1 /* 2 * Copyright (c) 2003-2004 Fabrice Bellard 3 * Copyright (c) 2019, 2024 Red Hat, Inc. 4 * 5 * Permission is hereby granted, free of charge, to any person obtaining a copy 6 * of this software and associated documentation files (the "Software"), to deal 7 * in the Software without restriction, including without limitation the rights 8 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 * copies of the Software, and to permit persons to whom the Software is 10 * furnished to do so, subject to the following conditions: 11 * 12 * The above copyright notice and this permission notice shall be included in 13 * all copies or substantial portions of the Software. 14 * 15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 18 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 * THE SOFTWARE. 22 */ 23 #include "qemu/osdep.h" 24 #include "qemu/error-report.h" 25 #include "qemu/cutils.h" 26 #include "qemu/units.h" 27 #include "qemu/datadir.h" 28 #include "qapi/error.h" 29 #include "system/numa.h" 30 #include "system/system.h" 31 #include "system/xen.h" 32 #include "trace.h" 33 34 #include "hw/i386/x86.h" 35 #include "target/i386/cpu.h" 36 #include "hw/rtc/mc146818rtc.h" 37 #include "target/i386/sev.h" 38 39 #include "hw/acpi/cpu_hotplug.h" 40 #include "hw/irq.h" 41 #include "hw/loader.h" 42 #include "multiboot.h" 43 #include "elf.h" 44 #include "standard-headers/asm-x86/bootparam.h" 45 #include CONFIG_DEVICES 46 #include "kvm/kvm_i386.h" 47 #include "kvm/tdx.h" 48 49 #ifdef CONFIG_XEN_EMU 50 #include "hw/xen/xen.h" 51 #include "hw/i386/kvm/xen_evtchn.h" 52 #endif 53 54 /* Physical Address of PVH entry point read from kernel ELF NOTE */ 55 static size_t pvh_start_addr; 56 57 static void x86_cpu_new(X86MachineState *x86ms, int64_t apic_id, Error **errp) 58 { 59 Object *cpu = object_new(MACHINE(x86ms)->cpu_type); 60 61 if (!object_property_set_uint(cpu, "apic-id", apic_id, errp)) { 62 goto out; 63 } 64 qdev_realize(DEVICE(cpu), NULL, errp); 65 66 out: 67 object_unref(cpu); 68 } 69 70 void x86_cpus_init(X86MachineState *x86ms, int default_cpu_version) 71 { 72 int i; 73 const CPUArchIdList *possible_cpus; 74 MachineState *ms = MACHINE(x86ms); 75 MachineClass *mc = MACHINE_GET_CLASS(x86ms); 76 77 x86_cpu_set_default_version(default_cpu_version); 78 79 /* 80 * Calculates the limit to CPU APIC ID values 81 * 82 * Limit for the APIC ID value, so that all 83 * CPU APIC IDs are < x86ms->apic_id_limit. 84 * 85 * This is used for FW_CFG_MAX_CPUS. See comments on fw_cfg_arch_create(). 86 */ 87 x86ms->apic_id_limit = x86_cpu_apic_id_from_index(x86ms, 88 ms->smp.max_cpus - 1) + 1; 89 90 /* 91 * Can we support APIC ID 255 or higher? With KVM, that requires 92 * both in-kernel lapic and X2APIC userspace API. 93 * 94 * kvm_enabled() must go first to ensure that kvm_* references are 95 * not emitted for the linker to consume (kvm_enabled() is 96 * a literal `0` in configurations where kvm_* aren't defined) 97 */ 98 if (kvm_enabled() && x86ms->apic_id_limit > 255 && 99 kvm_irqchip_in_kernel() && !kvm_enable_x2apic()) { 100 error_report("current -smp configuration requires kernel " 101 "irqchip and X2APIC API support."); 102 exit(EXIT_FAILURE); 103 } 104 105 if (kvm_enabled()) { 106 kvm_set_max_apic_id(x86ms->apic_id_limit); 107 } 108 109 if (!kvm_irqchip_in_kernel()) { 110 apic_set_max_apic_id(x86ms->apic_id_limit); 111 } 112 113 possible_cpus = mc->possible_cpu_arch_ids(ms); 114 for (i = 0; i < ms->smp.cpus; i++) { 115 x86_cpu_new(x86ms, possible_cpus->cpus[i].arch_id, &error_fatal); 116 } 117 } 118 119 void x86_rtc_set_cpus_count(ISADevice *s, uint16_t cpus_count) 120 { 121 MC146818RtcState *rtc = MC146818_RTC(s); 122 123 if (cpus_count > 0xff) { 124 /* 125 * If the number of CPUs can't be represented in 8 bits, the 126 * BIOS must use "FW_CFG_NB_CPUS". Set RTC field to 0 just 127 * to make old BIOSes fail more predictably. 