xref: /openbmc/qemu/pc-bios/s390-ccw/bootmap.c (revision 2b108085)
1 /*
2  * QEMU S390 bootmap interpreter
3  *
4  * Copyright (c) 2009 Alexander Graf <agraf@suse.de>
5  *
6  * This work is licensed under the terms of the GNU GPL, version 2 or (at
7  * your option) any later version. See the COPYING file in the top-level
8  * directory.
9  */
10 
11 #include "libc.h"
12 #include "s390-ccw.h"
13 #include "bootmap.h"
14 #include "virtio.h"
15 #include "bswap.h"
16 
17 #ifdef DEBUG
18 /* #define DEBUG_FALLBACK */
19 #endif
20 
21 #ifdef DEBUG_FALLBACK
22 #define dputs(txt) \
23     do { sclp_print("zipl: " txt); } while (0)
24 #else
25 #define dputs(fmt, ...) \
26     do { } while (0)
27 #endif
28 
29 /* Scratch space */
30 static uint8_t sec[MAX_SECTOR_SIZE*4] __attribute__((__aligned__(PAGE_SIZE)));
31 
32 typedef struct ResetInfo {
33     uint32_t ipl_mask;
34     uint32_t ipl_addr;
35     uint32_t ipl_continue;
36 } ResetInfo;
37 
38 static ResetInfo save;
39 
40 const uint8_t el_torito_magic[] = "EL TORITO SPECIFICATION"
41                                   "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0";
42 
43 /*
44  * Match two CCWs located after PSW and eight filler bytes.
45  * From libmagic and arch/s390/kernel/head.S.
46  */
47 const uint8_t linux_s390_magic[] = "\x02\x00\x00\x18\x60\x00\x00\x50\x02\x00"
48                                    "\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40"
49                                    "\x40\x40\x40\x40";
50 
51 static inline bool is_iso_vd_valid(IsoVolDesc *vd)
52 {
53     const uint8_t vol_desc_magic[] = "CD001";
54 
55     return !memcmp(&vd->ident[0], vol_desc_magic, 5) &&
56            vd->version == 0x1 &&
57            vd->type <= VOL_DESC_TYPE_PARTITION;
58 }
59 
60 static void jump_to_IPL_2(void)
61 {
62     ResetInfo *current = 0;
63 
64     void (*ipl)(void) = (void *) (uint64_t) current->ipl_continue;
65     *current = save;
66     ipl(); /* should not return */
67 }
68 
69 static void jump_to_IPL_code(uint64_t address)
70 {
71     /* store the subsystem information _after_ the bootmap was loaded */
72     write_subsystem_identification();
73 
74     /* prevent unknown IPL types in the guest */
75     if (iplb.pbt == S390_IPL_TYPE_QEMU_SCSI) {
76         iplb.pbt = S390_IPL_TYPE_CCW;
77         set_iplb(&iplb);
78     }
79 
80     /*
81      * The IPL PSW is at address 0. We also must not overwrite the
82      * content of non-BIOS memory after we loaded the guest, so we
83      * save the original content and restore it in jump_to_IPL_2.
84      */
85     ResetInfo *current = 0;
86 
87     save = *current;
88     current->ipl_addr = (uint32_t) (uint64_t) &jump_to_IPL_2;
89     current->ipl_continue = address & 0x7fffffff;
90 
91     debug_print_int("set IPL addr to", current->ipl_continue);
92 
93     /* Ensure the guest output starts fresh */
94     sclp_print("\n");
95 
96     /*
97      * HACK ALERT.
98      * We use the load normal reset to keep r15 unchanged. jump_to_IPL_2
99      * can then use r15 as its stack pointer.
