1 /*
2 * ARM kernel loader.
3 *
4 * Copyright (c) 2006-2007 CodeSourcery.
5 * Written by Paul Brook
6 *
7 * This code is licensed under the GPL.
8 */
9
10 #include "qemu/osdep.h"
11 #include "qemu/datadir.h"
12 #include "qemu/error-report.h"
13 #include "qapi/error.h"
14 #include <libfdt.h>
15 #include "hw/arm/boot.h"
16 #include "hw/arm/linux-boot-if.h"
17 #include "cpu.h"
18 #include "exec/target_page.h"
19 #include "system/kvm.h"
20 #include "system/tcg.h"
21 #include "system/system.h"
22 #include "system/memory.h"
23 #include "system/numa.h"
24 #include "hw/boards.h"
25 #include "system/reset.h"
26 #include "hw/loader.h"
27 #include "elf.h"
28 #include "system/device_tree.h"
29 #include "qemu/config-file.h"
30 #include "qemu/option.h"
31 #include "qemu/units.h"
32
33 /* Kernel boot protocol is specified in the kernel docs
34 * Documentation/arm/Booting and Documentation/arm64/booting.txt
35 * They have different preferred image load offsets from system RAM base.
36 */
37 #define KERNEL_ARGS_ADDR 0x100
38 #define KERNEL_NOLOAD_ADDR 0x02000000
39 #define KERNEL_LOAD_ADDR 0x00010000
40 #define KERNEL64_LOAD_ADDR 0x00080000
41
42 #define ARM64_TEXT_OFFSET_OFFSET 8
43 #define ARM64_MAGIC_OFFSET 56
44
45 #define BOOTLOADER_MAX_SIZE (4 * KiB)
46
arm_boot_address_space(ARMCPU * cpu,const struct arm_boot_info * info)47 AddressSpace *arm_boot_address_space(ARMCPU *cpu,
48 const struct arm_boot_info *info)
49 {
50 /* Return the address space to use for bootloader reads and writes.
51 * We prefer the secure address space if the CPU has it and we're
52 * going to boot the guest into it.
53 */
54 int asidx;
55 CPUState *cs = CPU(cpu);
56
57 if (arm_feature(&cpu->env, ARM_FEATURE_EL3) && info->secure_boot) {
58 asidx = ARMASIdx_S;
59 } else {
60 asidx = ARMASIdx_NS;
61 }
62
63 return cpu_get_address_space(cs, asidx);
64 }
65
66 static const ARMInsnFixup bootloader_aarch64[] = {
67 { 0x580000c0 }, /* ldr x0, arg ; Load the lower 32-bits of DTB */
68 { 0xaa1f03e1 }, /* mov x1, xzr */
69 { 0xaa1f03e2 }, /* mov x2, xzr */
70 { 0xaa1f03e3 }, /* mov x3, xzr */
71 { 0x58000084 }, /* ldr x4, entry ; Load the lower 32-bits of kernel entry */
72 { 0xd61f0080 }, /* br x4 ; Jump to the kernel entry point */
73 { 0, FIXUP_ARGPTR_LO }, /* arg: .word @DTB Lower 32-bits */
74 { 0, FIXUP_ARGPTR_HI}, /* .word @DTB Higher 32-bits */
75 { 0, FIXUP_ENTRYPOINT_LO }, /* entry: .word @Kernel Entry Lower 32-bits */
76 { 0, FIXUP_ENTRYPOINT_HI }, /* .word @Kernel Entry Higher 32-bits */
77 { 0, FIXUP_TERMINATOR }
78 };
79
80 /* A very small bootloader: call the board-setup code (if needed),
81 * set r0-r2, then jump to the kernel.
82 * If we're not calling boot setup code then we don't copy across
83 * the first BOOTLOADER_NO_BOARD_SETUP_OFFSET insns in this array.
84 */
85
86 static const ARMInsnFixup bootloader[] = {
87 { 0xe28fe004 }, /* add lr, pc, #4 */
88 { 0xe51ff004 }, /* ldr pc, [pc, #-4] */
89 { 0, FIXUP_BOARD_SETUP },
90 #define BOOTLOADER_NO_BOARD_SETUP_OFFSET 3
91 { 0xe3a00000 }, /* mov r0, #0 */
92 { 0xe59f1004 }, /* ldr r1, [pc, #4] */
93 { 0xe59f2004 }, /* ldr r2, [pc, #4] */
94 { 0xe59ff004 }, /* ldr pc, [pc, #4] */
95 { 0, FIXUP_BOARDID },
96 { 0, FIXUP_ARGPTR_LO },
97 { 0, FIXUP_ENTRYPOINT_LO },
98 { 0, FIXUP_TERMINATOR }
99 };
100
101 /* Handling for secondary CPU boot in a multicore system.
102 * Unlike the uniprocessor/primary CPU boot, this is platform
103 * dependent. The default code here is based on the secondary
104 * CPU boot protocol used on realview/vexpress boards, with
105 * some parameterisation to increase its flexibility.
106 * QEMU platform models for which this code is not appropriate
107 * should override write_secondary_boot and secondary_cpu_reset_hook
108 * instead.
109 *
110 * This code enables the interrupt controllers for the secondary
111 * CPUs and then puts all the secondary CPUs into a loop waiting
112 * for an interprocessor interrupt and polling a configurable
113 * location for the kernel secondary CPU entry point.
114 */
115 #define DSB_INSN 0xf57ff04f
116 #define CP15_DSB_INSN 0xee070f9a /* mcr cp15, 0, r0, c7, c10, 4 */
117
118 static const ARMInsnFixup smpboot[] = {
119 { 0xe59f2028 }, /* ldr r2, gic_cpu_if */
120 { 0xe59f0028 }, /* ldr r0, bootreg_addr */
121 { 0xe3a01001 }, /* mov r1, #1 */
122 { 0xe5821000 }, /* str r1, [r2] - set GICC_CTLR.Enable */
123 { 0xe3a010ff }, /* mov r1, #0xff */
124 { 0xe5821004 }, /* str r1, [r2, 4] - set GIC_PMR.Priority to 0xff */
125 { 0, FIXUP_DSB }, /* dsb */
126 { 0xe320f003 }, /* wfi */
127 { 0xe5901000 }, /* ldr r1, [r0] */
128 { 0xe1110001 }, /* tst r1, r1 */
129 { 0x0afffffb }, /* beq <wfi> */
130 { 0xe12fff11 }, /* bx r1 */
131 { 0, FIXUP_GIC_CPU_IF }, /* gic_cpu_if: .word 0x.... */
132 { 0, FIXUP_BOOTREG }, /* bootreg_addr: .word 0x.... */
133 { 0, FIXUP_TERMINATOR }
134 };
135
arm_write_bootloader(const char * name,AddressSpace * as,hwaddr addr,const ARMInsnFixup * insns,const uint32_t * fixupcontext)136 void arm_write_bootloader(const char *name,
137 AddressSpace *as, hwaddr addr,
138 const ARMInsnFixup *insns,
139 const uint32_t *fixupcontext)
140 {
141 /* Fix up the specified bootloader fragment and write it into
142 * guest memory using rom_add_blob_fixed(). fixupcontext is
143 * an array giving the values to write in for the fixup types
144 * which write a value into the code array.