128 */ 129 mc146818rtc_set_cmos_data(rtc, 0x5f, 0); 130 } else { 131 mc146818rtc_set_cmos_data(rtc, 0x5f, cpus_count - 1); 132 } 133 } 134 135 static int x86_apic_cmp(const void *a, const void *b) 136 { 137 CPUArchId *apic_a = (CPUArchId *)a; 138 CPUArchId *apic_b = (CPUArchId *)b; 139 140 return apic_a->arch_id - apic_b->arch_id; 141 } 142 143 /* 144 * returns pointer to CPUArchId descriptor that matches CPU's apic_id 145 * in ms->possible_cpus->cpus, if ms->possible_cpus->cpus has no 146 * entry corresponding to CPU's apic_id returns NULL. 147 */ 148 static CPUArchId *x86_find_cpu_slot(MachineState *ms, uint32_t id, int *idx) 149 { 150 CPUArchId apic_id, *found_cpu; 151 152 apic_id.arch_id = id; 153 found_cpu = bsearch(&apic_id, ms->possible_cpus->cpus, 154 ms->possible_cpus->len, sizeof(*ms->possible_cpus->cpus), 155 x86_apic_cmp); 156 if (found_cpu && idx) { 157 *idx = found_cpu - ms->possible_cpus->cpus; 158 } 159 return found_cpu; 160 } 161 162 void x86_cpu_plug(HotplugHandler *hotplug_dev, 163 DeviceState *dev, Error **errp) 164 { 165 CPUArchId *found_cpu; 166 Error *local_err = NULL; 167 X86CPU *cpu = X86_CPU(dev); 168 X86MachineState *x86ms = X86_MACHINE(hotplug_dev); 169 170 if (x86ms->acpi_dev) { 171 hotplug_handler_plug(x86ms->acpi_dev, dev, &local_err); 172 if (local_err) { 173 goto out; 174 } 175 } 176 177 /* increment the number of CPUs */ 178 x86ms->boot_cpus++; 179 if (x86ms->rtc) { 180 x86_rtc_set_cpus_count(x86ms->rtc, x86ms->boot_cpus); 181 } 182 if (x86ms->fw_cfg) { 183 fw_cfg_modify_i16(x86ms->fw_cfg, FW_CFG_NB_CPUS, x86ms->boot_cpus); 184 } 185 186 found_cpu = x86_find_cpu_slot(MACHINE(x86ms), cpu->apic_id, NULL); 187 found_cpu->cpu = CPU(dev); 188 out: 189 error_propagate(errp, local_err); 190 } 191 192 void x86_cpu_unplug_request_cb(HotplugHandler *hotplug_dev, 193 DeviceState *dev, Error **errp) 194 { 195 int idx = -1; 196 X86CPU *cpu = X86_CPU(dev); 197 X86MachineState *x86ms = X86_MACHINE(hotplug_dev); 198 199 if (!x86ms->acpi_dev) { 200 error_setg(errp, "CPU hot unplug not supported without ACPI"); 201 return; 202 } 203 204 x86_find_cpu_slot(MACHINE(x86ms), cpu->apic_id, &idx); 205 assert(idx != -1); 206 if (idx == 0) { 207 error_setg(errp, "Boot CPU is unpluggable"); 208 return; 209 } 210 211 hotplug_handler_unplug_request(x86ms->acpi_dev, dev, 212 errp); 213 } 214 215 void x86_cpu_unplug_cb(HotplugHandler *hotplug_dev, 216 DeviceState *dev, Error **errp) 217 { 218 CPUArchId *found_cpu; 219 Error *local_err = NULL; 220 X86CPU *cpu = X86_CPU(dev); 221 X86MachineState *x86ms = X86_MACHINE(hotplug_dev); 222 223 hotplug_handler_unplug(x86ms->acpi_dev, dev, &local_err); 224 if (local_err) { 225 goto out; 226 } 227 228 found_cpu = x86_find_cpu_slot(MACHINE(x86ms), cpu->apic_id, NULL); 229 found_cpu->cpu = NULL; 230 qdev_unrealize(dev); 231 232 /* decrement the number of CPUs */ 233 x86ms->boot_cpus--; 234 /* Update the number of CPUs in CMOS */ 235 x86_rtc_set_cpus_count(x86ms->rtc, x86ms->boot_cpus); 236 fw_cfg_modify_i16(x86ms->fw_cfg, FW_CFG_NB_CPUS, x86ms->boot_cpus); 237 out: 238 error_propagate(errp, local_err); 239 } 240 241 void x86_cpu_pre_plug(HotplugHandler *hotplug_dev, 242 DeviceState *dev, Error **errp) 243 { 244 int idx; 245 CPUState *cs; 246 CPUArchId *cpu_slot; 247 X86CPUTopoIDs topo_ids; 248 X86CPU *cpu = X86_CPU(dev); 249 CPUX86State *env = &cpu->env; 250 MachineState *ms = MACHINE(hotplug_dev); 251 X86MachineState *x86ms = X86_MACHINE(hotplug_dev); 252 X86CPUTopoInfo *topo_info = &env->topo_info; 253 254 if (!object_dynamic_cast(OBJECT(cpu), ms->cpu_type)) { 255 error_setg(errp, "Invalid CPU type, expected cpu type: '%s'", 256 ms->cpu_type); 257 return; 258 } 259 260 if (x86ms->acpi_dev) { 261 Error *local_err = NULL; 262 263 hotplug_handler_pre_plug(HOTPLUG_HANDLER(x86ms->acpi_dev), dev, 264 &local_err); 265 if (local_err) { 266 error_propagate(errp, local_err); 267 return; 268 } 269 } 270 271 init_topo_info(topo_info, x86ms); 272 273 if (ms->smp.modules > 1) { 274 set_bit(CPU_TOPOLOGY_LEVEL_MODULE, env->avail_cpu_topo); 275 } 276 277 if (ms->smp.dies > 1) { 278 set_bit(CPU_TOPOLOGY_LEVEL_DIE, env->avail_cpu_topo); 279 } 280 281 /* 282 * If APIC ID is not set, 283 * set it based on socket/die/module/core/thread properties. 284 */ 285 if (cpu->apic_id == UNASSIGNED_APIC_ID) { 286 /* 287 * die-id was optional in QEMU 4.0 and older, so keep it optional 288 * if there's only one die per socket. 