diff options
Diffstat (limited to 'firmware/linuxboot.c')
-rw-r--r-- | firmware/linuxboot.c | 96 |
1 files changed, 96 insertions, 0 deletions
diff --git a/firmware/linuxboot.c b/firmware/linuxboot.c index 5b6ab314b3..aa907ac7bb 100644 --- a/firmware/linuxboot.c +++ b/firmware/linuxboot.c | |||
@@ -216,3 +216,99 @@ ssize_t uimage_fd_reader(void* buf, size_t size, void* ctx) | |||
216 | int fd = (intptr_t)ctx; | 216 | int fd = (intptr_t)ctx; |
217 | return read(fd, buf, size); | 217 | return read(fd, buf, size); |
218 | } | 218 | } |
219 | |||
220 | /* Linux's self-extracting kernels are broken on MIPS. The decompressor stub | ||
221 | * doesn't flush caches after extracting the kernel code which can cause the | ||
222 | * boot to fail horribly. This has been true since at least 2009 and at the | ||
223 | * time of writing (2022) it's *still* broken. | ||
224 | * | ||
225 | * The FiiO M3K and Shanling Q1 both have broken kernels of this type, so we | ||
226 | * work around this by replacing the direct call to the kernel entry point with | ||
227 | * a thunk that adds the necessary cache flush. | ||
228 | */ | ||
229 | uint32_t mips_linux_stub_get_entry(void** code_start, size_t code_size) | ||
230 | { | ||
231 | /* The jump to the kernel entry point looks like this: | ||
232 | * | ||
233 | * move a0, s0 | ||
234 | * move a1, s1 | ||
235 | * move a2, s2 | ||
236 | * move a3, s3 | ||
237 | * ... | ||
238 | * la k0, KERNEL_ENTRY | ||
239 | * jr k0 | ||
240 | * --- or in kernels since 2021: --- | ||
241 | * la t9, KERNEL_ENTRY | ||
242 | * jalr t9 | ||
243 | * | ||
244 | * We're trying to identify this code and decode the kernel entry | ||
245 | * point address, and return a suitable address where we can patch | ||
246 | * in a call to our thunk. | ||
247 | */ | ||
248 | |||
249 | /* We should only need to scan within the first 128 bytes | ||
250 | * but do up to 256 just in case. */ | ||
251 | uint32_t* start = *code_start; | ||
252 | uint32_t* end = start + (MIN(code_size, 256) + 3) / 4; | ||
253 | |||
254 | /* Scan for the "move aN, sN" sequence */ | ||
255 | uint32_t* move_instr = start; | ||
256 | for(move_instr += 4; move_instr < end; ++move_instr) { | ||
257 | if(move_instr[-4] == 0x02002021 && /* move a0, s0 */ | ||
258 | move_instr[-3] == 0x02202821 && /* move a1, s1 */ | ||
259 | move_instr[-2] == 0x02403021 && /* move a2, s2 */ | ||
260 | move_instr[-1] == 0x02603821) /* move a3, s3 */ | ||
261 | break; | ||
262 | } | ||
263 | |||
264 | if(move_instr == end) | ||
265 | return 0; | ||
266 | |||
267 | /* Now search forward for the next jr/jalr instruction */ | ||
268 | int jreg = 0; | ||
269 | uint32_t* jump_instr = move_instr; | ||
270 | for(; jump_instr != end; ++jump_instr) { | ||
271 | if((jump_instr[0] & 0xfc1ff83f) == 0xf809 || | ||
272 | (jump_instr[0] & 0xfc00003f) == 0x8) { | ||
273 | /* jalr rN */ | ||
274 | jreg = (jump_instr[0] >> 21) & 0x1f; | ||
275 | break; | ||
276 | } | ||
277 | } | ||
278 | |||
279 | /* Need room here for 4 instructions. Assume everything between the | ||
280 | * moves and the jump is safe to overwrite; otherwise, we'll need to | ||
281 | * take a different approach. | ||
282 | * | ||
283 | * Count +1 instruction for the branch delay slot and another +1 because | ||
284 | * "move_instr" points to the instruction following the last move. */ | ||
285 | if(jump_instr - move_instr + 2 < 4) | ||
286 | return 0; | ||
287 | if(!jreg) | ||
288 | return 0; | ||
289 | |||
290 | /* Now scan from the end of the move sequence until the jump instruction | ||
291 | * and try to reconstruct the entry address. We check for lui/ori/addiu. */ | ||
292 | const uint32_t lui_mask = 0xffff0000; | ||
293 | const uint32_t lui = 0x3c000000 | (jreg << 16); | ||
294 | const uint32_t ori_mask = 0xffff0000; | ||
295 | const uint32_t ori = 0x34000000 | (jreg << 21) | (jreg << 16); | ||
296 | const uint32_t addiu_mask = 0xffff0000; | ||
297 | const uint32_t addiu = 0x24000000 | (jreg << 21) | (jreg << 16); | ||
298 | |||
299 | /* Can use any initial value here */ | ||
300 | uint32_t jreg_val = 0xdeadbeef; | ||
301 | |||
302 | for(uint32_t* instr = move_instr; instr != jump_instr; ++instr) { | ||
303 | if((instr[0] & lui_mask) == lui) | ||
304 | jreg_val = (instr[0] & 0xffff) << 16; | ||
305 | else if((instr[0] & ori_mask) == ori) | ||
306 | jreg_val |= instr[0] & 0xffff; | ||
307 | else if((instr[0] & addiu_mask) == addiu) | ||
308 | jreg_val += instr[0] & 0xffff; | ||
309 | } | ||
310 | |||
311 | /* Success! Probably! */ | ||
312 | *code_start = move_instr; | ||
313 | return jreg_val; | ||
314 | } | ||