xref: /qemu/hw/arm/boot.c (revision 3e82ddaa8db260a232dbbbf488d8ac7851d124c5)
1 /*
2  * ARM kernel loader.
3  *
4  * Copyright (c) 2006-2007 CodeSourcery.
5  * Written by Paul Brook
6  *
7  * This code is licensed under the GPL.
8  */
9 
10 #include "qemu/osdep.h"
11 #include "qemu/datadir.h"
12 #include "qemu/error-report.h"
13 #include "qapi/error.h"
14 #include <libfdt.h>
15 #include "hw/arm/boot.h"
16 #include "hw/arm/linux-boot-if.h"
17 #include "cpu.h"
18 #include "exec/target_page.h"
19 #include "system/kvm.h"
20 #include "system/tcg.h"
21 #include "system/system.h"
22 #include "system/memory.h"
23 #include "system/numa.h"
24 #include "hw/boards.h"
25 #include "system/reset.h"
26 #include "hw/loader.h"
27 #include "elf.h"
28 #include "system/device_tree.h"
29 #include "qemu/config-file.h"
30 #include "qemu/option.h"
31 #include "qemu/units.h"
32 
33 /* Kernel boot protocol is specified in the kernel docs
34  * Documentation/arm/Booting and Documentation/arm64/booting.txt
35  * They have different preferred image load offsets from system RAM base.
36  */
37 #define KERNEL_ARGS_ADDR   0x100
38 #define KERNEL_NOLOAD_ADDR 0x02000000
39 #define KERNEL_LOAD_ADDR   0x00010000
40 #define KERNEL64_LOAD_ADDR 0x00080000
41 
42 #define ARM64_TEXT_OFFSET_OFFSET    8
43 #define ARM64_MAGIC_OFFSET          56
44 
45 #define BOOTLOADER_MAX_SIZE         (4 * KiB)
46 
arm_boot_address_space(ARMCPU * cpu,const struct arm_boot_info * info)47 AddressSpace *arm_boot_address_space(ARMCPU *cpu,
48                                      const struct arm_boot_info *info)
49 {
50     /* Return the address space to use for bootloader reads and writes.
51      * We prefer the secure address space if the CPU has it and we're
52      * going to boot the guest into it.
53      */
54     int asidx;
55     CPUState *cs = CPU(cpu);
56 
57     if (arm_feature(&cpu->env, ARM_FEATURE_EL3) && info->secure_boot) {
58         asidx = ARMASIdx_S;
59     } else {
60         asidx = ARMASIdx_NS;
61     }
62 
63     return cpu_get_address_space(cs, asidx);
64 }
65 
66 static const ARMInsnFixup bootloader_aarch64[] = {
67     { 0x580000c0 }, /* ldr x0, arg ; Load the lower 32-bits of DTB */
68     { 0xaa1f03e1 }, /* mov x1, xzr */
69     { 0xaa1f03e2 }, /* mov x2, xzr */
70     { 0xaa1f03e3 }, /* mov x3, xzr */
71     { 0x58000084 }, /* ldr x4, entry ; Load the lower 32-bits of kernel entry */
72     { 0xd61f0080 }, /* br x4      ; Jump to the kernel entry point */
73     { 0, FIXUP_ARGPTR_LO }, /* arg: .word @DTB Lower 32-bits */
74     { 0, FIXUP_ARGPTR_HI}, /* .word @DTB Higher 32-bits */
75     { 0, FIXUP_ENTRYPOINT_LO }, /* entry: .word @Kernel Entry Lower 32-bits */
76     { 0, FIXUP_ENTRYPOINT_HI }, /* .word @Kernel Entry Higher 32-bits */
77     { 0, FIXUP_TERMINATOR }
78 };
79 
80 /* A very small bootloader: call the board-setup code (if needed),
81  * set r0-r2, then jump to the kernel.
82  * If we're not calling boot setup code then we don't copy across
83  * the first BOOTLOADER_NO_BOARD_SETUP_OFFSET insns in this array.
84  */
85 
86 static const ARMInsnFixup bootloader[] = {
87     { 0xe28fe004 }, /* add     lr, pc, #4 */
88     { 0xe51ff004 }, /* ldr     pc, [pc, #-4] */
89     { 0, FIXUP_BOARD_SETUP },
90 #define BOOTLOADER_NO_BOARD_SETUP_OFFSET 3
91     { 0xe3a00000 }, /* mov     r0, #0 */
92     { 0xe59f1004 }, /* ldr     r1, [pc, #4] */
93     { 0xe59f2004 }, /* ldr     r2, [pc, #4] */
94     { 0xe59ff004 }, /* ldr     pc, [pc, #4] */
95     { 0, FIXUP_BOARDID },
96     { 0, FIXUP_ARGPTR_LO },
97     { 0, FIXUP_ENTRYPOINT_LO },
98     { 0, FIXUP_TERMINATOR }
99 };
100 
101 /* Handling for secondary CPU boot in a multicore system.
102  * Unlike the uniprocessor/primary CPU boot, this is platform
103  * dependent. The default code here is based on the secondary
104  * CPU boot protocol used on realview/vexpress boards, with
105  * some parameterisation to increase its flexibility.
106  * QEMU platform models for which this code is not appropriate
107  * should override write_secondary_boot and secondary_cpu_reset_hook
108  * instead.
109  *
110  * This code enables the interrupt controllers for the secondary
111  * CPUs and then puts all the secondary CPUs into a loop waiting
112  * for an interprocessor interrupt and polling a configurable
113  * location for the kernel secondary CPU entry point.
114  */
115 #define DSB_INSN 0xf57ff04f
116 #define CP15_DSB_INSN 0xee070f9a /* mcr cp15, 0, r0, c7, c10, 4 */
117 
118 static const ARMInsnFixup smpboot[] = {
119     { 0xe59f2028 }, /* ldr r2, gic_cpu_if */
120     { 0xe59f0028 }, /* ldr r0, bootreg_addr */
121     { 0xe3a01001 }, /* mov r1, #1 */
122     { 0xe5821000 }, /* str r1, [r2] - set GICC_CTLR.Enable */
123     { 0xe3a010ff }, /* mov r1, #0xff */
124     { 0xe5821004 }, /* str r1, [r2, 4] - set GIC_PMR.Priority to 0xff */
125     { 0, FIXUP_DSB },   /* dsb */
126     { 0xe320f003 }, /* wfi */
127     { 0xe5901000 }, /* ldr     r1, [r0] */
128     { 0xe1110001 }, /* tst     r1, r1 */
129     { 0x0afffffb }, /* beq     <wfi> */
130     { 0xe12fff11 }, /* bx      r1 */
131     { 0, FIXUP_GIC_CPU_IF }, /* gic_cpu_if: .word 0x.... */
132     { 0, FIXUP_BOOTREG }, /* bootreg_addr: .word 0x.... */
133     { 0, FIXUP_TERMINATOR }
134 };
135 
arm_write_bootloader(const char * name,AddressSpace * as,hwaddr addr,const ARMInsnFixup * insns,const uint32_t * fixupcontext)136 void arm_write_bootloader(const char *name,
137                           AddressSpace *as, hwaddr addr,
138                           const ARMInsnFixup *insns,
139                           const uint32_t *fixupcontext)
140 {
141     /* Fix up the specified bootloader fragment and write it into
142      * guest memory using rom_add_blob_fixed(). fixupcontext is
143      * an array giving the values to write in for the fixup types
144      * which write a value into the code array.