145 */
146 int i, len;
147 uint32_t *code;
148
149 len = 0;
150 while (insns[len].fixup != FIXUP_TERMINATOR) {
151 len++;
152 }
153
154 code = g_new0(uint32_t, len);
155
156 for (i = 0; i < len; i++) {
157 uint32_t insn = insns[i].insn;
158 FixupType fixup = insns[i].fixup;
159
160 switch (fixup) {
161 case FIXUP_NONE:
162 break;
163 case FIXUP_BOARDID:
164 case FIXUP_BOARD_SETUP:
165 case FIXUP_ARGPTR_LO:
166 case FIXUP_ARGPTR_HI:
167 case FIXUP_ENTRYPOINT_LO:
168 case FIXUP_ENTRYPOINT_HI:
169 case FIXUP_GIC_CPU_IF:
170 case FIXUP_BOOTREG:
171 case FIXUP_DSB:
172 insn = fixupcontext[fixup];
173 break;
174 default:
175 abort();
176 }
177 code[i] = tswap32(insn);
178 }
179
180 assert((len * sizeof(uint32_t)) < BOOTLOADER_MAX_SIZE);
181
182 rom_add_blob_fixed_as(name, code, len * sizeof(uint32_t), addr, as);
183
184 g_free(code);
185 }
186
default_write_secondary(ARMCPU * cpu,const struct arm_boot_info * info)187 static void default_write_secondary(ARMCPU *cpu,
188 const struct arm_boot_info *info)
189 {
190 uint32_t fixupcontext[FIXUP_MAX];
191 AddressSpace *as = arm_boot_address_space(cpu, info);
192
193 fixupcontext[FIXUP_GIC_CPU_IF] = info->gic_cpu_if_addr;
194 fixupcontext[FIXUP_BOOTREG] = info->smp_bootreg_addr;
195 if (arm_feature(&cpu->env, ARM_FEATURE_V7)) {
196 fixupcontext[FIXUP_DSB] = DSB_INSN;
197 } else {
198 fixupcontext[FIXUP_DSB] = CP15_DSB_INSN;
199 }
200
201 arm_write_bootloader("smpboot", as, info->smp_loader_start,
202 smpboot, fixupcontext);
203 }
204
arm_write_secure_board_setup_dummy_smc(ARMCPU * cpu,const struct arm_boot_info * info,hwaddr mvbar_addr)205 void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
206 const struct arm_boot_info *info,
207 hwaddr mvbar_addr)
208 {
209 AddressSpace *as = arm_boot_address_space(cpu, info);
210 int n;
211 uint32_t mvbar_blob[] = {
212 /* mvbar_addr: secure monitor vectors
213 * Default unimplemented and unused vectors to spin. Makes it
214 * easier to debug (as opposed to the CPU running away).
215 */
216 0xeafffffe, /* (spin) */
217 0xeafffffe, /* (spin) */
218 0xe1b0f00e, /* movs pc, lr ;SMC exception return */
219 0xeafffffe, /* (spin) */
220 0xeafffffe, /* (spin) */
221 0xeafffffe, /* (spin) */
222 0xeafffffe, /* (spin) */
223 0xeafffffe, /* (spin) */
224 };
225 uint32_t board_setup_blob[] = {
226 /* board setup addr */
227 0xee110f51, /* mrc p15, 0, r0, c1, c1, 2 ;read NSACR */
228 0xe3800b03, /* orr r0, #0xc00 ;set CP11, CP10 */
229 0xee010f51, /* mcr p15, 0, r0, c1, c1, 2 ;write NSACR */
230 0xe3a00e00 + (mvbar_addr >> 4), /* mov r0, #mvbar_addr */
231 0xee0c0f30, /* mcr p15, 0, r0, c12, c0, 1 ;set MVBAR */
232 0xee110f11, /* mrc p15, 0, r0, c1 , c1, 0 ;read SCR */
233 0xe3800031, /* orr r0, #0x31 ;enable AW, FW, NS */
234 0xee010f11, /* mcr p15, 0, r0, c1, c1, 0 ;write SCR */
235 0xe1a0100e, /* mov r1, lr ;save LR across SMC */
236 0xe1600070, /* smc #0 ;call monitor to flush SCR */
237 0xe1a0f001, /* mov pc, r1 ;return */
238 };
239
240 /* check that mvbar_addr is correctly aligned and relocatable (using MOV) */
241 assert((mvbar_addr & 0x1f) == 0 && (mvbar_addr >> 4) < 0x100);
242
243 /* check that these blobs don't overlap */
244 assert((mvbar_addr + sizeof(mvbar_blob) <= info->board_setup_addr)
245 || (info->board_setup_addr + sizeof(board_setup_blob) <= mvbar_addr));
246
247 for (n = 0; n < ARRAY_SIZE(mvbar_blob); n++) {
248 mvbar_blob[n] = tswap32(mvbar_blob[n]);
249 }
250 rom_add_blob_fixed_as("board-setup-mvbar", mvbar_blob, sizeof(mvbar_blob),
251 mvbar_addr, as);
252
253 for (n = 0; n < ARRAY_SIZE(board_setup_blob); n++) {
254 board_setup_blob[n] = tswap32(board_setup_blob[n]);
255 }
256 rom_add_blob_fixed_as("board-setup", board_setup_blob,
257 sizeof(board_setup_blob), info->board_setup_addr, as);
258 }
259
default_reset_secondary(ARMCPU * cpu,const struct arm_boot_info * info)260 static void default_reset_secondary(ARMCPU *cpu,
261 const struct arm_boot_info *info)
262 {
263 AddressSpace *as = arm_boot_address_space(cpu, info);
264 CPUState *cs = CPU(cpu);
265
266 address_space_stl_notdirty(as, info->smp_bootreg_addr,
267 0, MEMTXATTRS_UNSPECIFIED, NULL);
268 cpu_set_pc(cs, info->smp_loader_start);
269 }
270
have_dtb(const struct arm_boot_info * info)271 static inline bool have_dtb(const struct arm_boot_info *info)
272 {
273 return info->dtb_filename || info->get_dtb;
274 }
275
276 #define WRITE_WORD(p, value) do { \
277 address_space_stl_notdirty(as, p, value, \
278 MEMTXATTRS_UNSPECIFIED, NULL); \
279 p += 4; \
280 } while (0)
281
set_kernel_args(const struct arm_boot_info * info,AddressSpace * as)282 static void set_kernel_args(const struct arm_boot_info *info, AddressSpace *as)
283 {
284 int initrd_size = info->initrd_size;
285 hwaddr base = info->loader_start;
286 hwaddr p;
287
288 p = base + KERNEL_ARGS_ADDR;
289 /* ATAG_CORE */
290 WRITE_WORD(p, 5);
291 WRITE_WORD(p, 0x54410001);
292 WRITE_WORD(p, 1);
293 WRITE_WORD(p, 0x1000);