100      */
101     asm volatile("lghi 1,1\n\t"
102                  "diag 1,1,0x308\n\t"
103                  : : : "1", "memory");
104     panic("\n! IPL returns !\n");
105 }
106 
107 /***********************************************************************
108  * IPL an ECKD DASD (CDL or LDL/CMS format)
109  */
110 
111 static unsigned char _bprs[8*1024]; /* guessed "max" ECKD sector size */
112 static const int max_bprs_entries = sizeof(_bprs) / sizeof(ExtEckdBlockPtr);
113 static uint8_t _s2[MAX_SECTOR_SIZE * 3] __attribute__((__aligned__(PAGE_SIZE)));
114 static void *s2_prev_blk = _s2;
115 static void *s2_cur_blk = _s2 + MAX_SECTOR_SIZE;
116 static void *s2_next_blk = _s2 + MAX_SECTOR_SIZE * 2;
117 
118 static inline void verify_boot_info(BootInfo *bip)
119 {
120     IPL_assert(magic_match(bip->magic, ZIPL_MAGIC), "No zIPL sig in BootInfo");
121     IPL_assert(bip->version == BOOT_INFO_VERSION, "Wrong zIPL version");
122     IPL_assert(bip->bp_type == BOOT_INFO_BP_TYPE_IPL, "DASD is not for IPL");
123     IPL_assert(bip->dev_type == BOOT_INFO_DEV_TYPE_ECKD, "DASD is not ECKD");
124     IPL_assert(bip->flags == BOOT_INFO_FLAGS_ARCH, "Not for this arch");
125     IPL_assert(block_size_ok(bip->bp.ipl.bm_ptr.eckd.bptr.size),
126                "Bad block size in zIPL section of the 1st record.");
127 }
128 
129 static block_number_t eckd_block_num(EckdCHS *chs)
130 {
131     const uint64_t sectors = virtio_get_sectors();
132     const uint64_t heads = virtio_get_heads();
133     const uint64_t cylinder = chs->cylinder
134                             + ((chs->head & 0xfff0) << 12);
135     const uint64_t head = chs->head & 0x000f;
136     const block_number_t block = sectors * heads * cylinder
137                                + sectors * head
138                                + chs->sector
139                                - 1; /* block nr starts with zero */
140     return block;
141 }
142 
143 static bool eckd_valid_address(BootMapPointer *p)
144 {
145     const uint64_t head = p->eckd.chs.head & 0x000f;
146 
147     if (head >= virtio_get_heads()
148         ||  p->eckd.chs.sector > virtio_get_sectors()
149         ||  p->eckd.chs.sector <= 0) {
150         return false;
151     }
152 
153     if (!virtio_guessed_disk_nature() &&
154         eckd_block_num(&p->eckd.chs) >= virtio_get_blocks()) {
155         return false;
156     }
157 
158     return true;
159 }
160 
161 static block_number_t load_eckd_segments(block_number_t blk, uint64_t *address)
162 {
163     block_number_t block_nr;
164     int j, rc;
165     BootMapPointer *bprs = (void *)_bprs;
166     bool more_data;
167 
168     memset(_bprs, FREE_SPACE_FILLER, sizeof(_bprs));
169     read_block(blk, bprs, "BPRS read failed");
170 
171     do {
172         more_data = false;
173         for (j = 0;; j++) {
174             block_nr = eckd_block_num(&bprs[j].xeckd.bptr.chs);
175             if (is_null_block_number(block_nr)) { /* end of chunk */
176                 break;
177             }
178 
179             /* we need the updated blockno for the next indirect entry
180              * in the chain, but don't want to advance address
181              */
182             if (j == (max_bprs_entries - 1)) {
183                 break;
184             }
185 
186             IPL_assert(block_size_ok(bprs[j].xeckd.bptr.size),
187                        "bad chunk block size");
188             IPL_assert(eckd_valid_address(&bprs[j]), "bad chunk ECKD addr");
189 
190             if ((bprs[j].xeckd.bptr.count == 0) && unused_space(&(bprs[j+1]),
191                 sizeof(EckdBlockPtr))) {
192                 /* This is a "continue" pointer.
193                  * This ptr should be the last one in the current
194                  * script section.
195                  * I.e. the next ptr must point to the unused memory area
196                  */
197                 memset(_bprs, FREE_SPACE_FILLER, sizeof(_bprs));
198                 read_block(block_nr, bprs, "BPRS continuation read failed");
199                 more_data = true;
200                 break;
201             }
202 
203             /* Load (count+1) blocks of code at (block_nr)
204              * to memory (address).