145      */
146     int i, len;
147     uint32_t *code;
148 
149     len = 0;
150     while (insns[len].fixup != FIXUP_TERMINATOR) {
151         len++;
152     }
153 
154     code = g_new0(uint32_t, len);
155 
156     for (i = 0; i < len; i++) {
157         uint32_t insn = insns[i].insn;
158         FixupType fixup = insns[i].fixup;
159 
160         switch (fixup) {
161         case FIXUP_NONE:
162             break;
163         case FIXUP_BOARDID:
164         case FIXUP_BOARD_SETUP:
165         case FIXUP_ARGPTR_LO:
166         case FIXUP_ARGPTR_HI:
167         case FIXUP_ENTRYPOINT_LO:
168         case FIXUP_ENTRYPOINT_HI:
169         case FIXUP_GIC_CPU_IF:
170         case FIXUP_BOOTREG:
171         case FIXUP_DSB:
172             insn = fixupcontext[fixup];
173             break;
174         default:
175             abort();
176         }
177         code[i] = tswap32(insn);
178     }
179 
180     assert((len * sizeof(uint32_t)) < BOOTLOADER_MAX_SIZE);
181 
182     rom_add_blob_fixed_as(name, code, len * sizeof(uint32_t), addr, as);
183 
184     g_free(code);
185 }
186 
default_write_secondary(ARMCPU * cpu,const struct arm_boot_info * info)187 static void default_write_secondary(ARMCPU *cpu,
188                                     const struct arm_boot_info *info)
189 {
190     uint32_t fixupcontext[FIXUP_MAX];
191     AddressSpace *as = arm_boot_address_space(cpu, info);
192 
193     fixupcontext[FIXUP_GIC_CPU_IF] = info->gic_cpu_if_addr;
194     fixupcontext[FIXUP_BOOTREG] = info->smp_bootreg_addr;
195     if (arm_feature(&cpu->env, ARM_FEATURE_V7)) {
196         fixupcontext[FIXUP_DSB] = DSB_INSN;
197     } else {
198         fixupcontext[FIXUP_DSB] = CP15_DSB_INSN;
199     }
200 
201     arm_write_bootloader("smpboot", as, info->smp_loader_start,
202                          smpboot, fixupcontext);
203 }
204 
arm_write_secure_board_setup_dummy_smc(ARMCPU * cpu,const struct arm_boot_info * info,hwaddr mvbar_addr)205 void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
206                                             const struct arm_boot_info *info,
207                                             hwaddr mvbar_addr)
208 {
209     AddressSpace *as = arm_boot_address_space(cpu, info);
210     int n;
211     uint32_t mvbar_blob[] = {
212         /* mvbar_addr: secure monitor vectors
213          * Default unimplemented and unused vectors to spin. Makes it
214          * easier to debug (as opposed to the CPU running away).
215          */
216         0xeafffffe, /* (spin) */
217         0xeafffffe, /* (spin) */
218         0xe1b0f00e, /* movs pc, lr ;SMC exception return */
219         0xeafffffe, /* (spin) */
220         0xeafffffe, /* (spin) */
221         0xeafffffe, /* (spin) */
222         0xeafffffe, /* (spin) */
223         0xeafffffe, /* (spin) */
224     };
225     uint32_t board_setup_blob[] = {
226         /* board setup addr */
227         0xee110f51, /* mrc     p15, 0, r0, c1, c1, 2  ;read NSACR */
228         0xe3800b03, /* orr     r0, #0xc00             ;set CP11, CP10 */
229         0xee010f51, /* mcr     p15, 0, r0, c1, c1, 2  ;write NSACR */
230         0xe3a00e00 + (mvbar_addr >> 4), /* mov r0, #mvbar_addr */
231         0xee0c0f30, /* mcr     p15, 0, r0, c12, c0, 1 ;set MVBAR */
232         0xee110f11, /* mrc     p15, 0, r0, c1 , c1, 0 ;read SCR */
233         0xe3800031, /* orr     r0, #0x31              ;enable AW, FW, NS */
234         0xee010f11, /* mcr     p15, 0, r0, c1, c1, 0  ;write SCR */
235         0xe1a0100e, /* mov     r1, lr                 ;save LR across SMC */
236         0xe1600070, /* smc     #0                     ;call monitor to flush SCR */
237         0xe1a0f001, /* mov     pc, r1                 ;return */
238     };
239 
240     /* check that mvbar_addr is correctly aligned and relocatable (using MOV) */
241     assert((mvbar_addr & 0x1f) == 0 && (mvbar_addr >> 4) < 0x100);
242 
243     /* check that these blobs don't overlap */
244     assert((mvbar_addr + sizeof(mvbar_blob) <= info->board_setup_addr)
245           || (info->board_setup_addr + sizeof(board_setup_blob) <= mvbar_addr));
246 
247     for (n = 0; n < ARRAY_SIZE(mvbar_blob); n++) {
248         mvbar_blob[n] = tswap32(mvbar_blob[n]);
249     }
250     rom_add_blob_fixed_as("board-setup-mvbar", mvbar_blob, sizeof(mvbar_blob),
251                           mvbar_addr, as);
252 
253     for (n = 0; n < ARRAY_SIZE(board_setup_blob); n++) {
254         board_setup_blob[n] = tswap32(board_setup_blob[n]);
255     }
256     rom_add_blob_fixed_as("board-setup", board_setup_blob,
257                           sizeof(board_setup_blob), info->board_setup_addr, as);
258 }
259 
default_reset_secondary(ARMCPU * cpu,const struct arm_boot_info * info)260 static void default_reset_secondary(ARMCPU *cpu,
261                                     const struct arm_boot_info *info)
262 {
263     AddressSpace *as = arm_boot_address_space(cpu, info);
264     CPUState *cs = CPU(cpu);
265 
266     address_space_stl_notdirty(as, info->smp_bootreg_addr,
267                                0, MEMTXATTRS_UNSPECIFIED, NULL);
268     cpu_set_pc(cs, info->smp_loader_start);
269 }
270 
have_dtb(const struct arm_boot_info * info)271 static inline bool have_dtb(const struct arm_boot_info *info)
272 {
273     return info->dtb_filename || info->get_dtb;
274 }
275 
276 #define WRITE_WORD(p, value) do { \
277     address_space_stl_notdirty(as, p, value, \
278                                MEMTXATTRS_UNSPECIFIED, NULL);  \
279     p += 4;                       \
280 } while (0)
281 
set_kernel_args(const struct arm_boot_info * info,AddressSpace * as)282 static void set_kernel_args(const struct arm_boot_info *info, AddressSpace *as)
283 {
284     int initrd_size = info->initrd_size;
285     hwaddr base = info->loader_start;
286     hwaddr p;
287 
288     p = base + KERNEL_ARGS_ADDR;
289     /* ATAG_CORE */
290     WRITE_WORD(p, 5);
291     WRITE_WORD(p, 0x54410001);
292     WRITE_WORD(p, 1);