294 WRITE_WORD(p, 0);
295 /* ATAG_MEM */
296 /* TODO: handle multiple chips on one ATAG list */
297 WRITE_WORD(p, 4);
298 WRITE_WORD(p, 0x54410002);
299 WRITE_WORD(p, info->ram_size);
300 WRITE_WORD(p, info->loader_start);
301 if (initrd_size) {
302 /* ATAG_INITRD2 */
303 WRITE_WORD(p, 4);
304 WRITE_WORD(p, 0x54420005);
305 WRITE_WORD(p, info->initrd_start);
306 WRITE_WORD(p, initrd_size);
307 }
308 if (info->kernel_cmdline && *info->kernel_cmdline) {
309 /* ATAG_CMDLINE */
310 int cmdline_size;
311
312 cmdline_size = strlen(info->kernel_cmdline);
313 address_space_write(as, p + 8, MEMTXATTRS_UNSPECIFIED,
314 info->kernel_cmdline, cmdline_size + 1);
315 cmdline_size = (cmdline_size >> 2) + 1;
316 WRITE_WORD(p, cmdline_size + 2);
317 WRITE_WORD(p, 0x54410009);
318 p += cmdline_size * 4;
319 }
320 if (info->atag_board) {
321 /* ATAG_BOARD */
322 int atag_board_len;
323 uint8_t atag_board_buf[0x1000];
324
325 atag_board_len = (info->atag_board(info, atag_board_buf) + 3) & ~3;
326 WRITE_WORD(p, (atag_board_len + 8) >> 2);
327 WRITE_WORD(p, 0x414f4d50);
328 address_space_write(as, p, MEMTXATTRS_UNSPECIFIED,
329 atag_board_buf, atag_board_len);
330 p += atag_board_len;
331 }
332 /* ATAG_END */
333 WRITE_WORD(p, 0);
334 WRITE_WORD(p, 0);
335 }
336
set_kernel_args_old(const struct arm_boot_info * info,AddressSpace * as)337 static void set_kernel_args_old(const struct arm_boot_info *info,
338 AddressSpace *as)
339 {
340 hwaddr p;
341 const char *s;
342 int initrd_size = info->initrd_size;
343 hwaddr base = info->loader_start;
344
345 /* see linux/include/asm-arm/setup.h */
346 p = base + KERNEL_ARGS_ADDR;
347 /* page_size */
348 WRITE_WORD(p, 4096);
349 /* nr_pages */
350 WRITE_WORD(p, info->ram_size / 4096);
351 /* ramdisk_size */
352 WRITE_WORD(p, 0);
353 #define FLAG_READONLY 1
354 #define FLAG_RDLOAD 4
355 #define FLAG_RDPROMPT 8
356 /* flags */
357 WRITE_WORD(p, FLAG_READONLY | FLAG_RDLOAD | FLAG_RDPROMPT);
358 /* rootdev */
359 WRITE_WORD(p, (31 << 8) | 0); /* /dev/mtdblock0 */
360 /* video_num_cols */
361 WRITE_WORD(p, 0);
362 /* video_num_rows */
363 WRITE_WORD(p, 0);
364 /* video_x */
365 WRITE_WORD(p, 0);
366 /* video_y */
367 WRITE_WORD(p, 0);
368 /* memc_control_reg */
369 WRITE_WORD(p, 0);
370 /* unsigned char sounddefault */
371 /* unsigned char adfsdrives */
372 /* unsigned char bytes_per_char_h */
373 /* unsigned char bytes_per_char_v */
374 WRITE_WORD(p, 0);
375 /* pages_in_bank[4] */
376 WRITE_WORD(p, 0);
377 WRITE_WORD(p, 0);
378 WRITE_WORD(p, 0);
379 WRITE_WORD(p, 0);
380 /* pages_in_vram */
381 WRITE_WORD(p, 0);
382 /* initrd_start */
383 if (initrd_size) {
384 WRITE_WORD(p, info->initrd_start);
385 } else {
386 WRITE_WORD(p, 0);
387 }
388 /* initrd_size */
389 WRITE_WORD(p, initrd_size);
390 /* rd_start */
391 WRITE_WORD(p, 0);
392 /* system_rev */
393 WRITE_WORD(p, 0);
394 /* system_serial_low */
395 WRITE_WORD(p, 0);
396 /* system_serial_high */
397 WRITE_WORD(p, 0);
398 /* mem_fclk_21285 */
399 WRITE_WORD(p, 0);
400 /* zero unused fields */
401 while (p < base + KERNEL_ARGS_ADDR + 256 + 1024) {
402 WRITE_WORD(p, 0);
403 }
404 s = info->kernel_cmdline;
405 if (s) {
406 address_space_write(as, p, MEMTXATTRS_UNSPECIFIED, s, strlen(s) + 1);
407 } else {
408 WRITE_WORD(p, 0);
409 }
410 }
411
fdt_add_memory_node(void * fdt,uint32_t acells,hwaddr mem_base,uint32_t scells,hwaddr mem_len,int numa_node_id)412 static int fdt_add_memory_node(void *fdt, uint32_t acells, hwaddr mem_base,
413 uint32_t scells, hwaddr mem_len,
414 int numa_node_id)
415 {
416 char *nodename;
417 int ret;
418
419 nodename = g_strdup_printf("/memory@%" PRIx64, mem_base);
420 qemu_fdt_add_subnode(fdt, nodename);
421 qemu_fdt_setprop_string(fdt, nodename, "device_type", "memory");
422 ret = qemu_fdt_setprop_sized_cells(fdt, nodename, "reg", acells, mem_base,
423 scells, mem_len);
424 if (ret < 0) {
425 goto out;
426 }
427
428 /* only set the NUMA ID if it is specified */
429 if (numa_node_id >= 0) {
430 ret = qemu_fdt_setprop_cell(fdt, nodename,
431 "numa-node-id", numa_node_id);
432 }
433 out:
434 g_free(nodename);
435 return ret;
436 }
437
fdt_add_psci_node(void * fdt,ARMCPU * armcpu)438 static void fdt_add_psci_node(void *fdt, ARMCPU *armcpu)
439 {
440 uint32_t cpu_suspend_fn;
441 uint32_t cpu_off_fn;
442 uint32_t cpu_on_fn;
443 uint32_t migrate_fn;
444 const char *psci_method;
445 int64_t psci_conduit;
446 int rc;
447
448 psci_conduit = object_property_get_int(OBJECT(armcpu),
449 "psci-conduit",
450 &error_abort);
451 switch (psci_conduit) {
452 case QEMU_PSCI_CONDUIT_DISABLED:
453 return;
454 case QEMU_PSCI_CONDUIT_HVC:
455 psci_method = "hvc";
456 break;
457 case QEMU_PSCI_CONDUIT_SMC:
458 psci_method = "smc";
459 break;
460 default:
461 g_assert_not_reached();
462 }
463
464 /*
465 * A pre-existing /psci node might specify function ID values
466 * that don't match QEMU's PSCI implementation. Delete the whole
467 * node and put our own in instead.