205              */
206             rc = virtio_read_many(block_nr, (void *)(*address),
207                                   bprs[j].xeckd.bptr.count+1);
208             IPL_assert(rc == 0, "code chunk read failed");
209 
210             *address += (bprs[j].xeckd.bptr.count+1) * virtio_get_block_size();
211         }
212     } while (more_data);
213     return block_nr;
214 }
215 
216 static bool find_zipl_boot_menu_banner(int *offset)
217 {
218     int i;
219 
220     /* Menu banner starts with "zIPL" */
221     for (i = 0; i < virtio_get_block_size() - 4; i++) {
222         if (magic_match(s2_cur_blk + i, ZIPL_MAGIC_EBCDIC)) {
223             *offset = i;
224             return true;
225         }
226     }
227 
228     return false;
229 }
230 
231 static int eckd_get_boot_menu_index(block_number_t s1b_block_nr)
232 {
233     block_number_t cur_block_nr;
234     block_number_t prev_block_nr = 0;
235     block_number_t next_block_nr = 0;
236     EckdStage1b *s1b = (void *)sec;
237     int banner_offset;
238     int i;
239 
240     /* Get Stage1b data */
241     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
242     read_block(s1b_block_nr, s1b, "Cannot read stage1b boot loader");
243 
244     memset(_s2, FREE_SPACE_FILLER, sizeof(_s2));
245 
246     /* Get Stage2 data */
247     for (i = 0; i < STAGE2_BLK_CNT_MAX; i++) {
248         cur_block_nr = eckd_block_num(&s1b->seek[i].chs);
249 
250         if (!cur_block_nr) {
251             break;
252         }
253 
254         read_block(cur_block_nr, s2_cur_blk, "Cannot read stage2 boot loader");
255 
256         if (find_zipl_boot_menu_banner(&banner_offset)) {
257             /*
258              * Load the adjacent blocks to account for the
259              * possibility of menu data spanning multiple blocks.
260              */
261             if (prev_block_nr) {
262                 read_block(prev_block_nr, s2_prev_blk,
263                            "Cannot read stage2 boot loader");
264             }
265 
266             if (i + 1 < STAGE2_BLK_CNT_MAX) {
267                 next_block_nr = eckd_block_num(&s1b->seek[i + 1].chs);
268             }
269 
270             if (next_block_nr) {
271                 read_block(next_block_nr, s2_next_blk,
272                            "Cannot read stage2 boot loader");
273             }
274 
275             return menu_get_zipl_boot_index(s2_cur_blk + banner_offset);
276         }
277 
278         prev_block_nr = cur_block_nr;
279     }
280 
281     sclp_print("No zipl boot menu data found. Booting default entry.");
282     return 0;
283 }
284 
285 static void run_eckd_boot_script(block_number_t bmt_block_nr,
286                                  block_number_t s1b_block_nr)
287 {
288     int i;
289     unsigned int loadparm = get_loadparm_index();
290     block_number_t block_nr;
291     uint64_t address;
292     BootMapTable *bmt = (void *)sec;
293     BootMapScript *bms = (void *)sec;
294 
295     if (menu_is_enabled_zipl()) {
296         loadparm = eckd_get_boot_menu_index(s1b_block_nr);
297     }
298 
299     debug_print_int("loadparm", loadparm);
300     IPL_assert(loadparm <= MAX_TABLE_ENTRIES, "loadparm value greater than"
301                " maximum number of boot entries allowed");
302 
303     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
304     read_block(bmt_block_nr, sec, "Cannot read Boot Map Table");
305 
306     block_nr = eckd_block_num(&bmt->entry[loadparm].xeckd.bptr.chs);
307     IPL_assert(block_nr != -1, "Cannot find Boot Map Table Entry");
308 
309     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
310     read_block(block_nr, sec, "Cannot read Boot Map Script");