289 */ 290 if (cpu->die_id < 0 && ms->smp.dies == 1) { 291 cpu->die_id = 0; 292 } 293 294 /* 295 * module-id was optional in QEMU 9.0 and older, so keep it optional 296 * if there's only one module per die. 297 */ 298 if (cpu->module_id < 0 && ms->smp.modules == 1) { 299 cpu->module_id = 0; 300 } 301 302 if (cpu->socket_id < 0) { 303 error_setg(errp, "CPU socket-id is not set"); 304 return; 305 } else if (cpu->socket_id > ms->smp.sockets - 1) { 306 error_setg(errp, "Invalid CPU socket-id: %u must be in range 0:%u", 307 cpu->socket_id, ms->smp.sockets - 1); 308 return; 309 } 310 if (cpu->die_id < 0) { 311 error_setg(errp, "CPU die-id is not set"); 312 return; 313 } else if (cpu->die_id > ms->smp.dies - 1) { 314 error_setg(errp, "Invalid CPU die-id: %u must be in range 0:%u", 315 cpu->die_id, ms->smp.dies - 1); 316 return; 317 } 318 if (cpu->module_id < 0) { 319 error_setg(errp, "CPU module-id is not set"); 320 return; 321 } else if (cpu->module_id > ms->smp.modules - 1) { 322 error_setg(errp, "Invalid CPU module-id: %u must be in range 0:%u", 323 cpu->module_id, ms->smp.modules - 1); 324 return; 325 } 326 if (cpu->core_id < 0) { 327 error_setg(errp, "CPU core-id is not set"); 328 return; 329 } else if (cpu->core_id > (ms->smp.cores - 1)) { 330 error_setg(errp, "Invalid CPU core-id: %u must be in range 0:%u", 331 cpu->core_id, ms->smp.cores - 1); 332 return; 333 } 334 if (cpu->thread_id < 0) { 335 error_setg(errp, "CPU thread-id is not set"); 336 return; 337 } else if (cpu->thread_id > (ms->smp.threads - 1)) { 338 error_setg(errp, "Invalid CPU thread-id: %u must be in range 0:%u", 339 cpu->thread_id, ms->smp.threads - 1); 340 return; 341 } 342 343 topo_ids.pkg_id = cpu->socket_id; 344 topo_ids.die_id = cpu->die_id; 345 topo_ids.module_id = cpu->module_id; 346 topo_ids.core_id = cpu->core_id; 347 topo_ids.smt_id = cpu->thread_id; 348 cpu->apic_id = x86_apicid_from_topo_ids(topo_info, &topo_ids); 349 } 350 351 cpu_slot = x86_find_cpu_slot(MACHINE(x86ms), cpu->apic_id, &idx); 352 if (!cpu_slot) { 353 x86_topo_ids_from_apicid(cpu->apic_id, topo_info, &topo_ids); 354 355 error_setg(errp, 356 "Invalid CPU [socket: %u, die: %u, module: %u, core: %u, thread: %u]" 357 " with APIC ID %" PRIu32 ", valid index range 0:%d", 358 topo_ids.pkg_id, topo_ids.die_id, topo_ids.module_id, 359 topo_ids.core_id, topo_ids.smt_id, cpu->apic_id, 360 ms->possible_cpus->len - 1); 361 return; 362 } 363 364 if (cpu_slot->cpu) { 365 error_setg(errp, "CPU[%d] with APIC ID %" PRIu32 " exists", 366 idx, cpu->apic_id); 367 return; 368 } 369 370 /* if 'address' properties socket-id/core-id/thread-id are not set, set them 371 * so that machine_query_hotpluggable_cpus would show correct values 372 */ 373 /* TODO: move socket_id/core_id/thread_id checks into x86_cpu_realizefn() 374 * once -smp refactoring is complete and there will be CPU private 375 * CPUState::nr_cores and CPUState::nr_threads fields instead of globals */ 376 x86_topo_ids_from_apicid(cpu->apic_id, topo_info, &topo_ids); 377 if (cpu->socket_id != -1 && cpu->socket_id != topo_ids.pkg_id) { 378 error_setg(errp, "property socket-id: %u doesn't match set apic-id:" 379 " 0x%x (socket-id: %u)", cpu->socket_id, cpu->apic_id, 380 topo_ids.pkg_id); 381 return; 382 } 383 cpu->socket_id = topo_ids.pkg_id; 384 385 if (cpu->die_id != -1 && cpu->die_id != topo_ids.die_id) { 386 error_setg(errp, "property die-id: %u doesn't match set apic-id:" 387 " 0x%x (die-id: %u)", cpu->die_id, cpu->apic_id, topo_ids.die_id); 388 return; 389 } 390 cpu->die_id = topo_ids.die_id; 391 392 if (cpu->module_id != -1 && cpu->module_id != topo_ids.module_id) { 393 error_setg(errp, "property module-id: %u doesn't match set apic-id:" 394 " 0x%x (module-id: %u)", cpu->module_id, cpu->apic_id, 395 topo_ids.module_id); 396 return; 397 } 398 cpu->module_id = topo_ids.module_id; 399 400 if (cpu->core_id != -1 && cpu->core_id != topo_ids.core_id) { 401 error_setg(errp, "property core-id: %u doesn't match set apic-id:" 402 " 0x%x (core-id: %u)", cpu->core_id, cpu->apic_id, 403 topo_ids.core_id); 404 return; 405 } 406 cpu->core_id = topo_ids.core_id; 407 408 if (cpu->thread_id != -1 && cpu->thread_id != topo_ids.smt_id) { 409 error_setg(errp, "property thread-id: %u doesn't match set apic-id:" 410 " 0x%x (thread-id: %u)", cpu->thread_id, cpu->apic_id, 411 topo_ids.smt_id); 412 return; 413 } 414 cpu->thread_id = topo_ids.smt_id; 415 416 /* 417 * kvm_enabled() must go first to ensure that kvm_* references are 418 * not emitted for the linker to consume (kvm_enabled() is 419 * a literal `0` in configurations where kvm_* aren't defined) 420 */ 421 if (kvm_enabled() && hyperv_feat_enabled(cpu, HYPERV_FEAT_VPINDEX) && 422 !kvm_hv_vpindex_settable()) { 423 error_setg(errp, "kernel doesn't allow setting HyperV VP_INDEX"); 424 return; 425 } 426 427 cs = CPU(cpu); 428 cs->cpu_index = idx; 429 430 numa_cpu_pre_plug(cpu_slot, dev, errp); 431 } 432 433 static long get_file_size(FILE *f) 434 { 435 long where, size; 436 437 /* XXX: on Unix systems, using fstat() probably makes more sense */ 438 439 where = ftell(f); 440 fseek(f, 0, SEEK_END); 441 size = ftell(f); 442 fseek(f, where, SEEK_SET); 443 444 return size; 445 } 446 447 void gsi_handler(void *opaque, int n, int level) 448 { 449 GSIState *s = opaque; 450 bool bypass_ioapic = false; 451 452 trace_x86_gsi_interrupt(n, level); 453 454 #ifdef CONFIG_XEN_EMU 455 /* 456 * Xen delivers the GSI to the Legacy PIC (not that Legacy PIC 457 * routing actually works properly under Xen). And then to 458 * *either* the PIRQ handling or the I/OAPIC depending on whether 459 * the former wants it. 460 * 461 * Additionally, this hook allows the Xen event channel GSI to 462 * work around QEMU's lack of support for shared level interrupts, 463 * by keeping track of the externally driven state of the pin and 464 * implementing a logical OR with the state of the evtchn GSI. 465 */ 466 if (xen_mode == XEN_EMULATE) { 467 bypass_ioapic = xen_evtchn_set_gsi(n, &level); 468 } 469 #endif 470 471 switch (n) { 472 case 0 ... ISA_NUM_IRQS - 1: 473 if (s->i8259_irq[n]) { 474 /* Under KVM, Kernel will forward to both PIC and IOAPIC */ 475 qemu_set_irq(s->i8259_irq[n], level); 476 } 477 /* fall through */ 478 case ISA_NUM_IRQS ... IOAPIC_NUM_PINS - 1: 479 if (!bypass_ioapic) { 480 qemu_set_irq(s->ioapic_irq[n], level); 481 } 482 break; 483 case IO_APIC_SECONDARY_IRQBASE 484 ... IO_APIC_SECONDARY_IRQBASE + IOAPIC_NUM_PINS - 1: 485 qemu_set_irq(s->ioapic2_irq[n - IO_APIC_SECONDARY_IRQBASE], level); 486 break; 487 } 488 } 489 490 void ioapic_init_gsi(GSIState *gsi_state, Object *parent) 491 { 492 DeviceState *dev; 493 SysBusDevice *d; 494 unsigned int i; 495 496 assert(parent); 497 if (kvm_ioapic_in_kernel()) { 498 dev = qdev_new(TYPE_KVM_IOAPIC); 499 } else { 500 dev = qdev_new(TYPE_IOAPIC); 501 } 502 object_property_add_child(parent, "ioapic", OBJECT(dev)); 503 d = SYS_BUS_DEVICE(dev); 504 sysbus_realize_and_unref(d, &error_fatal); 505 sysbus_mmio_map(d, 0, IO_APIC_DEFAULT_ADDRESS); 506 507 for (i = 0; i < IOAPIC_NUM_PINS; i++) { 508 gsi_state->ioapic_irq[i] = qdev_get_gpio_in(dev, i); 509 } 510 } 511 512 DeviceState *ioapic_init_secondary(GSIState *gsi_state) 513 { 514 DeviceState *dev; 515 SysBusDevice *d; 516 unsigned int i; 517 518 dev = qdev_new(TYPE_IOAPIC); 519 d = SYS_BUS_DEVICE(dev); 520 sysbus_realize_and_unref(d, &error_fatal); 521 sysbus_mmio_map(d, 0, IO_APIC_SECONDARY_ADDRESS); 522 523 for (i = 0; i < IOAPIC_NUM_PINS; i++) { 524 gsi_state->ioapic2_irq[i] = qdev_get_gpio_in(dev, i); 525 } 526 return dev; 527 } 528 529 /* 530 * The entry point into the kernel for PVH boot is different from 531 * the native entry point. The PVH entry is defined by the x86/HVM 532 * direct boot ABI and is available in an ELFNOTE in the kernel binary. 533 * 534 * This function is passed to load_elf() when it is called from 535 * load_elfboot() which then additionally checks for an ELF Note of 536 * type XEN_ELFNOTE_PHYS32_ENTRY and passes it to this function to 537 * parse the PVH entry address from the ELF Note. 538 * 539 * Due to trickery in elf_opts.h, load_elf() is actually available as 540 * load_elf32() or load_elf64() and this routine needs to be able 541 * to deal with being called as 32 or 64 bit. 542 * 543 * The address of the PVH entry point is saved to the 'pvh_start_addr' 544 * global variable. (although the entry point is 32-bit, the kernel 545 * binary can be either 32-bit or 64-bit). 