293     WRITE_WORD(p, 0x1000);
294     WRITE_WORD(p, 0);
295     /* ATAG_MEM */
296     /* TODO: handle multiple chips on one ATAG list */
297     WRITE_WORD(p, 4);
298     WRITE_WORD(p, 0x54410002);
299     WRITE_WORD(p, info->ram_size);
300     WRITE_WORD(p, info->loader_start);
301     if (initrd_size) {
302         /* ATAG_INITRD2 */
303         WRITE_WORD(p, 4);
304         WRITE_WORD(p, 0x54420005);
305         WRITE_WORD(p, info->initrd_start);
306         WRITE_WORD(p, initrd_size);
307     }
308     if (info->kernel_cmdline && *info->kernel_cmdline) {
309         /* ATAG_CMDLINE */
310         int cmdline_size;
311 
312         cmdline_size = strlen(info->kernel_cmdline);
313         address_space_write(as, p + 8, MEMTXATTRS_UNSPECIFIED,
314                             info->kernel_cmdline, cmdline_size + 1);
315         cmdline_size = (cmdline_size >> 2) + 1;
316         WRITE_WORD(p, cmdline_size + 2);
317         WRITE_WORD(p, 0x54410009);
318         p += cmdline_size * 4;
319     }
320     if (info->atag_board) {
321         /* ATAG_BOARD */
322         int atag_board_len;
323         uint8_t atag_board_buf[0x1000];
324 
325         atag_board_len = (info->atag_board(info, atag_board_buf) + 3) & ~3;
326         WRITE_WORD(p, (atag_board_len + 8) >> 2);
327         WRITE_WORD(p, 0x414f4d50);
328         address_space_write(as, p, MEMTXATTRS_UNSPECIFIED,
329                             atag_board_buf, atag_board_len);
330         p += atag_board_len;
331     }
332     /* ATAG_END */
333     WRITE_WORD(p, 0);
334     WRITE_WORD(p, 0);
335 }
336 
set_kernel_args_old(const struct arm_boot_info * info,AddressSpace * as)337 static void set_kernel_args_old(const struct arm_boot_info *info,
338                                 AddressSpace *as)
339 {
340     hwaddr p;
341     const char *s;
342     int initrd_size = info->initrd_size;
343     hwaddr base = info->loader_start;
344 
345     /* see linux/include/asm-arm/setup.h */
346     p = base + KERNEL_ARGS_ADDR;
347     /* page_size */
348     WRITE_WORD(p, 4096);
349     /* nr_pages */
350     WRITE_WORD(p, info->ram_size / 4096);
351     /* ramdisk_size */
352     WRITE_WORD(p, 0);
353 #define FLAG_READONLY 1
354 #define FLAG_RDLOAD   4
355 #define FLAG_RDPROMPT 8
356     /* flags */
357     WRITE_WORD(p, FLAG_READONLY | FLAG_RDLOAD | FLAG_RDPROMPT);
358     /* rootdev */
359     WRITE_WORD(p, (31 << 8) | 0); /* /dev/mtdblock0 */
360     /* video_num_cols */
361     WRITE_WORD(p, 0);
362     /* video_num_rows */
363     WRITE_WORD(p, 0);
364     /* video_x */
365     WRITE_WORD(p, 0);
366     /* video_y */
367     WRITE_WORD(p, 0);
368     /* memc_control_reg */
369     WRITE_WORD(p, 0);
370     /* unsigned char sounddefault */
371     /* unsigned char adfsdrives */
372     /* unsigned char bytes_per_char_h */
373     /* unsigned char bytes_per_char_v */
374     WRITE_WORD(p, 0);
375     /* pages_in_bank[4] */
376     WRITE_WORD(p, 0);
377     WRITE_WORD(p, 0);
378     WRITE_WORD(p, 0);
379     WRITE_WORD(p, 0);
380     /* pages_in_vram */
381     WRITE_WORD(p, 0);
382     /* initrd_start */
383     if (initrd_size) {
384         WRITE_WORD(p, info->initrd_start);
385     } else {
386         WRITE_WORD(p, 0);
387     }
388     /* initrd_size */
389     WRITE_WORD(p, initrd_size);
390     /* rd_start */
391     WRITE_WORD(p, 0);
392     /* system_rev */
393     WRITE_WORD(p, 0);
394     /* system_serial_low */
395     WRITE_WORD(p, 0);
396     /* system_serial_high */
397     WRITE_WORD(p, 0);
398     /* mem_fclk_21285 */
399     WRITE_WORD(p, 0);
400     /* zero unused fields */
401     while (p < base + KERNEL_ARGS_ADDR + 256 + 1024) {
402         WRITE_WORD(p, 0);
403     }
404     s = info->kernel_cmdline;
405     if (s) {
406         address_space_write(as, p, MEMTXATTRS_UNSPECIFIED, s, strlen(s) + 1);
407     } else {
408         WRITE_WORD(p, 0);
409     }
410 }
411 
fdt_add_memory_node(void * fdt,uint32_t acells,hwaddr mem_base,uint32_t scells,hwaddr mem_len,int numa_node_id)412 static int fdt_add_memory_node(void *fdt, uint32_t acells, hwaddr mem_base,
413                                uint32_t scells, hwaddr mem_len,
414                                int numa_node_id)
415 {
416     char *nodename;
417     int ret;
418 
419     nodename = g_strdup_printf("/memory@%" PRIx64, mem_base);
420     qemu_fdt_add_subnode(fdt, nodename);
421     qemu_fdt_setprop_string(fdt, nodename, "device_type", "memory");
422     ret = qemu_fdt_setprop_sized_cells(fdt, nodename, "reg", acells, mem_base,
423                                        scells, mem_len);
424     if (ret < 0) {
425         goto out;
426     }
427 
428     /* only set the NUMA ID if it is specified */
429     if (numa_node_id >= 0) {
430         ret = qemu_fdt_setprop_cell(fdt, nodename,
431                                     "numa-node-id", numa_node_id);
432     }
433 out:
434     g_free(nodename);
435     return ret;
436 }
437 
fdt_add_psci_node(void * fdt,ARMCPU * armcpu)438 static void fdt_add_psci_node(void *fdt, ARMCPU *armcpu)
439 {
440     uint32_t cpu_suspend_fn;
441     uint32_t cpu_off_fn;
442     uint32_t cpu_on_fn;
443     uint32_t migrate_fn;
444     const char *psci_method;
445     int64_t psci_conduit;
446     int rc;
447 
448     psci_conduit = object_property_get_int(OBJECT(armcpu),
449                                            "psci-conduit",
450                                            &error_abort);
451     switch (psci_conduit) {
452     case QEMU_PSCI_CONDUIT_DISABLED:
453         return;
454     case QEMU_PSCI_CONDUIT_HVC:
455         psci_method = "hvc";
456         break;
457     case QEMU_PSCI_CONDUIT_SMC:
458         psci_method = "smc";
459         break;
460     default:
461         g_assert_not_reached();
462     }
463 
464     /*
465      * A pre-existing /psci node might specify function ID values
466      * that don't match QEMU's PSCI implementation. Delete the whole
467      * node and put our own in instead.