311 
312     for (i = 0; bms->entry[i].type == BOOT_SCRIPT_LOAD; i++) {
313         address = bms->entry[i].address.load_address;
314         block_nr = eckd_block_num(&bms->entry[i].blkptr.xeckd.bptr.chs);
315 
316         do {
317             block_nr = load_eckd_segments(block_nr, &address);
318         } while (block_nr != -1);
319     }
320 
321     IPL_assert(bms->entry[i].type == BOOT_SCRIPT_EXEC,
322                "Unknown script entry type");
323     jump_to_IPL_code(bms->entry[i].address.load_address); /* no return */
324 }
325 
326 static void ipl_eckd_cdl(void)
327 {
328     XEckdMbr *mbr;
329     EckdCdlIpl2 *ipl2 = (void *)sec;
330     IplVolumeLabel *vlbl = (void *)sec;
331     block_number_t bmt_block_nr, s1b_block_nr;
332 
333     /* we have just read the block #0 and recognized it as "IPL1" */
334     sclp_print("CDL\n");
335 
336     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
337     read_block(1, ipl2, "Cannot read IPL2 record at block 1");
338 
339     mbr = &ipl2->mbr;
340     IPL_assert(magic_match(mbr, ZIPL_MAGIC), "No zIPL section in IPL2 record.");
341     IPL_assert(block_size_ok(mbr->blockptr.xeckd.bptr.size),
342                "Bad block size in zIPL section of IPL2 record.");
343     IPL_assert(mbr->dev_type == DEV_TYPE_ECKD,
344                "Non-ECKD device type in zIPL section of IPL2 record.");
345 
346     /* save pointer to Boot Map Table */
347     bmt_block_nr = eckd_block_num(&mbr->blockptr.xeckd.bptr.chs);
348 
349     /* save pointer to Stage1b Data */
350     s1b_block_nr = eckd_block_num(&ipl2->stage1.seek[0].chs);
351 
352     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
353     read_block(2, vlbl, "Cannot read Volume Label at block 2");
354     IPL_assert(magic_match(vlbl->key, VOL1_MAGIC),
355                "Invalid magic of volume label block");
356     IPL_assert(magic_match(vlbl->f.key, VOL1_MAGIC),
357                "Invalid magic of volser block");
358     print_volser(vlbl->f.volser);
359 
360     run_eckd_boot_script(bmt_block_nr, s1b_block_nr);
361     /* no return */
362 }
363 
364 static void print_eckd_ldl_msg(ECKD_IPL_mode_t mode)
365 {
366     LDL_VTOC *vlbl = (void *)sec; /* already read, 3rd block */
367     char msg[4] = { '?', '.', '\n', '\0' };
368 
369     sclp_print((mode == ECKD_CMS) ? "CMS" : "LDL");
370     sclp_print(" version ");
371     switch (vlbl->LDL_version) {
372     case LDL1_VERSION:
373         msg[0] = '1';
374         break;
375     case LDL2_VERSION:
376         msg[0] = '2';
377         break;
378     default:
379         msg[0] = vlbl->LDL_version;
380         msg[0] &= 0x0f; /* convert EBCDIC   */
381         msg[0] |= 0x30; /* to ASCII (digit) */
382         msg[1] = '?';
383         break;
384     }
385     sclp_print(msg);
386     print_volser(vlbl->volser);
387 }
388 
389 static void ipl_eckd_ldl(ECKD_IPL_mode_t mode)
390 {
391     block_number_t bmt_block_nr, s1b_block_nr;
392     EckdLdlIpl1 *ipl1 = (void *)sec;
393 
394     if (mode != ECKD_LDL_UNLABELED) {
395         print_eckd_ldl_msg(mode);
396     }
397 
398     /* DO NOT read BootMap pointer (only one, xECKD) at block #2 */
399 
400     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
401     read_block(0, sec, "Cannot read block 0 to grab boot info.");
402     if (mode == ECKD_LDL_UNLABELED) {
403         if (!magic_match(ipl1->bip.magic, ZIPL_MAGIC)) {
404             return; /* not applicable layout */
405         }
406         sclp_print("unlabeled LDL.\n");
407     }
408     verify_boot_info(&ipl1->bip);
409 
410     /* save pointer to Boot Map Table */
411     bmt_block_nr = eckd_block_num(&ipl1->bip.bp.ipl.bm_ptr.eckd.bptr.chs);