546 */ 547 static uint64_t read_pvh_start_addr(void *arg1, void *arg2, bool is64) 548 { 549 size_t *elf_note_data_addr; 550 551 /* Check if ELF Note header passed in is valid */ 552 if (arg1 == NULL) { 553 return 0; 554 } 555 556 if (is64) { 557 struct elf64_note *nhdr64 = (struct elf64_note *)arg1; 558 uint64_t nhdr_size64 = sizeof(struct elf64_note); 559 uint64_t phdr_align = *(uint64_t *)arg2; 560 uint64_t nhdr_namesz = nhdr64->n_namesz; 561 562 elf_note_data_addr = 563 ((void *)nhdr64) + nhdr_size64 + 564 QEMU_ALIGN_UP(nhdr_namesz, phdr_align); 565 566 pvh_start_addr = *elf_note_data_addr; 567 } else { 568 struct elf32_note *nhdr32 = (struct elf32_note *)arg1; 569 uint32_t nhdr_size32 = sizeof(struct elf32_note); 570 uint32_t phdr_align = *(uint32_t *)arg2; 571 uint32_t nhdr_namesz = nhdr32->n_namesz; 572 573 elf_note_data_addr = 574 ((void *)nhdr32) + nhdr_size32 + 575 QEMU_ALIGN_UP(nhdr_namesz, phdr_align); 576 577 pvh_start_addr = *(uint32_t *)elf_note_data_addr; 578 } 579 580 return pvh_start_addr; 581 } 582 583 static bool load_elfboot(const char *kernel_filename, 584 int kernel_file_size, 585 uint8_t *header, 586 size_t pvh_xen_start_addr, 587 FWCfgState *fw_cfg) 588 { 589 uint32_t flags = 0; 590 uint32_t mh_load_addr = 0; 591 uint32_t elf_kernel_size = 0; 592 uint64_t elf_entry; 593 uint64_t elf_low, elf_high; 594 int kernel_size; 595 596 if (ldl_le_p(header) != 0x464c457f) { 597 return false; /* no elfboot */ 598 } 599 600 bool elf_is64 = header[EI_CLASS] == ELFCLASS64; 601 flags = elf_is64 ? 602 ((Elf64_Ehdr *)header)->e_flags : ((Elf32_Ehdr *)header)->e_flags; 603 604 if (flags & 0x00010004) { /* LOAD_ELF_HEADER_HAS_ADDR */ 605 error_report("elfboot unsupported flags = %x", flags); 606 exit(1); 607 } 608 609 uint64_t elf_note_type = XEN_ELFNOTE_PHYS32_ENTRY; 610 kernel_size = load_elf(kernel_filename, read_pvh_start_addr, 611 NULL, &elf_note_type, &elf_entry, 612 &elf_low, &elf_high, NULL, 613 ELFDATA2LSB, I386_ELF_MACHINE, 0, 0); 614 615 if (kernel_size < 0) { 616 error_report("Error while loading elf kernel"); 617 exit(1); 618 } 619 mh_load_addr = elf_low; 620 elf_kernel_size = elf_high - elf_low; 621 622 if (pvh_start_addr == 0) { 623 error_report("Error loading uncompressed kernel without PVH ELF Note"); 624 exit(1); 625 } 626 fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_ENTRY, pvh_start_addr); 627 fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_ADDR, mh_load_addr); 628 fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_SIZE, elf_kernel_size); 629 630 return true; 631 } 632 633 void x86_load_linux(X86MachineState *x86ms, 634 FWCfgState *fw_cfg, 635 int acpi_data_size, 636 bool pvh_enabled) 637 { 638 bool linuxboot_dma_enabled = X86_MACHINE_GET_CLASS(x86ms)->fwcfg_dma_enabled; 639 uint16_t protocol; 640 int setup_size, kernel_size, cmdline_size; 641 int dtb_size, setup_data_offset; 642 uint32_t initrd_max; 643 uint8_t header[8192], *setup, *kernel; 644 hwaddr real_addr, prot_addr, cmdline_addr, initrd_addr = 0; 645 FILE *f; 646 char *vmode; 647 MachineState *machine = MACHINE(x86ms); 648 struct setup_data *setup_data; 649 const char *kernel_filename = machine->kernel_filename; 650 const char *initrd_filename = machine->initrd_filename; 651 const char *dtb_filename = machine->dtb; 652 const char *kernel_cmdline = machine->kernel_cmdline; 653 SevKernelLoaderContext sev_load_ctx = {}; 654 655 /* Align to 16 bytes as a paranoia measure */ 656 cmdline_size = (strlen(kernel_cmdline) + 16) & ~15; 657 658 /* load the kernel header */ 659 f = fopen(kernel_filename, "rb"); 660 if (!f) { 661 fprintf(stderr, "qemu: could not open kernel file '%s': %s\n", 662 kernel_filename, strerror(errno)); 663 exit(1); 664 } 665 666 kernel_size = get_file_size(f); 667 if (!kernel_size || 668 fread(header, 1, MIN(ARRAY_SIZE(header), kernel_size), f) != 669 MIN(ARRAY_SIZE(header), kernel_size)) { 670 fprintf(stderr, "qemu: could not load kernel '%s': %s\n", 671 kernel_filename, strerror(errno)); 672 exit(1); 673 } 674 675 /* 676 * kernel protocol version. 677 * Please see https://www.kernel.org/doc/Documentation/x86/boot.txt 678 */ 679 if (ldl_le_p(header + 0x202) == 0x53726448) /* Magic signature "HdrS" */ { 680 protocol = lduw_le_p(header + 0x206); 681 } else { 682 /* 683 * This could be a multiboot kernel. If it is, let's stop treating it 684 * like a Linux kernel. 