (char *)&_end;
719                 altdst = 4 + load_kernel((unsigned int)kernel,
720                     (unsigned int)curaddr,
721                     (unsigned int)&func_end + 800 , 0);
722                 if (altdst > dst)
723                         dst = altdst;
724
725                 /*
726                  * Disable MMU.  Otherwise, setup_pagetables call below
727                  * might overwrite the L1 table we are currently using.
728                  */
729                 cpu_idcache_wbinv_all();
730                 cpu_l2cache_wbinv_all();
731                 __asm __volatile("mrc p15, 0, %0, c1, c0, 0\n" /* CP15_SCTLR(%0)*/
732                   "bic %0, %0, #1\n" /* MMU_DISABLE */
733                   "mcr p15, 0, %0, c1, c0, 0\n" /* CP15_SCTLR(%0)*/
734                   :"=r" (pt_addr));
735         } else
736 #endif
737                 dst = 4 + load_kernel((unsigned int)&kernel_start,
738             (unsigned int)curaddr,
739             (unsigned int)&func_end, 0);
740         dst = (void *)(((vm_offset_t)dst & ~3));
741         pt_addr = L1_TABLE_SIZE + rounddown2((unsigned int)dst, L1_TABLE_SIZE);
742         setup_pagetables(pt_addr, (vm_paddr_t)curaddr,
743             (vm_paddr_t)curaddr + 0x10000000, 0);
744         sp = pt_addr + L1_TABLE_SIZE + 8192;
745         sp = sp &~3;
746         dst = (void *)(sp + 4);
747         memcpy((void *)dst, (void *)&load_kernel, (unsigned int)&func_end -
748             (unsigned int)&load_kernel + 800);
749         do_call(dst, kernel, dst + (unsigned int)(&func_end) -
750             (unsigned int)(&load_kernel) + 800, sp);
751 }
752
753 /* We need to provide these functions but never call them */
754 void __aeabi_unwind_cpp_pr0(void);
755 void __aeabi_unwind_cpp_pr1(void);
756 void __aeabi_unwind_cpp_pr2(void);
757
758 __strong_reference(__aeabi_unwind_cpp_pr0, __aeabi_unwind_cpp_pr1);
759 __strong_reference(__aeabi_unwind_cpp_pr0, __aeabi_unwind_cpp_pr2);
760 void
761 __aeabi_unwind_cpp_pr0(void)
762 {
763 }