468 */
469 rc = fdt_path_offset(fdt, "/psci");
470 if (rc >= 0) {
471 qemu_fdt_nop_node(fdt, "/psci");
472 }
473
474 qemu_fdt_add_subnode(fdt, "/psci");
475 if (armcpu->psci_version >= QEMU_PSCI_VERSION_0_2) {
476 if (armcpu->psci_version < QEMU_PSCI_VERSION_1_0) {
477 const char comp[] = "arm,psci-0.2\0arm,psci";
478 qemu_fdt_setprop(fdt, "/psci", "compatible", comp, sizeof(comp));
479 } else {
480 const char comp[] = "arm,psci-1.0\0arm,psci-0.2\0arm,psci";
481 qemu_fdt_setprop(fdt, "/psci", "compatible", comp, sizeof(comp));
482 }
483
484 cpu_off_fn = QEMU_PSCI_0_2_FN_CPU_OFF;
485 if (arm_feature(&armcpu->env, ARM_FEATURE_AARCH64)) {
486 cpu_suspend_fn = QEMU_PSCI_0_2_FN64_CPU_SUSPEND;
487 cpu_on_fn = QEMU_PSCI_0_2_FN64_CPU_ON;
488 migrate_fn = QEMU_PSCI_0_2_FN64_MIGRATE;
489 } else {
490 cpu_suspend_fn = QEMU_PSCI_0_2_FN_CPU_SUSPEND;
491 cpu_on_fn = QEMU_PSCI_0_2_FN_CPU_ON;
492 migrate_fn = QEMU_PSCI_0_2_FN_MIGRATE;
493 }
494 } else {
495 qemu_fdt_setprop_string(fdt, "/psci", "compatible", "arm,psci");
496
497 cpu_suspend_fn = QEMU_PSCI_0_1_FN_CPU_SUSPEND;
498 cpu_off_fn = QEMU_PSCI_0_1_FN_CPU_OFF;
499 cpu_on_fn = QEMU_PSCI_0_1_FN_CPU_ON;
500 migrate_fn = QEMU_PSCI_0_1_FN_MIGRATE;
501 }
502
503 /* We adopt the PSCI spec's nomenclature, and use 'conduit' to refer
504 * to the instruction that should be used to invoke PSCI functions.
505 * However, the device tree binding uses 'method' instead, so that is
506 * what we should use here.
507 */
508 qemu_fdt_setprop_string(fdt, "/psci", "method", psci_method);
509
510 qemu_fdt_setprop_cell(fdt, "/psci", "cpu_suspend", cpu_suspend_fn);
511 qemu_fdt_setprop_cell(fdt, "/psci", "cpu_off", cpu_off_fn);
512 qemu_fdt_setprop_cell(fdt, "/psci", "cpu_on", cpu_on_fn);
513 qemu_fdt_setprop_cell(fdt, "/psci", "migrate", migrate_fn);
514 }
515
arm_load_dtb(hwaddr addr,const struct arm_boot_info * binfo,hwaddr addr_limit,AddressSpace * as,MachineState * ms,ARMCPU * cpu)516 int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
517 hwaddr addr_limit, AddressSpace *as, MachineState *ms,
518 ARMCPU *cpu)
519 {
520 void *fdt = NULL;
521 int size, rc, n = 0;
522 uint32_t acells, scells;
523 unsigned int i;
524 hwaddr mem_base, mem_len;
525 char **node_path;
526 Error *err = NULL;
527
528 if (binfo->dtb_filename) {
529 char *filename;
530 filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, binfo->dtb_filename);
531 if (!filename) {
532 fprintf(stderr, "Couldn't open dtb file %s\n", binfo->dtb_filename);
533 goto fail;
534 }
535
536 fdt = load_device_tree(filename, &size);
537 if (!fdt) {
538 fprintf(stderr, "Couldn't open dtb file %s\n", filename);
539 g_free(filename);
540 goto fail;
541 }
542 g_free(filename);
543 } else {
544 fdt = binfo->get_dtb(binfo, &size);
545 if (!fdt) {
546 fprintf(stderr, "Board was unable to create a dtb blob\n");
547 goto fail;
548 }
549 }
550
551 if (addr_limit > addr && size > (addr_limit - addr)) {
552 /* Installing the device tree blob at addr would exceed addr_limit.
553 * Whether this constitutes failure is up to the caller to decide,
554 * so just return 0 as size, i.e., no error.
555 */
556 g_free(fdt);
557 return 0;
558 }
559
560 acells = qemu_fdt_getprop_cell(fdt, "/", "#address-cells",
561 NULL, &error_fatal);
562 scells = qemu_fdt_getprop_cell(fdt, "/", "#size-cells",
563 NULL, &error_fatal);
564 if (acells == 0 || scells == 0) {
565 fprintf(stderr, "dtb file invalid (#address-cells or #size-cells 0)\n");
566 goto fail;
567 }
568
569 if (scells < 2 && binfo->ram_size >= 4 * GiB) {
570 /* This is user error so deserves a friendlier error message
571 * than the failure of setprop_sized_cells would provide
572 */
573 fprintf(stderr, "qemu: dtb file not compatible with "
574 "RAM size > 4GB\n");
575 goto fail;
576 }
577
578 /* nop all root nodes matching /memory or /memory@unit-address */
579 node_path = qemu_fdt_node_unit_path(fdt, "memory", &err);
580 if (err) {
581 error_report_err(err);
582 goto fail;
583 }
584 while (node_path[n]) {
585 if (g_str_has_prefix(node_path[n], "/memory")) {
586 qemu_fdt_nop_node(fdt, node_path[n]);
587 }
588 n++;
589 }
590 g_strfreev(node_path);
591
592 /*
593 * We drop all the memory nodes which correspond to empty NUMA nodes
594 * from the device tree, because the Linux NUMA binding document
595 * states they should not be generated. Linux will get the NUMA node
596 * IDs of the empty NUMA nodes from the distance map if they are needed.
597 * This means QEMU users may be obliged to provide command lines which
598 * configure distance maps when the empty NUMA node IDs are needed and
599 * Linux's default distance map isn't sufficient.