685 * Note: some multiboot images could be in the ELF format (the same of 686 * PVH), so we try multiboot first since we check the multiboot magic 687 * header before to load it. 688 */ 689 if (load_multiboot(x86ms, fw_cfg, f, kernel_filename, initrd_filename, 690 kernel_cmdline, kernel_size, header)) { 691 return; 692 } 693 /* 694 * Check if the file is an uncompressed kernel file (ELF) and load it, 695 * saving the PVH entry point used by the x86/HVM direct boot ABI. 696 * If load_elfboot() is successful, populate the fw_cfg info. 697 */ 698 if (pvh_enabled && 699 load_elfboot(kernel_filename, kernel_size, 700 header, pvh_start_addr, fw_cfg)) { 701 fclose(f); 702 703 fw_cfg_add_i32(fw_cfg, FW_CFG_CMDLINE_SIZE, 704 strlen(kernel_cmdline) + 1); 705 fw_cfg_add_string(fw_cfg, FW_CFG_CMDLINE_DATA, kernel_cmdline); 706 707 setup = g_memdup2(header, sizeof(header)); 708 709 fw_cfg_add_i32(fw_cfg, FW_CFG_SETUP_SIZE, sizeof(header)); 710 fw_cfg_add_bytes(fw_cfg, FW_CFG_SETUP_DATA, 711 setup, sizeof(header)); 712 713 /* load initrd */ 714 if (initrd_filename) { 715 GMappedFile *mapped_file; 716 gsize initrd_size; 717 gchar *initrd_data; 718 GError *gerr = NULL; 719 720 mapped_file = g_mapped_file_new(initrd_filename, false, &gerr); 721 if (!mapped_file) { 722 fprintf(stderr, "qemu: error reading initrd %s: %s\n", 723 initrd_filename, gerr->message); 724 exit(1); 725 } 726 x86ms->initrd_mapped_file = mapped_file; 727 728 initrd_data = g_mapped_file_get_contents(mapped_file); 729 initrd_size = g_mapped_file_get_length(mapped_file); 730 initrd_max = x86ms->below_4g_mem_size - acpi_data_size - 1; 731 if (initrd_size >= initrd_max) { 732 fprintf(stderr, "qemu: initrd is too large, cannot support." 733 "(max: %"PRIu32", need %"PRId64")\n", 734 initrd_max, (uint64_t)initrd_size); 735 exit(1); 736 } 737 738 initrd_addr = (initrd_max - initrd_size) & ~4095; 739 740 fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_ADDR, initrd_addr); 741 fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_SIZE, initrd_size); 742 fw_cfg_add_bytes(fw_cfg, FW_CFG_INITRD_DATA, initrd_data, 743 initrd_size); 744 } 745 746 option_rom[nb_option_roms].bootindex = 0; 747 option_rom[nb_option_roms].name = "pvh.bin"; 748 nb_option_roms++; 749 750 return; 751 } 752 protocol = 0; 753 } 754 755 if (protocol < 0x200 || !(header[0x211] & 0x01)) { 756 /* Low kernel */ 757 real_addr = 0x90000; 758 cmdline_addr = 0x9a000 - cmdline_size; 759 prot_addr = 0x10000; 760 } else if (protocol < 0x202) { 761 /* High but ancient kernel */ 762 real_addr = 0x90000; 763 cmdline_addr = 0x9a000 - cmdline_size; 764 prot_addr = 0x100000; 765 } else { 766 /* High and recent kernel */ 767 real_addr = 0x10000; 768 cmdline_addr = 0x20000; 769 prot_addr = 0x100000; 770 } 771 772 /* highest address for loading the initrd */ 773 if (protocol >= 0x20c && 774 lduw_le_p(header + 0x236) & XLF_CAN_BE_LOADED_ABOVE_4G) { 775 /* 776 * Linux has supported initrd up to 4 GB for a very long time (2007, 777 * long before XLF_CAN_BE_LOADED_ABOVE_4G which was added in 2013), 778 * though it only sets initrd_max to 2 GB to "work around bootloader 779 * bugs". Luckily, QEMU firmware(which does something like bootloader) 780 * has supported this. 781 * 782 * It's believed that if XLF_CAN_BE_LOADED_ABOVE_4G is set, initrd can 783 * be loaded into any address. 784 * 785 * In addition, initrd_max is uint32_t simply because QEMU doesn't 786 * support the 64-bit boot protocol (specifically the ext_ramdisk_image 787 * field). 788 * 789 * Therefore here just limit initrd_max to UINT32_MAX simply as well. 790 */ 791 initrd_max = UINT32_MAX; 792 } else if (protocol >= 0x203) { 793 initrd_max = ldl_le_p(header + 0x22c); 794 } else { 795 initrd_max = 0x37ffffff; 796 } 797 798 if (initrd_max >= x86ms->below_4g_mem_size - acpi_data_size) { 799 initrd_max = x86ms->below_4g_mem_size - acpi_data_size - 1; 800 } 801 802 fw_cfg_add_i32(fw_cfg, FW_CFG_CMDLINE_ADDR, cmdline_addr); 803 fw_cfg_add_i32(fw_cfg, FW_CFG_CMDLINE_SIZE, strlen(kernel_cmdline) + 1); 804 fw_cfg_add_string(fw_cfg, FW_CFG_CMDLINE_DATA, kernel_cmdline); 805 sev_load_ctx.cmdline_data = (char *)kernel_cmdline; 806 sev_load_ctx.cmdline_size = strlen(kernel_cmdline) + 1; 807 808 if (protocol >= 0x202) { 809 stl_le_p(header + 0x228, cmdline_addr); 810 } else { 811 stw_le_p(header + 0x20, 0xA33F); 812 stw_le_p(header + 0x22, cmdline_addr - real_addr); 813 } 814 815 /* handle vga= parameter */ 816 vmode = strstr(kernel_cmdline, "vga="); 817 if (vmode) { 818 unsigned int video_mode; 819 const char *end; 820 int ret; 821 /* skip "vga=" */ 822 vmode += 4; 823 if (!strncmp(vmode, "normal", 6)) { 824 video_mode = 0xffff; 825 } else if (!strncmp(vmode, "ext", 3)) { 826 video_mode = 0xfffe; 827 } else if (!strncmp(vmode, "ask", 3)) { 828 video_mode = 0xfffd; 829 } else { 830 ret = qemu_strtoui(vmode, &end, 0, &video_mode); 831 if (ret != 0 || (*end && *end != ' ')) { 832 fprintf(stderr, "qemu: invalid 'vga=' kernel parameter.