412 
413     /* save pointer to Stage1b Data */
414     s1b_block_nr = eckd_block_num(&ipl1->stage1.seek[0].chs);
415 
416     run_eckd_boot_script(bmt_block_nr, s1b_block_nr);
417     /* no return */
418 }
419 
420 static void print_eckd_msg(void)
421 {
422     char msg[] = "Using ECKD scheme (block size *****), ";
423     char *p = &msg[34], *q = &msg[30];
424     int n = virtio_get_block_size();
425 
426     /* Fill in the block size and show up the message */
427     if (n > 0 && n <= 99999) {
428         while (n) {
429             *p-- = '0' + (n % 10);
430             n /= 10;
431         }
432         while (p >= q) {
433             *p-- = ' ';
434         }
435     }
436     sclp_print(msg);
437 }
438 
439 static void ipl_eckd(void)
440 {
441     XEckdMbr *mbr = (void *)sec;
442     LDL_VTOC *vlbl = (void *)sec;
443 
444     print_eckd_msg();
445 
446     /* Grab the MBR again */
447     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
448     read_block(0, mbr, "Cannot read block 0 on DASD");
449 
450     if (magic_match(mbr->magic, IPL1_MAGIC)) {
451         ipl_eckd_cdl(); /* no return */
452     }
453 
454     /* LDL/CMS? */
455     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
456     read_block(2, vlbl, "Cannot read block 2");
457 
458     if (magic_match(vlbl->magic, CMS1_MAGIC)) {
459         ipl_eckd_ldl(ECKD_CMS); /* no return */
460     }
461     if (magic_match(vlbl->magic, LNX1_MAGIC)) {
462         ipl_eckd_ldl(ECKD_LDL); /* no return */
463     }
464 
465     ipl_eckd_ldl(ECKD_LDL_UNLABELED); /* it still may return */
466     /*
467      * Ok, it is not a LDL by any means.
468      * It still might be a CDL with zero record keys for IPL1 and IPL2
469      */
470     ipl_eckd_cdl();
471 }
472 
473 /***********************************************************************
474  * IPL a SCSI disk
475  */
476 
477 static void zipl_load_segment(ComponentEntry *entry)
478 {
479     const int max_entries = (MAX_SECTOR_SIZE / sizeof(ScsiBlockPtr));
480     ScsiBlockPtr *bprs = (void *)sec;
481     const int bprs_size = sizeof(sec);
482     block_number_t blockno;
483     uint64_t address;
484     int i;
485     char err_msg[] = "zIPL failed to read BPRS at 0xZZZZZZZZZZZZZZZZ";
486     char *blk_no = &err_msg[30]; /* where to print blockno in (those ZZs) */
487 
488     blockno = entry->data.blockno;
489     address = entry->load_address;
490 
491     debug_print_int("loading segment at block", blockno);
492     debug_print_int("addr", address);
493 
494     do {
495         memset(bprs, FREE_SPACE_FILLER, bprs_size);
496         fill_hex_val(blk_no, &blockno, sizeof(blockno));
497         read_block(blockno, bprs, err_msg);
498 
499         for (i = 0;; i++) {
500             uint64_t *cur_desc = (void *)&bprs[i];
501 
502             blockno = bprs[i].blockno;
503             if (!blockno) {
504                 break;
505             }
506 
507             /* we need the updated blockno for the next indirect entry in the
508                chain, but don't want to advance address */
509             if (i == (max_entries - 1)) {
510                 break;
511             }
512 
513             if (bprs[i].blockct == 0 && unused_space(&bprs[i + 1],
514                 sizeof(ScsiBlockPtr))) {
515                 /* This is a "continue" pointer.
516                  * This ptr is the last one in the current script section.
517                  * I.e. the next ptr must point to the unused memory area.
518                  * The blockno is not zero, so the upper loop must continue
519                  * reading next section of BPRS.