468      */
469     rc = fdt_path_offset(fdt, "/psci");
470     if (rc >= 0) {
471         qemu_fdt_nop_node(fdt, "/psci");
472     }
473 
474     qemu_fdt_add_subnode(fdt, "/psci");
475     if (armcpu->psci_version >= QEMU_PSCI_VERSION_0_2) {
476         if (armcpu->psci_version < QEMU_PSCI_VERSION_1_0) {
477             const char comp[] = "arm,psci-0.2\0arm,psci";
478             qemu_fdt_setprop(fdt, "/psci", "compatible", comp, sizeof(comp));
479         } else {
480             const char comp[] = "arm,psci-1.0\0arm,psci-0.2\0arm,psci";
481             qemu_fdt_setprop(fdt, "/psci", "compatible", comp, sizeof(comp));
482         }
483 
484         cpu_off_fn = QEMU_PSCI_0_2_FN_CPU_OFF;
485         if (arm_feature(&armcpu->env, ARM_FEATURE_AARCH64)) {
486             cpu_suspend_fn = QEMU_PSCI_0_2_FN64_CPU_SUSPEND;
487             cpu_on_fn = QEMU_PSCI_0_2_FN64_CPU_ON;
488             migrate_fn = QEMU_PSCI_0_2_FN64_MIGRATE;
489         } else {
490             cpu_suspend_fn = QEMU_PSCI_0_2_FN_CPU_SUSPEND;
491             cpu_on_fn = QEMU_PSCI_0_2_FN_CPU_ON;
492             migrate_fn = QEMU_PSCI_0_2_FN_MIGRATE;
493         }
494     } else {
495         qemu_fdt_setprop_string(fdt, "/psci", "compatible", "arm,psci");
496 
497         cpu_suspend_fn = QEMU_PSCI_0_1_FN_CPU_SUSPEND;
498         cpu_off_fn = QEMU_PSCI_0_1_FN_CPU_OFF;
499         cpu_on_fn = QEMU_PSCI_0_1_FN_CPU_ON;
500         migrate_fn = QEMU_PSCI_0_1_FN_MIGRATE;
501     }
502 
503     /* We adopt the PSCI spec's nomenclature, and use 'conduit' to refer
504      * to the instruction that should be used to invoke PSCI functions.
505      * However, the device tree binding uses 'method' instead, so that is
506      * what we should use here.
507      */
508     qemu_fdt_setprop_string(fdt, "/psci", "method", psci_method);
509 
510     qemu_fdt_setprop_cell(fdt, "/psci", "cpu_suspend", cpu_suspend_fn);
511     qemu_fdt_setprop_cell(fdt, "/psci", "cpu_off", cpu_off_fn);
512     qemu_fdt_setprop_cell(fdt, "/psci", "cpu_on", cpu_on_fn);
513     qemu_fdt_setprop_cell(fdt, "/psci", "migrate", migrate_fn);
514 }
515 
arm_load_dtb(hwaddr addr,const struct arm_boot_info * binfo,hwaddr addr_limit,AddressSpace * as,MachineState * ms,ARMCPU * cpu)516 int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
517                  hwaddr addr_limit, AddressSpace *as, MachineState *ms,
518                  ARMCPU *cpu)
519 {
520     void *fdt = NULL;
521     int size, rc, n = 0;
522     uint32_t acells, scells;
523     unsigned int i;
524     hwaddr mem_base, mem_len;
525     char **node_path;
526     Error *err = NULL;
527 
528     if (binfo->dtb_filename) {
529         char *filename;
530         filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, binfo->dtb_filename);
531         if (!filename) {
532             fprintf(stderr, "Couldn't open dtb file %s\n", binfo->dtb_filename);
533             goto fail;
534         }
535 
536         fdt = load_device_tree(filename, &size);
537         if (!fdt) {
538             fprintf(stderr, "Couldn't open dtb file %s\n", filename);
539             g_free(filename);
540             goto fail;
541         }
542         g_free(filename);
543     } else {
544         fdt = binfo->get_dtb(binfo, &size);
545         if (!fdt) {
546             fprintf(stderr, "Board was unable to create a dtb blob\n");
547             goto fail;
548         }
549     }
550 
551     if (addr_limit > addr && size > (addr_limit - addr)) {
552         /* Installing the device tree blob at addr would exceed addr_limit.
553          * Whether this constitutes failure is up to the caller to decide,
554          * so just return 0 as size, i.e., no error.
555          */
556         g_free(fdt);
557         return 0;
558     }
559 
560     acells = qemu_fdt_getprop_cell(fdt, "/", "#address-cells",
561                                    NULL, &error_fatal);
562     scells = qemu_fdt_getprop_cell(fdt, "/", "#size-cells",
563                                    NULL, &error_fatal);
564     if (acells == 0 || scells == 0) {
565         fprintf(stderr, "dtb file invalid (#address-cells or #size-cells 0)\n");
566         goto fail;
567     }
568 
569     if (scells < 2 && binfo->ram_size >= 4 * GiB) {
570         /* This is user error so deserves a friendlier error message
571          * than the failure of setprop_sized_cells would provide
572          */
573         fprintf(stderr, "qemu: dtb file not compatible with "
574                 "RAM size > 4GB\n");
575         goto fail;
576     }
577 
578     /* nop all root nodes matching /memory or /memory@unit-address */
579     node_path = qemu_fdt_node_unit_path(fdt, "memory", &err);
580     if (err) {
581         error_report_err(err);
582         goto fail;
583     }
584     while (node_path[n]) {
585         if (g_str_has_prefix(node_path[n], "/memory")) {
586             qemu_fdt_nop_node(fdt, node_path[n]);
587         }
588         n++;
589     }
590     g_strfreev(node_path);
591 
592     /*
593      * We drop all the memory nodes which correspond to empty NUMA nodes
594      * from the device tree, because the Linux NUMA binding document
595      * states they should not be generated. Linux will get the NUMA node
596      * IDs of the empty NUMA nodes from the distance map if they are needed.
597      * This means QEMU users may be obliged to provide command lines which
598      * configure distance maps when the empty NUMA node IDs are needed and
599      * Linux's default distance map isn't sufficient.