600 */
601 if (ms->numa_state != NULL && ms->numa_state->num_nodes > 0) {
602 mem_base = binfo->loader_start;
603 for (i = 0; i < ms->numa_state->num_nodes; i++) {
604 mem_len = ms->numa_state->nodes[i].node_mem;
605 if (!mem_len) {
606 continue;
607 }
608
609 rc = fdt_add_memory_node(fdt, acells, mem_base,
610 scells, mem_len, i);
611 if (rc < 0) {
612 fprintf(stderr, "couldn't add /memory@%"PRIx64" node\n",
613 mem_base);
614 goto fail;
615 }
616
617 mem_base += mem_len;
618 }
619 } else {
620 rc = fdt_add_memory_node(fdt, acells, binfo->loader_start,
621 scells, binfo->ram_size, -1);
622 if (rc < 0) {
623 fprintf(stderr, "couldn't add /memory@%"PRIx64" node\n",
624 binfo->loader_start);
625 goto fail;
626 }
627 }
628
629 rc = fdt_path_offset(fdt, "/chosen");
630 if (rc < 0) {
631 qemu_fdt_add_subnode(fdt, "/chosen");
632 }
633
634 if (ms->kernel_cmdline && *ms->kernel_cmdline) {
635 rc = qemu_fdt_setprop_string(fdt, "/chosen", "bootargs",
636 ms->kernel_cmdline);
637 if (rc < 0) {
638 fprintf(stderr, "couldn't set /chosen/bootargs\n");
639 goto fail;
640 }
641 }
642
643 if (binfo->initrd_size) {
644 rc = qemu_fdt_setprop_sized_cells(fdt, "/chosen", "linux,initrd-start",
645 acells, binfo->initrd_start);
646 if (rc < 0) {
647 fprintf(stderr, "couldn't set /chosen/linux,initrd-start\n");
648 goto fail;
649 }
650
651 rc = qemu_fdt_setprop_sized_cells(fdt, "/chosen", "linux,initrd-end",
652 acells,
653 binfo->initrd_start +
654 binfo->initrd_size);
655 if (rc < 0) {
656 fprintf(stderr, "couldn't set /chosen/linux,initrd-end\n");
657 goto fail;
658 }
659 }
660
661 fdt_add_psci_node(fdt, cpu);
662
663 if (binfo->modify_dtb) {
664 binfo->modify_dtb(binfo, fdt);
665 }
666
667 /* Put the DTB into the memory map as a ROM image: this will ensure
668 * the DTB is copied again upon reset, even if addr points into RAM.
669 */
670 rom_add_blob_fixed_as("dtb", fdt, size, addr, as);
671 qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
672 rom_ptr_for_as(as, addr, size));
673
674 if (fdt != ms->fdt) {
675 g_free(ms->fdt);
676 ms->fdt = fdt;
677 }
678
679 return size;
680
681 fail:
682 g_free(fdt);
683 return -1;
684 }
685
do_cpu_reset(void * opaque)686 static void do_cpu_reset(void *opaque)
687 {
688 ARMCPU *cpu = opaque;
689 CPUState *cs = CPU(cpu);
690 CPUARMState *env = &cpu->env;
691 const struct arm_boot_info *info = env->boot_info;
692
693 cpu_reset(cs);
694 if (info) {
695 if (!info->is_linux) {
696 int i;
697 /* Jump to the entry point. */
698 uint64_t entry = info->entry;
699
700 switch (info->endianness) {
701 case ARM_ENDIANNESS_LE:
702 env->cp15.sctlr_el[1] &= ~SCTLR_E0E;
703 for (i = 1; i < 4; ++i) {
704 env->cp15.sctlr_el[i] &= ~SCTLR_EE;
705 }
706 env->uncached_cpsr &= ~CPSR_E;
707 break;
708 case ARM_ENDIANNESS_BE8:
709 env->cp15.sctlr_el[1] |= SCTLR_E0E;
710 for (i = 1; i < 4; ++i) {
711 env->cp15.sctlr_el[i] |= SCTLR_EE;
712 }
713 env->uncached_cpsr |= CPSR_E;
714 break;
715 case ARM_ENDIANNESS_BE32:
716 env->cp15.sctlr_el[1] |= SCTLR_B;
717 break;
718 case ARM_ENDIANNESS_UNKNOWN:
719 break; /* Board's decision */
720 default:
721 g_assert_not_reached();
722 }
723
724 cpu_set_pc(cs, entry);
725 } else {
726 /*
727 * If we are booting Linux then we might need to do so at:
728 * - AArch64 NS EL2 or NS EL1
729 * - AArch32 Secure SVC (EL3)
730 * - AArch32 NS Hyp (EL2)
731 * - AArch32 NS SVC (EL1)
732 * Configure the CPU in the way boot firmware would do to
733 * drop us down to the appropriate level.
734 */
735 int target_el = arm_feature(env, ARM_FEATURE_EL2) ? 2 : 1;
736
737 if (env->aarch64) {
738 /*
739 * AArch64 kernels never boot in secure mode, and we don't
740 * support the secure_board_setup hook for AArch64.
741 */
742 assert(!info->secure_boot);
743 assert(!info->secure_board_setup);
744 } else {
745 if (arm_feature(env, ARM_FEATURE_EL3) &&
746 (info->secure_boot ||
747 (info->secure_board_setup && cs == first_cpu))) {
748 /* Start this CPU in Secure SVC */
749 target_el = 3;
750 }
751 }
752
753 arm_emulate_firmware_reset(cs, target_el);
754
755 if (cs == first_cpu) {
756 AddressSpace *as = arm_boot_address_space(cpu, info);
757
758 cpu_set_pc(cs, info->loader_start);
759
760 if (!have_dtb(info)) {
761 if (old_param) {
762 set_kernel_args_old(info, as);
763 } else {
764 set_kernel_args(info, as);
765 }
766 }
767 } else if (info->secondary_cpu_reset_hook) {
768 info->secondary_cpu_reset_hook(cpu, info);
769 }
770 }
771
772 if (tcg_enabled()) {
773 arm_rebuild_hflags(env);
774 }
775 }
776 }
777
do_arm_linux_init(Object * obj,void * opaque)778 static int do_arm_linux_init(Object *obj, void *opaque)
779 {
780 if (object_dynamic_cast(obj, TYPE_ARM_LINUX_BOOT_IF)) {
781 ARMLinuxBootIf *albif = ARM_LINUX_BOOT_IF(obj);
782 ARMLinuxBootIfClass *albifc = ARM_LINUX_BOOT_IF_GET_CLASS(obj);
783 struct arm_boot_info *info = opaque;
784
785 if (albifc->arm_linux_init) {
786 albifc->arm_linux_init(albif, info->secure_boot);
787 }
788 }
789 return 0;
790 }
791
arm_load_elf(struct arm_boot_info * info,uint64_t * pentry,uint64_t * lowaddr,uint64_t * highaddr,int elf_machine,AddressSpace * as)792 static ssize_t arm_load_elf(struct arm_boot_info *info, uint64_t *pentry,
793 uint64_t *lowaddr, uint64_t *highaddr,
794 int elf_machine, AddressSpace *as)
795 {
796 bool elf_is64;
797 union {
798 Elf32_Ehdr h32;
799 Elf64_Ehdr h64;
800 } elf_header;
801 int data_swab = 0;
802 int elf_data_order;
803 ssize_t ret;
804 Error *err = NULL;
805
806
807 load_elf_hdr(info->kernel_filename, &elf_header, &elf_is64, &err);
808 if (err) {
809 /*
810 * If the file is not an ELF file we silently return.
811 * The caller will fall back to try other formats.
812 */
813 error_free(err);
814 return -1;
815 }
816
817 if (elf_is64) {
818 elf_data_order = elf_header.h64.e_ident[EI_DATA];
819 info->endianness = elf_data_order == ELFDATA2MSB ? ARM_ENDIANNESS_BE8
820 : ARM_ENDIANNESS_LE;
821 } else {
822 elf_data_order = elf_header.h32.e_ident[EI_DATA];
823 if (elf_data_order == ELFDATA2MSB) {
824 if (bswap32(elf_header.h32.e_flags) & EF_ARM_BE8) {
825 info->endianness = ARM_ENDIANNESS_BE8;
826 } else {
827 info->endianness = ARM_ENDIANNESS_BE32;
828 /* In BE32, the CPU has a different view of the per-byte
829 * address map than the rest of the system. BE32 ELF files
830 * are organised such that they can be programmed through
831 * the CPU's per-word byte-reversed view of the world. QEMU
832 * however loads ELF files independently of the CPU. So
833 * tell the ELF loader to byte reverse the data for us.