\n"); 833 exit(1); 834 } 835 } 836 stw_le_p(header + 0x1fa, video_mode); 837 } 838 839 /* loader type */ 840 /* 841 * High nybble = B reserved for QEMU; low nybble is revision number. 842 * If this code is substantially changed, you may want to consider 843 * incrementing the revision. 844 */ 845 if (protocol >= 0x200) { 846 header[0x210] = 0xB0; 847 } 848 /* heap */ 849 if (protocol >= 0x201) { 850 header[0x211] |= 0x80; /* CAN_USE_HEAP */ 851 stw_le_p(header + 0x224, cmdline_addr - real_addr - 0x200); 852 } 853 854 /* load initrd */ 855 if (initrd_filename) { 856 GMappedFile *mapped_file; 857 gsize initrd_size; 858 gchar *initrd_data; 859 GError *gerr = NULL; 860 861 if (protocol < 0x200) { 862 fprintf(stderr, "qemu: linux kernel too old to load a ram disk\n"); 863 exit(1); 864 } 865 866 mapped_file = g_mapped_file_new(initrd_filename, false, &gerr); 867 if (!mapped_file) { 868 fprintf(stderr, "qemu: error reading initrd %s: %s\n", 869 initrd_filename, gerr->message); 870 exit(1); 871 } 872 x86ms->initrd_mapped_file = mapped_file; 873 874 initrd_data = g_mapped_file_get_contents(mapped_file); 875 initrd_size = g_mapped_file_get_length(mapped_file); 876 if (initrd_size >= initrd_max) { 877 fprintf(stderr, "qemu: initrd is too large, cannot support." 878 "(max: %"PRIu32", need %"PRId64")\n", 879 initrd_max, (uint64_t)initrd_size); 880 exit(1); 881 } 882 883 initrd_addr = (initrd_max - initrd_size) & ~4095; 884 885 fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_ADDR, initrd_addr); 886 fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_SIZE, initrd_size); 887 fw_cfg_add_bytes(fw_cfg, FW_CFG_INITRD_DATA, initrd_data, initrd_size); 888 sev_load_ctx.initrd_data = initrd_data; 889 sev_load_ctx.initrd_size = initrd_size; 890 891 stl_le_p(header + 0x218, initrd_addr); 892 stl_le_p(header + 0x21c, initrd_size); 893 } 894 895 /* load kernel and setup */ 896 setup_size = header[0x1f1]; 897 if (setup_size == 0) { 898 setup_size = 4; 899 } 900 setup_size = (setup_size + 1) * 512; 901 if (setup_size > kernel_size) { 902 fprintf(stderr, "qemu: invalid kernel header\n"); 903 exit(1); 904 } 905 906 setup = g_malloc(setup_size); 907 kernel = g_malloc(kernel_size); 908 fseek(f, 0, SEEK_SET); 909 if (fread(setup, 1, setup_size, f) != setup_size) { 910 fprintf(stderr, "fread() failed\n"); 911 exit(1); 912 } 913 fseek(f, 0, SEEK_SET); 914 if (fread(kernel, 1, kernel_size, f) != kernel_size) { 915 fprintf(stderr, "fread() failed\n"); 916 exit(1); 917 } 918 fclose(f); 919 920 /* append dtb to kernel */ 921 if (dtb_filename) { 922 if (protocol < 0x209) { 923 fprintf(stderr, "qemu: Linux kernel too old to load a dtb\n"); 924 exit(1); 925 } 926 927 dtb_size = get_image_size(dtb_filename); 928 if (dtb_size <= 0) { 929 fprintf(stderr, "qemu: error reading dtb %s: %s\n", 930 dtb_filename, strerror(errno)); 931 exit(1); 932 } 933 934 setup_data_offset = QEMU_ALIGN_UP(kernel_size, 16); 935 kernel_size = setup_data_offset + sizeof(struct setup_data) + dtb_size; 936 kernel = g_realloc(kernel, kernel_size); 937 938 stq_le_p(header + 0x250, prot_addr + setup_data_offset); 939 940 setup_data = (struct setup_data *)(kernel + setup_data_offset); 941 setup_data->next = 0; 942 setup_data->type = cpu_to_le32(SETUP_DTB); 943 setup_data->len = cpu_to_le32(dtb_size); 944 945 load_image_size(dtb_filename, setup_data->data, dtb_size); 946 } 947 948 /* 949 * If we're starting an encrypted VM, it will be OVMF based, which uses the 950 * efi stub for booting and doesn't require any values to be placed in the 951 * kernel header. We therefore don't update the header so the hash of the 952 * kernel on the other side of the fw_cfg interface matches the hash of the 953 * file the user passed in. 954 */ 955 if (!sev_enabled() && protocol > 0) { 956 memcpy(setup, header, MIN(sizeof(header), setup_size)); 957 } 958 