600      */
601     if (ms->numa_state != NULL && ms->numa_state->num_nodes > 0) {
602         mem_base = binfo->loader_start;
603         for (i = 0; i < ms->numa_state->num_nodes; i++) {
604             mem_len = ms->numa_state->nodes[i].node_mem;
605             if (!mem_len) {
606                 continue;
607             }
608 
609             rc = fdt_add_memory_node(fdt, acells, mem_base,
610                                      scells, mem_len, i);
611             if (rc < 0) {
612                 fprintf(stderr, "couldn't add /memory@%"PRIx64" node\n",
613                         mem_base);
614                 goto fail;
615             }
616 
617             mem_base += mem_len;
618         }
619     } else {
620         rc = fdt_add_memory_node(fdt, acells, binfo->loader_start,
621                                  scells, binfo->ram_size, -1);
622         if (rc < 0) {
623             fprintf(stderr, "couldn't add /memory@%"PRIx64" node\n",
624                     binfo->loader_start);
625             goto fail;
626         }
627     }
628 
629     rc = fdt_path_offset(fdt, "/chosen");
630     if (rc < 0) {
631         qemu_fdt_add_subnode(fdt, "/chosen");
632     }
633 
634     if (ms->kernel_cmdline && *ms->kernel_cmdline) {
635         rc = qemu_fdt_setprop_string(fdt, "/chosen", "bootargs",
636                                      ms->kernel_cmdline);
637         if (rc < 0) {
638             fprintf(stderr, "couldn't set /chosen/bootargs\n");
639             goto fail;
640         }
641     }
642 
643     if (binfo->initrd_size) {
644         rc = qemu_fdt_setprop_sized_cells(fdt, "/chosen", "linux,initrd-start",
645                                           acells, binfo->initrd_start);
646         if (rc < 0) {
647             fprintf(stderr, "couldn't set /chosen/linux,initrd-start\n");
648             goto fail;
649         }
650 
651         rc = qemu_fdt_setprop_sized_cells(fdt, "/chosen", "linux,initrd-end",
652                                           acells,
653                                           binfo->initrd_start +
654                                           binfo->initrd_size);
655         if (rc < 0) {
656             fprintf(stderr, "couldn't set /chosen/linux,initrd-end\n");
657             goto fail;
658         }
659     }
660 
661     fdt_add_psci_node(fdt, cpu);
662 
663     if (binfo->modify_dtb) {
664         binfo->modify_dtb(binfo, fdt);
665     }
666 
667     /* Put the DTB into the memory map as a ROM image: this will ensure
668      * the DTB is copied again upon reset, even if addr points into RAM.
669      */
670     rom_add_blob_fixed_as("dtb", fdt, size, addr, as);
671     qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
672                                        rom_ptr_for_as(as, addr, size));
673 
674     if (fdt != ms->fdt) {
675         g_free(ms->fdt);
676         ms->fdt = fdt;
677     }
678 
679     return size;
680 
681 fail:
682     g_free(fdt);
683     return -1;
684 }
685 
do_cpu_reset(void * opaque)686 static void do_cpu_reset(void *opaque)
687 {
688     ARMCPU *cpu = opaque;
689     CPUState *cs = CPU(cpu);
690     CPUARMState *env = &cpu->env;
691     const struct arm_boot_info *info = env->boot_info;
692 
693     cpu_reset(cs);
694     if (info) {
695         if (!info->is_linux) {
696             int i;
697             /* Jump to the entry point.  */
698             uint64_t entry = info->entry;
699 
700             switch (info->endianness) {
701             case ARM_ENDIANNESS_LE:
702                 env->cp15.sctlr_el[1] &= ~SCTLR_E0E;
703                 for (i = 1; i < 4; ++i) {
704                     env->cp15.sctlr_el[i] &= ~SCTLR_EE;
705                 }
706                 env->uncached_cpsr &= ~CPSR_E;
707                 break;
708             case ARM_ENDIANNESS_BE8:
709                 env->cp15.sctlr_el[1] |= SCTLR_E0E;
710                 for (i = 1; i < 4; ++i) {
711                     env->cp15.sctlr_el[i] |= SCTLR_EE;
712                 }
713                 env->uncached_cpsr |= CPSR_E;
714                 break;
715             case ARM_ENDIANNESS_BE32:
716                 env->cp15.sctlr_el[1] |= SCTLR_B;
717                 break;
718             case ARM_ENDIANNESS_UNKNOWN:
719                 break; /* Board's decision */
720             default:
721                 g_assert_not_reached();
722             }
723 
724             cpu_set_pc(cs, entry);
725         } else {
726             /*
727              * If we are booting Linux then we might need to do so at:
728              *  - AArch64 NS EL2 or NS EL1
729              *  - AArch32 Secure SVC (EL3)
730              *  - AArch32 NS Hyp (EL2)
731              *  - AArch32 NS SVC (EL1)
732              * Configure the CPU in the way boot firmware would do to
733              * drop us down to the appropriate level.
734              */
735             int target_el = arm_feature(env, ARM_FEATURE_EL2) ? 2 : 1;
736 
737             if (env->aarch64) {
738                 /*
739                  * AArch64 kernels never boot in secure mode, and we don't
740                  * support the secure_board_setup hook for AArch64.
741                  */
742                 assert(!info->secure_boot);
743                 assert(!info->secure_board_setup);
744             } else {
745                 if (arm_feature(env, ARM_FEATURE_EL3) &&
746                     (info->secure_boot ||
747                      (info->secure_board_setup && cs == first_cpu))) {
748                     /* Start this CPU in Secure SVC */
749                     target_el = 3;
750                 }
751             }
752 
753             arm_emulate_firmware_reset(cs, target_el);
754 
755             if (cs == first_cpu) {
756                 AddressSpace *as = arm_boot_address_space(cpu, info);
757 
758                 cpu_set_pc(cs, info->loader_start);
759 
760                 if (!have_dtb(info)) {
761                     if (old_param) {
762                         set_kernel_args_old(info, as);
763                     } else {
764                         set_kernel_args(info, as);
765                     }
766                 }
767             } else if (info->secondary_cpu_reset_hook) {
768                 info->secondary_cpu_reset_hook(cpu, info);
769             }
770         }
771 
772         if (tcg_enabled()) {
773             arm_rebuild_hflags(env);
774         }
775     }
776 }
777 
do_arm_linux_init(Object * obj,void * opaque)778 static int do_arm_linux_init(Object *obj, void *opaque)
779 {
780     if (object_dynamic_cast(obj, TYPE_ARM_LINUX_BOOT_IF)) {
781         ARMLinuxBootIf *albif = ARM_LINUX_BOOT_IF(obj);
782         ARMLinuxBootIfClass *albifc = ARM_LINUX_BOOT_IF_GET_CLASS(obj);
783         struct arm_boot_info *info = opaque;
784 
785         if (albifc->arm_linux_init) {
786             albifc->arm_linux_init(albif, info->secure_boot);
787         }
788     }
789     return 0;
790 }
791 
arm_load_elf(struct arm_boot_info * info,uint64_t * pentry,uint64_t * lowaddr,uint64_t * highaddr,int elf_machine,AddressSpace * as)792 static ssize_t arm_load_elf(struct arm_boot_info *info, uint64_t *pentry,
793                             uint64_t *lowaddr, uint64_t *highaddr,
794                             int elf_machine, AddressSpace *as)
795 {
796     bool elf_is64;
797     union {
798         Elf32_Ehdr h32;
799         Elf64_Ehdr h64;
800     } elf_header;
801     int data_swab = 0;
802     int elf_data_order;
803     ssize_t ret;
804     Error *err = NULL;
805 
806 
807     load_elf_hdr(info->kernel_filename, &elf_header, &elf_is64, &err);
808     if (err) {
809         /*
810          * If the file is not an ELF file we silently return.
811          * The caller will fall back to try other formats.
812          */
813         error_free(err);
814         return -1;
815     }
816 
817     if (elf_is64) {
818         elf_data_order = elf_header.h64.e_ident[EI_DATA];
819         info->endianness = elf_data_order == ELFDATA2MSB ? ARM_ENDIANNESS_BE8
820                                                          : ARM_ENDIANNESS_LE;
821     } else {
822         elf_data_order = elf_header.h32.e_ident[EI_DATA];
823         if (elf_data_order == ELFDATA2MSB) {
824             if (bswap32(elf_header.h32.e_flags) & EF_ARM_BE8) {
825                 info->endianness = ARM_ENDIANNESS_BE8;
826             } else {
827                 info->endianness = ARM_ENDIANNESS_BE32;
828                 /* In BE32, the CPU has a different view of the per-byte
829                  * address map than the rest of the system. BE32 ELF files
830                  * are organised such that they can be programmed through
831                  * the CPU's per-word byte-reversed view of the world. QEMU
832                  * however loads ELF files independently of the CPU. So
833                  * tell the ELF loader to byte reverse the data for us.