834 */
835 data_swab = 2;
836 }
837 } else {
838 info->endianness = ARM_ENDIANNESS_LE;
839 }
840 }
841
842 ret = load_elf_as(info->kernel_filename, NULL, NULL, NULL,
843 pentry, lowaddr, highaddr, NULL, elf_data_order,
844 elf_machine, 1, data_swab, as);
845 if (ret <= 0) {
846 /* The header loaded but the image didn't */
847 error_report("Couldn't load elf '%s': %s",
848 info->kernel_filename, load_elf_strerror(ret));
849 exit(1);
850 }
851
852 return ret;
853 }
854
load_aarch64_image(const char * filename,hwaddr mem_base,hwaddr * entry,AddressSpace * as)855 static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
856 hwaddr *entry, AddressSpace *as)
857 {
858 hwaddr kernel_load_offset = KERNEL64_LOAD_ADDR;
859 uint64_t kernel_size = 0;
860 uint8_t *buffer;
861 ssize_t size;
862
863 /* On aarch64, it's the bootloader's job to uncompress the kernel. */
864 size = load_image_gzipped_buffer(filename, LOAD_IMAGE_MAX_GUNZIP_BYTES,
865 &buffer);
866
867 if (size < 0) {
868 gsize len;
869
870 /* Load as raw file otherwise */
871 if (!g_file_get_contents(filename, (char **)&buffer, &len, NULL)) {
872 return -1;
873 }
874 size = len;
875
876 /* Unpack the image if it is a EFI zboot image */
877 if (unpack_efi_zboot_image(&buffer, &size) < 0) {
878 g_free(buffer);
879 return -1;
880 }
881 }
882
883 /* check the arm64 magic header value -- very old kernels may not have it */
884 if (size > ARM64_MAGIC_OFFSET + 4 &&
885 memcmp(buffer + ARM64_MAGIC_OFFSET, "ARM\x64", 4) == 0) {
886 uint64_t hdrvals[2];
887
888 /* The arm64 Image header has text_offset and image_size fields at 8 and
889 * 16 bytes into the Image header, respectively. The text_offset field
890 * is only valid if the image_size is non-zero.
891 */
892 memcpy(&hdrvals, buffer + ARM64_TEXT_OFFSET_OFFSET, sizeof(hdrvals));
893
894 kernel_size = le64_to_cpu(hdrvals[1]);
895
896 if (kernel_size != 0) {
897 kernel_load_offset = le64_to_cpu(hdrvals[0]);
898
899 /*
900 * We write our startup "bootloader" at the very bottom of RAM,
901 * so that bit can't be used for the image. Luckily the Image
902 * format specification is that the image requests only an offset
903 * from a 2MB boundary, not an absolute load address. So if the
904 * image requests an offset that might mean it overlaps with the
905 * bootloader, we can just load it starting at 2MB+offset rather
906 * than 0MB + offset.
907 */
908 if (kernel_load_offset < BOOTLOADER_MAX_SIZE) {
909 kernel_load_offset += 2 * MiB;
910 }
911 }
912 }
913
914 /*
915 * Kernels before v3.17 don't populate the image_size field, and
916 * raw images have no header. For those our best guess at the size
917 * is the size of the Image file itself.
918 */
919 if (kernel_size == 0) {
920 kernel_size = size;
921 }
922
923 *entry = mem_base + kernel_load_offset;
924 rom_add_blob_fixed_as(filename, buffer, size, *entry, as);
925
926 g_free(buffer);
927
928 return kernel_size;
929 }
930
arm_setup_direct_kernel_boot(ARMCPU * cpu,struct arm_boot_info * info)931 static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
932 struct arm_boot_info *info)
933 {
934 /* Set up for a direct boot of a kernel image file. */
935 CPUState *cs;
936 AddressSpace *as = arm_boot_address_space(cpu, info);
937 ssize_t kernel_size;
938 int initrd_size;
939 int is_linux = 0;
940 uint64_t elf_entry;
941 /* Addresses of first byte used and first byte not used by the image */
942 uint64_t image_low_addr = 0, image_high_addr = 0;
943 int elf_machine;
944 hwaddr entry;
945 static const ARMInsnFixup *primary_loader;
946 uint64_t ram_end = info->loader_start + info->ram_size;
947
948 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
949 primary_loader = bootloader_aarch64;
950 elf_machine = EM_AARCH64;
951 } else {
952 primary_loader = bootloader;
953 if (!info->write_board_setup) {
954 primary_loader += BOOTLOADER_NO_BOARD_SETUP_OFFSET;
955 }
956 elf_machine = EM_ARM;
957 }
958
959 /* Assume that raw images are linux kernels, and ELF images are not. */
960 kernel_size = arm_load_elf(info, &elf_entry, &image_low_addr,
961 &image_high_addr, elf_machine, as);
962 if (kernel_size > 0 && have_dtb(info)) {
963 /*
964 * If there is still some room left at the base of RAM, try and put
965 * the DTB there like we do for images loaded with -bios or -pflash.
966 */
967 if (image_low_addr > info->loader_start
968 || image_high_addr < info->loader_start) {
969 /*
970 * Set image_low_addr as address limit for arm_load_dtb if it may be
971 * pointing into RAM, otherwise pass '0' (no limit)
972 */
973 if (image_low_addr < info->loader_start) {
974 image_low_addr = 0;
975 }
976 info->dtb_start = info->loader_start;
977 info->dtb_limit = image_low_addr;
978 }
979 }
980 entry = elf_entry;
981 if (kernel_size < 0) {
982 uint64_t loadaddr = info->loader_start + KERNEL_NOLOAD_ADDR;
983 kernel_size = load_uimage_as(info->kernel_filename, &entry, &loadaddr,
984 &is_linux, NULL, NULL, as);
985 if (kernel_size >= 0) {
986 image_low_addr = loadaddr;
987 image_high_addr = image_low_addr + kernel_size;
988 }
989 }
990 if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64) && kernel_size < 0) {
991 kernel_size = load_aarch64_image(info->kernel_filename,
992 info->loader_start, &entry, as);
993 is_linux = 1;
994 if (kernel_size >= 0) {
995 image_low_addr = entry;
996 image_high_addr = image_low_addr + kernel_size;
997 }
998 } else if (kernel_size < 0) {
999 /* 32-bit ARM */
1000 entry = info->loader_start + KERNEL_LOAD_ADDR;
1001 kernel_size = load_image_targphys_as(info->kernel_filename, entry,
1002 ram_end - KERNEL_LOAD_ADDR, as);
1003 is_linux = 1;
1004 if (kernel_size >= 0) {
1005 image_low_addr = entry;
1006 image_high_addr = image_low_addr + kernel_size;
1007 }
1008 }
1009 if (kernel_size < 0) {
1010 error_report("could not load kernel '%s'", info->kernel_filename);
1011 exit(1);
1012 }
1013
1014 if (kernel_size > info->ram_size) {
1015 error_report("kernel '%s' is too large to fit in RAM "
1016 "(kernel size %zd, RAM size %" PRId64 ")",
1017 info->kernel_filename, kernel_size, info->ram_size);
1018 exit(1);
1019 }
1020
1021 info->entry = entry;
1022
1023 /*
1024 * We want to put the initrd far enough into RAM that when the
1025 * kernel is uncompressed it will not clobber the initrd. However
1026 * on boards without much RAM we must ensure that we still leave
1027 * enough room for a decent sized initrd, and on boards with large
1028 * amounts of RAM we must avoid the initrd being so far up in RAM
1029 * that it is outside lowmem and inaccessible to the kernel.