959 fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_ADDR, prot_addr); 960 fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_SIZE, kernel_size - setup_size); 961 fw_cfg_add_bytes(fw_cfg, FW_CFG_KERNEL_DATA, 962 kernel + setup_size, kernel_size - setup_size); 963 sev_load_ctx.kernel_data = (char *)kernel + setup_size; 964 sev_load_ctx.kernel_size = kernel_size - setup_size; 965 966 fw_cfg_add_i32(fw_cfg, FW_CFG_SETUP_ADDR, real_addr); 967 fw_cfg_add_i32(fw_cfg, FW_CFG_SETUP_SIZE, setup_size); 968 fw_cfg_add_bytes(fw_cfg, FW_CFG_SETUP_DATA, setup, setup_size); 969 sev_load_ctx.setup_data = (char *)setup; 970 sev_load_ctx.setup_size = setup_size; 971 972 /* kernel without setup header patches */ 973 fw_cfg_add_file(fw_cfg, "etc/boot/kernel", kernel, kernel_size); 974 975 if (machine->shim_filename) { 976 GMappedFile *mapped_file; 977 GError *gerr = NULL; 978 979 mapped_file = g_mapped_file_new(machine->shim_filename, false, &gerr); 980 if (!mapped_file) { 981 fprintf(stderr, "qemu: error reading shim %s: %s\n", 982 machine->shim_filename, gerr->message); 983 exit(1); 984 } 985 986 fw_cfg_add_file(fw_cfg, "etc/boot/shim", 987 g_mapped_file_get_contents(mapped_file), 988 g_mapped_file_get_length(mapped_file)); 989 } 990 991 if (sev_enabled()) { 992 sev_add_kernel_loader_hashes(&sev_load_ctx, &error_fatal); 993 } 994 995 option_rom[nb_option_roms].bootindex = 0; 996 option_rom[nb_option_roms].name = "linuxboot.bin"; 997 if (linuxboot_dma_enabled && fw_cfg_dma_enabled(fw_cfg)) { 998 option_rom[nb_option_roms].name = "linuxboot_dma.bin"; 999 } 1000 nb_option_roms++; 1001 } 1002 1003 void x86_isa_bios_init(MemoryRegion *isa_bios, MemoryRegion *isa_memory, 1004 MemoryRegion *bios, bool read_only) 1005 { 1006 uint64_t bios_size = memory_region_size(bios); 1007 uint64_t isa_bios_size = MIN(bios_size, 128 * KiB); 1008 1009 memory_region_init_alias(isa_bios, NULL, "isa-bios", bios, 1010 bios_size - isa_bios_size, isa_bios_size); 1011 memory_region_add_subregion_overlap(isa_memory, 1 * MiB - isa_bios_size, 1012 isa_bios, 1); 1013 memory_region_set_readonly(isa_bios, read_only); 1014 } 1015 1016 void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware, 1017 MemoryRegion *rom_memory, bool isapc_ram_fw) 1018 { 1019 const char *bios_name; 1020 char *filename; 1021 int bios_size; 1022 ssize_t ret; 1023 1024 /* BIOS load */ 1025 bios_name = MACHINE(x86ms)->firmware ?: default_firmware; 1026 filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name); 1027 if (filename) { 1028 bios_size = get_image_size(filename); 1029 } else { 1030 bios_size = -1; 1031 } 1032 if (bios_size <= 0 || 1033 (bios_size % 65536) != 0) { 1034 goto bios_error; 1035 } 1036 if (machine_require_guest_memfd(MACHINE(x86ms))) { 1037 memory_region_init_ram_guest_memfd(&x86ms->bios, NULL, "pc.bios", 1038 bios_size, &error_fatal); 1039 if (is_tdx_vm()) { 1040 tdx_set_tdvf_region(&x86ms->bios); 1041 } 1042 } else { 1043 memory_region_init_ram(&x86ms->bios, NULL, "pc.bios", 1044 bios_size, &error_fatal); 1045 } 1046 if (sev_enabled() || is_tdx_vm()) { 1047 /* 1048 * The concept of a "reset" simply doesn't exist for 1049 * confidential computing guests, we have to destroy and 1050 * re-launch them instead. So there is no need to register 1051 * the firmware as rom to properly re-initialize on reset. 1052 * Just go for a straight file load instead. 1053 */ 1054 void *ptr = memory_region_get_ram_ptr(&x86ms->bios); 1055 load_image_size(filename, ptr, bios_size); 1056 x86_firmware_configure(0x100000000ULL - bios_size, ptr, bios_size); 1057 } else { 1058 memory_region_set_readonly(&x86ms->bios, !isapc_ram_fw); 1059 ret = rom_add_file_fixed(bios_name, (uint32_t)(-bios_size), -1); 1060 if (ret != 0) { 1061 goto bios_error; 1062 } 1063 } 1064 g_free(filename); 1065 1066 if (!machine_require_guest_memfd(MACHINE(x86ms))) { 1067 /* map the last 128KB of the BIOS in ISA space */ 1068 x86_isa_bios_init(&x86ms->isa_bios, rom_memory, &x86ms->bios, 1069 !isapc_ram_fw); 1070 } 1071 1072 /* map all the bios at the top of memory */ 1073 memory_region_add_subregion(rom_memory, 1074 (uint32_t)(-bios_size), 1075 &x86ms->bios); 1076 return; 1077 1078 bios_error: 1079 fprintf(stderr, "qemu: could not load PC BIOS '%s'\n", bios_name); 1080 exit(1); 1081 } 1082