834                  */
835                 data_swab = 2;
836             }
837         } else {
838             info->endianness = ARM_ENDIANNESS_LE;
839         }
840     }
841 
842     ret = load_elf_as(info->kernel_filename, NULL, NULL, NULL,
843                       pentry, lowaddr, highaddr, NULL, elf_data_order,
844                       elf_machine, 1, data_swab, as);
845     if (ret <= 0) {
846         /* The header loaded but the image didn't */
847         error_report("Couldn't load elf '%s': %s",
848                      info->kernel_filename, load_elf_strerror(ret));
849         exit(1);
850     }
851 
852     return ret;
853 }
854 
load_aarch64_image(const char * filename,hwaddr mem_base,hwaddr * entry,AddressSpace * as)855 static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
856                                    hwaddr *entry, AddressSpace *as)
857 {
858     hwaddr kernel_load_offset = KERNEL64_LOAD_ADDR;
859     uint64_t kernel_size = 0;
860     uint8_t *buffer;
861     ssize_t size;
862 
863     /* On aarch64, it's the bootloader's job to uncompress the kernel. */
864     size = load_image_gzipped_buffer(filename, LOAD_IMAGE_MAX_GUNZIP_BYTES,
865                                      &buffer);
866 
867     if (size < 0) {
868         gsize len;
869 
870         /* Load as raw file otherwise */
871         if (!g_file_get_contents(filename, (char **)&buffer, &len, NULL)) {
872             return -1;
873         }
874         size = len;
875 
876         /* Unpack the image if it is a EFI zboot image */
877         if (unpack_efi_zboot_image(&buffer, &size) < 0) {
878             g_free(buffer);
879             return -1;
880         }
881     }
882 
883     /* check the arm64 magic header value -- very old kernels may not have it */
884     if (size > ARM64_MAGIC_OFFSET + 4 &&
885         memcmp(buffer + ARM64_MAGIC_OFFSET, "ARM\x64", 4) == 0) {
886         uint64_t hdrvals[2];
887 
888         /* The arm64 Image header has text_offset and image_size fields at 8 and
889          * 16 bytes into the Image header, respectively. The text_offset field
890          * is only valid if the image_size is non-zero.
891          */
892         memcpy(&hdrvals, buffer + ARM64_TEXT_OFFSET_OFFSET, sizeof(hdrvals));
893 
894         kernel_size = le64_to_cpu(hdrvals[1]);
895 
896         if (kernel_size != 0) {
897             kernel_load_offset = le64_to_cpu(hdrvals[0]);
898 
899             /*
900              * We write our startup "bootloader" at the very bottom of RAM,
901              * so that bit can't be used for the image. Luckily the Image
902              * format specification is that the image requests only an offset
903              * from a 2MB boundary, not an absolute load address. So if the
904              * image requests an offset that might mean it overlaps with the
905              * bootloader, we can just load it starting at 2MB+offset rather
906              * than 0MB + offset.
907              */
908             if (kernel_load_offset < BOOTLOADER_MAX_SIZE) {
909                 kernel_load_offset += 2 * MiB;
910             }
911         }
912     }
913 
914     /*
915      * Kernels before v3.17 don't populate the image_size field, and
916      * raw images have no header. For those our best guess at the size
917      * is the size of the Image file itself.
918      */
919     if (kernel_size == 0) {
920         kernel_size = size;
921     }
922 
923     *entry = mem_base + kernel_load_offset;
924     rom_add_blob_fixed_as(filename, buffer, size, *entry, as);
925 
926     g_free(buffer);
927 
928     return kernel_size;
929 }
930 
arm_setup_direct_kernel_boot(ARMCPU * cpu,struct arm_boot_info * info)931 static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
932                                          struct arm_boot_info *info)
933 {
934     /* Set up for a direct boot of a kernel image file. */
935     CPUState *cs;
936     AddressSpace *as = arm_boot_address_space(cpu, info);
937     ssize_t kernel_size;
938     int initrd_size;
939     int is_linux = 0;
940     uint64_t elf_entry;
941     /* Addresses of first byte used and first byte not used by the image */
942     uint64_t image_low_addr = 0, image_high_addr = 0;
943     int elf_machine;
944     hwaddr entry;
945     static const ARMInsnFixup *primary_loader;
946     uint64_t ram_end = info->loader_start + info->ram_size;
947 
948     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
949         primary_loader = bootloader_aarch64;
950         elf_machine = EM_AARCH64;
951     } else {
952         primary_loader = bootloader;
953         if (!info->write_board_setup) {
954             primary_loader += BOOTLOADER_NO_BOARD_SETUP_OFFSET;
955         }
956         elf_machine = EM_ARM;
957     }
958 
959     /* Assume that raw images are linux kernels, and ELF images are not.  */
960     kernel_size = arm_load_elf(info, &elf_entry, &image_low_addr,
961                                &image_high_addr, elf_machine, as);
962     if (kernel_size > 0 && have_dtb(info)) {
963         /*
964          * If there is still some room left at the base of RAM, try and put
965          * the DTB there like we do for images loaded with -bios or -pflash.
966          */
967         if (image_low_addr > info->loader_start
968             || image_high_addr < info->loader_start) {
969             /*
970              * Set image_low_addr as address limit for arm_load_dtb if it may be
971              * pointing into RAM, otherwise pass '0' (no limit)
972              */
973             if (image_low_addr < info->loader_start) {
974                 image_low_addr = 0;
975             }
976             info->dtb_start = info->loader_start;
977             info->dtb_limit = image_low_addr;
978         }
979     }
980     entry = elf_entry;
981     if (kernel_size < 0) {
982         uint64_t loadaddr = info->loader_start + KERNEL_NOLOAD_ADDR;
983         kernel_size = load_uimage_as(info->kernel_filename, &entry, &loadaddr,
984                                      &is_linux, NULL, NULL, as);
985         if (kernel_size >= 0) {
986             image_low_addr = loadaddr;
987             image_high_addr = image_low_addr + kernel_size;
988         }
989     }
990     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64) && kernel_size < 0) {
991         kernel_size = load_aarch64_image(info->kernel_filename,
992                                          info->loader_start, &entry, as);
993         is_linux = 1;
994         if (kernel_size >= 0) {
995             image_low_addr = entry;
996             image_high_addr = image_low_addr + kernel_size;
997         }
998     } else if (kernel_size < 0) {
999         /* 32-bit ARM */
1000         entry = info->loader_start + KERNEL_LOAD_ADDR;
1001         kernel_size = load_image_targphys_as(info->kernel_filename, entry,
1002                                              ram_end - KERNEL_LOAD_ADDR, as);
1003         is_linux = 1;
1004         if (kernel_size >= 0) {
1005             image_low_addr = entry;
1006             image_high_addr = image_low_addr + kernel_size;
1007         }
1008     }
1009     if (kernel_size < 0) {
1010         error_report("could not load kernel '%s'", info->kernel_filename);
1011         exit(1);
1012     }
1013 
1014     if (kernel_size > info->ram_size) {
1015         error_report("kernel '%s' is too large to fit in RAM "
1016                      "(kernel size %zd, RAM size %" PRId64 ")",
1017                      info->kernel_filename, kernel_size, info->ram_size);
1018         exit(1);
1019     }
1020 
1021     info->entry = entry;
1022 
1023     /*
1024      * We want to put the initrd far enough into RAM that when the
1025      * kernel is uncompressed it will not clobber the initrd. However
1026      * on boards without much RAM we must ensure that we still leave
1027      * enough room for a decent sized initrd, and on boards with large
1028      * amounts of RAM we must avoid the initrd being so far up in RAM
1029      * that it is outside lowmem and inaccessible to the kernel.