1030 * So for boards with less than 256MB of RAM we put the initrd
1031 * halfway into RAM, and for boards with 256MB of RAM or more we put
1032 * the initrd at 128MB.
1033 * We also refuse to put the initrd somewhere that will definitely
1034 * overlay the kernel we just loaded, though for kernel formats which
1035 * don't tell us their exact size (eg self-decompressing 32-bit kernels)
1036 * we might still make a bad choice here.
1037 */
1038 info->initrd_start = info->loader_start +
1039 MIN(info->ram_size / 2, 128 * MiB);
1040 if (image_high_addr) {
1041 info->initrd_start = MAX(info->initrd_start, image_high_addr);
1042 }
1043 info->initrd_start = TARGET_PAGE_ALIGN(info->initrd_start);
1044
1045 if (is_linux) {
1046 uint32_t fixupcontext[FIXUP_MAX];
1047
1048 if (info->initrd_filename) {
1049
1050 if (info->initrd_start >= ram_end) {
1051 error_report("not enough space after kernel to load initrd");
1052 exit(1);
1053 }
1054
1055 initrd_size = load_ramdisk_as(info->initrd_filename,
1056 info->initrd_start,
1057 ram_end - info->initrd_start, as);
1058 if (initrd_size < 0) {
1059 initrd_size = load_image_targphys_as(info->initrd_filename,
1060 info->initrd_start,
1061 ram_end -
1062 info->initrd_start,
1063 as);
1064 }
1065 if (initrd_size < 0) {
1066 error_report("could not load initrd '%s'",
1067 info->initrd_filename);
1068 exit(1);
1069 }
1070 if (info->initrd_start + initrd_size > ram_end) {
1071 error_report("could not load initrd '%s': "
1072 "too big to fit into RAM after the kernel",
1073 info->initrd_filename);
1074 exit(1);
1075 }
1076 } else {
1077 initrd_size = 0;
1078 }
1079 info->initrd_size = initrd_size;
1080
1081 fixupcontext[FIXUP_BOARDID] = info->board_id;
1082 fixupcontext[FIXUP_BOARD_SETUP] = info->board_setup_addr;
1083
1084 /*
1085 * for device tree boot, we pass the DTB directly in r2. Otherwise
1086 * we point to the kernel args.
1087 */
1088 if (have_dtb(info)) {
1089 hwaddr align;
1090
1091 if (elf_machine == EM_AARCH64) {
1092 /*
1093 * Some AArch64 kernels on early bootup map the fdt region as
1094 *
1095 * [ ALIGN_DOWN(fdt, 2MB) ... ALIGN_DOWN(fdt, 2MB) + 2MB ]
1096 *
1097 * Let's play safe and prealign it to 2MB to give us some space.
1098 */
1099 align = 2 * MiB;
1100 } else {
1101 /*
1102 * Some 32bit kernels will trash anything in the 4K page the
1103 * initrd ends in, so make sure the DTB isn't caught up in that.
1104 */
1105 align = 4 * KiB;
1106 }
1107
1108 /* Place the DTB after the initrd in memory with alignment. */
1109 info->dtb_start = QEMU_ALIGN_UP(info->initrd_start + initrd_size,
1110 align);
1111 if (info->dtb_start >= ram_end) {
1112 error_report("Not enough space for DTB after kernel/initrd");
1113 exit(1);
1114 }
1115 fixupcontext[FIXUP_ARGPTR_LO] = info->dtb_start;
1116 fixupcontext[FIXUP_ARGPTR_HI] = info->dtb_start >> 32;
1117 } else {
1118 fixupcontext[FIXUP_ARGPTR_LO] =
1119 info->loader_start + KERNEL_ARGS_ADDR;
1120 fixupcontext[FIXUP_ARGPTR_HI] =
1121 (info->loader_start + KERNEL_ARGS_ADDR) >> 32;
1122 if (info->ram_size >= 4 * GiB) {
1123 error_report("RAM size must be less than 4GB to boot"
1124 " Linux kernel using ATAGS (try passing a device tree"
1125 " using -dtb)");
1126 exit(1);
1127 }
1128 }
1129 fixupcontext[FIXUP_ENTRYPOINT_LO] = entry;
1130 fixupcontext[FIXUP_ENTRYPOINT_HI] = entry >> 32;
1131
1132 arm_write_bootloader("bootloader", as, info->loader_start,
1133 primary_loader, fixupcontext);
1134
1135 if (info->write_board_setup) {
1136 info->write_board_setup(cpu, info);
1137 }
1138
1139 /*
1140 * Notify devices which need to fake up firmware initialization
1141 * that we're doing a direct kernel boot.
1142 */
1143 object_child_foreach_recursive(object_get_root(),
1144 do_arm_linux_init, info);
1145 }
1146 info->is_linux = is_linux;
1147
1148 for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
1149 ARM_CPU(cs)->env.boot_info = info;
1150 }
1151 }
1152
arm_setup_firmware_boot(ARMCPU * cpu,struct arm_boot_info * info)1153 static void arm_setup_firmware_boot(ARMCPU *cpu, struct arm_boot_info *info)
1154 {
1155 /* Set up for booting firmware (which might load a kernel via fw_cfg) */
1156
1157 if (have_dtb(info)) {
1158 /*
1159 * If we have a device tree blob, but no kernel to supply it to (or
1160 * the kernel is supposed to be loaded by the bootloader), copy the
1161 * DTB to the base of RAM for the bootloader to pick up.
1162 */
1163 info->dtb_start = info->loader_start;
1164 }
1165
1166 if (info->kernel_filename) {
1167 FWCfgState *fw_cfg;
1168 bool try_decompressing_kernel;
1169
1170 fw_cfg = fw_cfg_find();
1171
1172 if (!fw_cfg) {
1173 error_report("This machine type does not support loading both "
1174 "a guest firmware/BIOS image and a guest kernel at "
1175 "the same time. You should change your QEMU command "
1176 "line to specify one or the other, but not both.");
1177 exit(1);
1178 }
1179
1180 try_decompressing_kernel = arm_feature(&cpu->env,
1181 ARM_FEATURE_AARCH64);
1182
1183 /*
1184 * Expose the kernel, the command line, and the initrd in fw_cfg.