520                  */
521                 break;
522             }
523             address = virtio_load_direct(cur_desc[0], cur_desc[1], 0,
524                                          (void *)address);
525             IPL_assert(address != -1, "zIPL load segment failed");
526         }
527     } while (blockno);
528 }
529 
530 /* Run a zipl program */
531 static void zipl_run(ScsiBlockPtr *pte)
532 {
533     ComponentHeader *header;
534     ComponentEntry *entry;
535     uint8_t tmp_sec[MAX_SECTOR_SIZE];
536 
537     read_block(pte->blockno, tmp_sec, "Cannot read header");
538     header = (ComponentHeader *)tmp_sec;
539 
540     IPL_assert(magic_match(tmp_sec, ZIPL_MAGIC), "No zIPL magic in header");
541     IPL_assert(header->type == ZIPL_COMP_HEADER_IPL, "Bad header type");
542 
543     dputs("start loading images\n");
544 
545     /* Load image(s) into RAM */
546     entry = (ComponentEntry *)(&header[1]);
547     while (entry->component_type == ZIPL_COMP_ENTRY_LOAD) {
548         zipl_load_segment(entry);
549 
550         entry++;
551 
552         IPL_assert((uint8_t *)(&entry[1]) <= (tmp_sec + MAX_SECTOR_SIZE),
553                    "Wrong entry value");
554     }
555 
556     IPL_assert(entry->component_type == ZIPL_COMP_ENTRY_EXEC, "No EXEC entry");
557 
558     /* should not return */
559     jump_to_IPL_code(entry->load_address);
560 }
561 
562 static void ipl_scsi(void)
563 {
564     ScsiMbr *mbr = (void *)sec;
565     int program_table_entries = 0;
566     BootMapTable *prog_table = (void *)sec;
567     unsigned int loadparm = get_loadparm_index();
568 
569     /* Grab the MBR */
570     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
571     read_block(0, mbr, "Cannot read block 0");
572 
573     if (!magic_match(mbr->magic, ZIPL_MAGIC)) {
574         return;
575     }
576 
577     sclp_print("Using SCSI scheme.\n");
578     debug_print_int("MBR Version", mbr->version_id);
579     IPL_check(mbr->version_id == 1,
580               "Unknown MBR layout version, assuming version 1");
581     debug_print_int("program table", mbr->pt.blockno);
582     IPL_assert(mbr->pt.blockno, "No Program Table");
583 
584     /* Parse the program table */
585     read_block(mbr->pt.blockno, sec, "Error reading Program Table");
586     IPL_assert(magic_match(sec, ZIPL_MAGIC), "No zIPL magic in PT");
587 
588     while (program_table_entries <= MAX_TABLE_ENTRIES) {
589         if (!prog_table->entry[program_table_entries].scsi.blockno) {
590             break;
591         }
592         program_table_entries++;
593     }
594 
595     debug_print_int("program table entries", program_table_entries);
596     IPL_assert(program_table_entries != 0, "Empty Program Table");
597 
598     if (menu_is_enabled_enum()) {
599         loadparm = menu_get_enum_boot_index(program_table_entries);
600     }
601 
602     debug_print_int("loadparm", loadparm);
603     IPL_assert(loadparm <= MAX_TABLE_ENTRIES, "loadparm value greater than"
604                " maximum number of boot entries allowed");
605 
606     zipl_run(&prog_table->entry[loadparm].scsi); /* no return */
607 }
608 
609 /***********************************************************************
610  * IPL El Torito ISO9660 image or DVD
611  */
612 
613 static bool is_iso_bc_entry_compatible(IsoBcSection *s)
614 {
615     uint8_t *magic_sec = (uint8_t *)(sec + ISO_SECTOR_SIZE);
616 
617     if (s->unused || !s->sector_count) {
618         return false;
619     }
620     read_iso_sector(bswap32(s->load_rba), magic_sec,
621                     "Failed to read image sector 0");
622 
623     /* Checking bytes 8 - 32 for S390 Linux magic */
624     return !memcmp(magic_sec + 8, linux_s390_magic, 24);
625 }
626 
627 /* Location of the current sector of the directory */
628 static uint32_t sec_loc[ISO9660_MAX_DIR_DEPTH];
629 /* Offset in the current sector of the directory */
630 static uint32_t sec_offset[ISO9660_MAX_DIR_DEPTH];
631 /* Remained directory space in bytes */
632 static uint32_t dir_rem[ISO9660_MAX_DIR_DEPTH];
633 