1030      * So for boards with less  than 256MB of RAM we put the initrd
1031      * halfway into RAM, and for boards with 256MB of RAM or more we put
1032      * the initrd at 128MB.
1033      * We also refuse to put the initrd somewhere that will definitely
1034      * overlay the kernel we just loaded, though for kernel formats which
1035      * don't tell us their exact size (eg self-decompressing 32-bit kernels)
1036      * we might still make a bad choice here.
1037      */
1038     info->initrd_start = info->loader_start +
1039         MIN(info->ram_size / 2, 128 * MiB);
1040     if (image_high_addr) {
1041         info->initrd_start = MAX(info->initrd_start, image_high_addr);
1042     }
1043     info->initrd_start = TARGET_PAGE_ALIGN(info->initrd_start);
1044 
1045     if (is_linux) {
1046         uint32_t fixupcontext[FIXUP_MAX];
1047 
1048         if (info->initrd_filename) {
1049 
1050             if (info->initrd_start >= ram_end) {
1051                 error_report("not enough space after kernel to load initrd");
1052                 exit(1);
1053             }
1054 
1055             initrd_size = load_ramdisk_as(info->initrd_filename,
1056                                           info->initrd_start,
1057                                           ram_end - info->initrd_start, as);
1058             if (initrd_size < 0) {
1059                 initrd_size = load_image_targphys_as(info->initrd_filename,
1060                                                      info->initrd_start,
1061                                                      ram_end -
1062                                                      info->initrd_start,
1063                                                      as);
1064             }
1065             if (initrd_size < 0) {
1066                 error_report("could not load initrd '%s'",
1067                              info->initrd_filename);
1068                 exit(1);
1069             }
1070             if (info->initrd_start + initrd_size > ram_end) {
1071                 error_report("could not load initrd '%s': "
1072                              "too big to fit into RAM after the kernel",
1073                              info->initrd_filename);
1074                 exit(1);
1075             }
1076         } else {
1077             initrd_size = 0;
1078         }
1079         info->initrd_size = initrd_size;
1080 
1081         fixupcontext[FIXUP_BOARDID] = info->board_id;
1082         fixupcontext[FIXUP_BOARD_SETUP] = info->board_setup_addr;
1083 
1084         /*
1085          * for device tree boot, we pass the DTB directly in r2. Otherwise
1086          * we point to the kernel args.
1087          */
1088         if (have_dtb(info)) {
1089             hwaddr align;
1090 
1091             if (elf_machine == EM_AARCH64) {
1092                 /*
1093                  * Some AArch64 kernels on early bootup map the fdt region as
1094                  *
1095                  *   [ ALIGN_DOWN(fdt, 2MB) ... ALIGN_DOWN(fdt, 2MB) + 2MB ]
1096                  *
1097                  * Let's play safe and prealign it to 2MB to give us some space.
1098                  */
1099                 align = 2 * MiB;
1100             } else {
1101                 /*
1102                  * Some 32bit kernels will trash anything in the 4K page the
1103                  * initrd ends in, so make sure the DTB isn't caught up in that.
1104                  */
1105                 align = 4 * KiB;
1106             }
1107 
1108             /* Place the DTB after the initrd in memory with alignment. */
1109             info->dtb_start = QEMU_ALIGN_UP(info->initrd_start + initrd_size,
1110                                            align);
1111             if (info->dtb_start >= ram_end) {
1112                 error_report("Not enough space for DTB after kernel/initrd");
1113                 exit(1);
1114             }
1115             fixupcontext[FIXUP_ARGPTR_LO] = info->dtb_start;
1116             fixupcontext[FIXUP_ARGPTR_HI] = info->dtb_start >> 32;
1117         } else {
1118             fixupcontext[FIXUP_ARGPTR_LO] =
1119                 info->loader_start + KERNEL_ARGS_ADDR;
1120             fixupcontext[FIXUP_ARGPTR_HI] =
1121                 (info->loader_start + KERNEL_ARGS_ADDR) >> 32;
1122             if (info->ram_size >= 4 * GiB) {
1123                 error_report("RAM size must be less than 4GB to boot"
1124                              " Linux kernel using ATAGS (try passing a device tree"
1125                              " using -dtb)");
1126                 exit(1);
1127             }
1128         }
1129         fixupcontext[FIXUP_ENTRYPOINT_LO] = entry;
1130         fixupcontext[FIXUP_ENTRYPOINT_HI] = entry >> 32;
1131 
1132         arm_write_bootloader("bootloader", as, info->loader_start,
1133                              primary_loader, fixupcontext);
1134 
1135         if (info->write_board_setup) {
1136             info->write_board_setup(cpu, info);
1137         }
1138 
1139         /*
1140          * Notify devices which need to fake up firmware initialization
1141          * that we're doing a direct kernel boot.
1142          */
1143         object_child_foreach_recursive(object_get_root(),
1144                                        do_arm_linux_init, info);
1145     }
1146     info->is_linux = is_linux;
1147 
1148     for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
1149         ARM_CPU(cs)->env.boot_info = info;
1150     }
1151 }
1152 
arm_setup_firmware_boot(ARMCPU * cpu,struct arm_boot_info * info)1153 static void arm_setup_firmware_boot(ARMCPU *cpu, struct arm_boot_info *info)
1154 {
1155     /* Set up for booting firmware (which might load a kernel via fw_cfg) */
1156 
1157     if (have_dtb(info)) {
1158         /*
1159          * If we have a device tree blob, but no kernel to supply it to (or
1160          * the kernel is supposed to be loaded by the bootloader), copy the
1161          * DTB to the base of RAM for the bootloader to pick up.
1162          */
1163         info->dtb_start = info->loader_start;
1164     }
1165 
1166     if (info->kernel_filename) {
1167         FWCfgState *fw_cfg;
1168         bool try_decompressing_kernel;
1169 
1170         fw_cfg = fw_cfg_find();
1171 
1172         if (!fw_cfg) {
1173             error_report("This machine type does not support loading both "
1174                          "a guest firmware/BIOS image and a guest kernel at "
1175                          "the same time. You should change your QEMU command "
1176                          "line to specify one or the other, but not both.");
1177             exit(1);
1178         }
1179 
1180         try_decompressing_kernel = arm_feature(&cpu->env,
1181                                                ARM_FEATURE_AARCH64);
1182 
1183         /*
1184          * Expose the kernel, the command line, and the initrd in fw_cfg.