1185 * We don't process them here at all, it's all left to the
1186 * firmware.
1187 */
1188 load_image_to_fw_cfg(fw_cfg,
1189 FW_CFG_KERNEL_SIZE, FW_CFG_KERNEL_DATA,
1190 info->kernel_filename,
1191 try_decompressing_kernel);
1192 load_image_to_fw_cfg(fw_cfg,
1193 FW_CFG_INITRD_SIZE, FW_CFG_INITRD_DATA,
1194 info->initrd_filename, false);
1195
1196 if (info->kernel_cmdline) {
1197 fw_cfg_add_i32(fw_cfg, FW_CFG_CMDLINE_SIZE,
1198 strlen(info->kernel_cmdline) + 1);
1199 fw_cfg_add_string(fw_cfg, FW_CFG_CMDLINE_DATA,
1200 info->kernel_cmdline);
1201 }
1202 }
1203
1204 /*
1205 * We will start from address 0 (typically a boot ROM image) in the
1206 * same way as hardware. Leave env->boot_info NULL, so that
1207 * do_cpu_reset() knows it does not need to alter the PC on reset.
1208 */
1209 }
1210
arm_load_kernel(ARMCPU * cpu,MachineState * ms,struct arm_boot_info * info)1211 void arm_load_kernel(ARMCPU *cpu, MachineState *ms, struct arm_boot_info *info)
1212 {
1213 CPUState *cs;
1214 AddressSpace *as = arm_boot_address_space(cpu, info);
1215 int boot_el;
1216 CPUARMState *env = &cpu->env;
1217 int nb_cpus = 0;
1218
1219 /*
1220 * CPU objects (unlike devices) are not automatically reset on system
1221 * reset, so we must always register a handler to do so. If we're
1222 * actually loading a kernel, the handler is also responsible for
1223 * arranging that we start it correctly.
1224 */
1225 for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
1226 qemu_register_reset(do_cpu_reset, ARM_CPU(cs));
1227 nb_cpus++;
1228 }
1229
1230 /*
1231 * The board code is not supposed to set secure_board_setup unless
1232 * running its code in secure mode is actually possible, and KVM
1233 * doesn't support secure.
1234 */
1235 assert(!(info->secure_board_setup && kvm_enabled()));
1236 info->kernel_filename = ms->kernel_filename;
1237 info->kernel_cmdline = ms->kernel_cmdline;
1238 info->initrd_filename = ms->initrd_filename;
1239 info->dtb_filename = ms->dtb;
1240 info->dtb_limit = 0;
1241
1242 /* Load the kernel. */
1243 if (!info->kernel_filename || info->firmware_loaded) {
1244 arm_setup_firmware_boot(cpu, info);
1245 } else {
1246 arm_setup_direct_kernel_boot(cpu, info);
1247 }
1248
1249 /*
1250 * Disable the PSCI conduit if it is set up to target the same
1251 * or a lower EL than the one we're going to start the guest code in.
1252 * This logic needs to agree with the code in do_cpu_reset() which
1253 * decides whether we're going to boot the guest in the highest
1254 * supported exception level or in a lower one.
1255 */
1256
1257 /*
1258 * If PSCI is enabled, then SMC calls all go to the PSCI handler and
1259 * are never emulated to trap into guest code. It therefore does not
1260 * make sense for the board to have a setup code fragment that runs
1261 * in Secure, because this will probably need to itself issue an SMC of some
1262 * kind as part of its operation.
1263 */
1264 assert(info->psci_conduit == QEMU_PSCI_CONDUIT_DISABLED ||
1265 !info->secure_board_setup);
1266
1267 /* Boot into highest supported EL ... */
1268 if (arm_feature(env, ARM_FEATURE_EL3)) {
1269 boot_el = 3;
1270 } else if (arm_feature(env, ARM_FEATURE_EL2)) {
1271 boot_el = 2;
1272 } else {
1273 boot_el = 1;
1274 }
1275 /* ...except that if we're booting Linux we adjust the EL we boot into */
1276 if (info->is_linux && !info->secure_boot) {
1277 boot_el = arm_feature(env, ARM_FEATURE_EL2) ? 2 : 1;
1278 }
1279
1280 if ((info->psci_conduit == QEMU_PSCI_CONDUIT_HVC && boot_el >= 2) ||
1281 (info->psci_conduit == QEMU_PSCI_CONDUIT_SMC && boot_el == 3)) {
1282 info->psci_conduit = QEMU_PSCI_CONDUIT_DISABLED;
1283 }
1284
1285 if (info->psci_conduit != QEMU_PSCI_CONDUIT_DISABLED) {
1286 for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
1287 Object *cpuobj = OBJECT(cs);
1288
1289 object_property_set_int(cpuobj, "psci-conduit", info->psci_conduit,
1290 &error_abort);
1291 /*
1292 * Secondary CPUs start in PSCI powered-down state. Like the
1293 * code in do_cpu_reset(), we assume first_cpu is the primary
1294 * CPU.
1295 */
1296 if (cs != first_cpu) {
1297 object_property_set_bool(cpuobj, "start-powered-off", true,
1298 &error_abort);
1299 }
1300 }
1301 }
1302
1303 if (info->psci_conduit == QEMU_PSCI_CONDUIT_DISABLED &&
1304 info->is_linux && nb_cpus > 1) {
1305 /*
1306 * We're booting Linux but not using PSCI, so for SMP we need
1307 * to write a custom secondary CPU boot loader stub, and arrange
1308 * for the secondary CPU reset to make the accompanying initialization.
1309 */
1310 if (!info->secondary_cpu_reset_hook) {
1311 info->secondary_cpu_reset_hook = default_reset_secondary;
1312 }
1313 if (!info->write_secondary_boot) {
1314 info->write_secondary_boot = default_write_secondary;
1315 }
1316 info->write_secondary_boot(cpu, info);
1317 } else {
1318 /*
1319 * No secondary boot stub; don't use the reset hook that would
1320 * have set the CPU up to call it
1321 */
1322 info->write_secondary_boot = NULL;
1323 info->secondary_cpu_reset_hook = NULL;
1324 }
1325
1326 /*
1327 * arm_load_dtb() may add a PSCI node so it must be called after we have
1328 * decided whether to enable PSCI and set the psci-conduit CPU properties.
1329 */
1330 if (!info->skip_dtb_autoload && have_dtb(info)) {
1331 if (arm_load_dtb(info->dtb_start, info, info->dtb_limit,
1332 as, ms, cpu) < 0) {
1333 exit(1);
1334 }
1335 }
1336 }
1337
1338 static const TypeInfo arm_linux_boot_if_info = {
1339 .name = TYPE_ARM_LINUX_BOOT_IF,
1340 .parent = TYPE_INTERFACE,
1341 .class_size = sizeof(ARMLinuxBootIfClass),
1342 };
1343
arm_linux_boot_register_types(void)1344 static void arm_linux_boot_register_types(void)
1345 {
1346 type_register_static(&arm_linux_boot_if_info);
1347 }
1348
1349 type_init(arm_linux_boot_register_types)
1350