1185          * We don't process them here at all, it's all left to the
1186          * firmware.
1187          */
1188         load_image_to_fw_cfg(fw_cfg,
1189                              FW_CFG_KERNEL_SIZE, FW_CFG_KERNEL_DATA,
1190                              info->kernel_filename,
1191                              try_decompressing_kernel);
1192         load_image_to_fw_cfg(fw_cfg,
1193                              FW_CFG_INITRD_SIZE, FW_CFG_INITRD_DATA,
1194                              info->initrd_filename, false);
1195 
1196         if (info->kernel_cmdline) {
1197             fw_cfg_add_i32(fw_cfg, FW_CFG_CMDLINE_SIZE,
1198                            strlen(info->kernel_cmdline) + 1);
1199             fw_cfg_add_string(fw_cfg, FW_CFG_CMDLINE_DATA,
1200                               info->kernel_cmdline);
1201         }
1202     }
1203 
1204     /*
1205      * We will start from address 0 (typically a boot ROM image) in the
1206      * same way as hardware. Leave env->boot_info NULL, so that
1207      * do_cpu_reset() knows it does not need to alter the PC on reset.
1208      */
1209 }
1210 
arm_load_kernel(ARMCPU * cpu,MachineState * ms,struct arm_boot_info * info)1211 void arm_load_kernel(ARMCPU *cpu, MachineState *ms, struct arm_boot_info *info)
1212 {
1213     CPUState *cs;
1214     AddressSpace *as = arm_boot_address_space(cpu, info);
1215     int boot_el;
1216     CPUARMState *env = &cpu->env;
1217     int nb_cpus = 0;
1218 
1219     /*
1220      * CPU objects (unlike devices) are not automatically reset on system
1221      * reset, so we must always register a handler to do so. If we're
1222      * actually loading a kernel, the handler is also responsible for
1223      * arranging that we start it correctly.
1224      */
1225     for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
1226         qemu_register_reset(do_cpu_reset, ARM_CPU(cs));
1227         nb_cpus++;
1228     }
1229 
1230     /*
1231      * The board code is not supposed to set secure_board_setup unless
1232      * running its code in secure mode is actually possible, and KVM
1233      * doesn't support secure.
1234      */
1235     assert(!(info->secure_board_setup && kvm_enabled()));
1236     info->kernel_filename = ms->kernel_filename;
1237     info->kernel_cmdline = ms->kernel_cmdline;
1238     info->initrd_filename = ms->initrd_filename;
1239     info->dtb_filename = ms->dtb;
1240     info->dtb_limit = 0;
1241 
1242     /* Load the kernel.  */
1243     if (!info->kernel_filename || info->firmware_loaded) {
1244         arm_setup_firmware_boot(cpu, info);
1245     } else {
1246         arm_setup_direct_kernel_boot(cpu, info);
1247     }
1248 
1249     /*
1250      * Disable the PSCI conduit if it is set up to target the same
1251      * or a lower EL than the one we're going to start the guest code in.
1252      * This logic needs to agree with the code in do_cpu_reset() which
1253      * decides whether we're going to boot the guest in the highest
1254      * supported exception level or in a lower one.
1255      */
1256 
1257     /*
1258      * If PSCI is enabled, then SMC calls all go to the PSCI handler and
1259      * are never emulated to trap into guest code. It therefore does not
1260      * make sense for the board to have a setup code fragment that runs
1261      * in Secure, because this will probably need to itself issue an SMC of some
1262      * kind as part of its operation.
1263      */
1264     assert(info->psci_conduit == QEMU_PSCI_CONDUIT_DISABLED ||
1265            !info->secure_board_setup);
1266 
1267     /* Boot into highest supported EL ... */
1268     if (arm_feature(env, ARM_FEATURE_EL3)) {
1269         boot_el = 3;
1270     } else if (arm_feature(env, ARM_FEATURE_EL2)) {
1271         boot_el = 2;
1272     } else {
1273         boot_el = 1;
1274     }
1275     /* ...except that if we're booting Linux we adjust the EL we boot into */
1276     if (info->is_linux && !info->secure_boot) {
1277         boot_el = arm_feature(env, ARM_FEATURE_EL2) ? 2 : 1;
1278     }
1279 
1280     if ((info->psci_conduit == QEMU_PSCI_CONDUIT_HVC && boot_el >= 2) ||
1281         (info->psci_conduit == QEMU_PSCI_CONDUIT_SMC && boot_el == 3)) {
1282         info->psci_conduit = QEMU_PSCI_CONDUIT_DISABLED;
1283     }
1284 
1285     if (info->psci_conduit != QEMU_PSCI_CONDUIT_DISABLED) {
1286         for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
1287             Object *cpuobj = OBJECT(cs);
1288 
1289             object_property_set_int(cpuobj, "psci-conduit", info->psci_conduit,
1290                                     &error_abort);
1291             /*
1292              * Secondary CPUs start in PSCI powered-down state. Like the
1293              * code in do_cpu_reset(), we assume first_cpu is the primary
1294              * CPU.
1295              */
1296             if (cs != first_cpu) {
1297                 object_property_set_bool(cpuobj, "start-powered-off", true,
1298                                          &error_abort);
1299             }
1300         }
1301     }
1302 
1303     if (info->psci_conduit == QEMU_PSCI_CONDUIT_DISABLED &&
1304         info->is_linux && nb_cpus > 1) {
1305         /*
1306          * We're booting Linux but not using PSCI, so for SMP we need
1307          * to write a custom secondary CPU boot loader stub, and arrange
1308          * for the secondary CPU reset to make the accompanying initialization.
1309          */
1310         if (!info->secondary_cpu_reset_hook) {
1311             info->secondary_cpu_reset_hook = default_reset_secondary;
1312         }
1313         if (!info->write_secondary_boot) {
1314             info->write_secondary_boot = default_write_secondary;
1315         }
1316         info->write_secondary_boot(cpu, info);
1317     } else {
1318         /*
1319          * No secondary boot stub; don't use the reset hook that would
1320          * have set the CPU up to call it
1321          */
1322         info->write_secondary_boot = NULL;
1323         info->secondary_cpu_reset_hook = NULL;
1324     }
1325 
1326     /*
1327      * arm_load_dtb() may add a PSCI node so it must be called after we have
1328      * decided whether to enable PSCI and set the psci-conduit CPU properties.
1329      */
1330     if (!info->skip_dtb_autoload && have_dtb(info)) {
1331         if (arm_load_dtb(info->dtb_start, info, info->dtb_limit,
1332                          as, ms, cpu) < 0) {
1333             exit(1);
1334         }
1335     }
1336 }
1337 
1338 static const TypeInfo arm_linux_boot_if_info = {
1339     .name = TYPE_ARM_LINUX_BOOT_IF,
1340     .parent = TYPE_INTERFACE,
1341     .class_size = sizeof(ARMLinuxBootIfClass),
1342 };
1343 
arm_linux_boot_register_types(void)1344 static void arm_linux_boot_register_types(void)
1345 {
1346     type_register_static(&arm_linux_boot_if_info);
1347 }
1348 
1349 type_init(arm_linux_boot_register_types)
1350