634 static inline uint32_t iso_get_file_size(uint32_t load_rba)
635 {
636     IsoVolDesc *vd = (IsoVolDesc *)sec;
637     IsoDirHdr *cur_record = &vd->vd.primary.rootdir;
638     uint8_t *temp = sec + ISO_SECTOR_SIZE;
639     int level = 0;
640 
641     read_iso_sector(ISO_PRIMARY_VD_SECTOR, sec,
642                     "Failed to read ISO primary descriptor");
643     sec_loc[0] = iso_733_to_u32(cur_record->ext_loc);
644     dir_rem[0] = 0;
645     sec_offset[0] = 0;
646 
647     while (level >= 0) {
648         IPL_assert(sec_offset[level] <= ISO_SECTOR_SIZE,
649                    "Directory tree structure violation");
650 
651         cur_record = (IsoDirHdr *)(temp + sec_offset[level]);
652 
653         if (sec_offset[level] == 0) {
654             read_iso_sector(sec_loc[level], temp,
655                             "Failed to read ISO directory");
656             if (dir_rem[level] == 0) {
657                 /* Skip self and parent records */
658                 dir_rem[level] = iso_733_to_u32(cur_record->data_len) -
659                                  cur_record->dr_len;
660                 sec_offset[level] += cur_record->dr_len;
661 
662                 cur_record = (IsoDirHdr *)(temp + sec_offset[level]);
663                 dir_rem[level] -= cur_record->dr_len;
664                 sec_offset[level] += cur_record->dr_len;
665                 continue;
666             }
667         }
668 
669         if (!cur_record->dr_len || sec_offset[level] == ISO_SECTOR_SIZE) {
670             /* Zero-padding and/or the end of current sector */
671             dir_rem[level] -= ISO_SECTOR_SIZE - sec_offset[level];
672             sec_offset[level] = 0;
673             sec_loc[level]++;
674         } else {
675             /* The directory record is valid */
676             if (load_rba == iso_733_to_u32(cur_record->ext_loc)) {
677                 return iso_733_to_u32(cur_record->data_len);
678             }
679 
680             dir_rem[level] -= cur_record->dr_len;
681             sec_offset[level] += cur_record->dr_len;
682 
683             if (cur_record->file_flags & 0x2) {
684                 /* Subdirectory */
685                 if (level == ISO9660_MAX_DIR_DEPTH - 1) {
686                     sclp_print("ISO-9660 directory depth limit exceeded\n");
687                 } else {
688                     level++;
689                     sec_loc[level] = iso_733_to_u32(cur_record->ext_loc);
690                     sec_offset[level] = 0;
691                     dir_rem[level] = 0;
692                     continue;
693                 }
694             }
695         }
696 
697         if (dir_rem[level] == 0) {
698             /* Nothing remaining */
699             level--;
700             read_iso_sector(sec_loc[level], temp,
701                             "Failed to read ISO directory");
702         }
703     }
704 
705     return 0;
706 }
707 
708 static void load_iso_bc_entry(IsoBcSection *load)
709 {
710     IsoBcSection s = *load;
711     /*
712      * According to spec, extent for each file
713      * is padded and ISO_SECTOR_SIZE bytes aligned
714      */
715     uint32_t blks_to_load = bswap16(s.sector_count) >> ET_SECTOR_SHIFT;
716     uint32_t real_size = iso_get_file_size(bswap32(s.load_rba));
717 
718     if (real_size) {
719         /* Round up blocks to load */
720         blks_to_load = (real_size + ISO_SECTOR_SIZE - 1) / ISO_SECTOR_SIZE;
721         sclp_print("ISO boot image size verified\n");
722     } else {
723         sclp_print("ISO boot image size could not be verified\n");
724     }
725 
726     read_iso_boot_image(bswap32(s.load_rba),
727                         (void *)((uint64_t)bswap16(s.load_segment)),
728                         blks_to_load);
729 
730     /* Trying to get PSW at zero address */
731     if (*((uint64_t *)0) & IPL_PSW_MASK) {
732         jump_to_IPL_code((*((uint64_t *)0)) & 0x7fffffff);
733     }
734 
735     /* Try default linux start address */
736     jump_to_IPL_code(KERN_IMAGE_START);
737 }
738 
739 static uint32_t find_iso_bc(void)
740 {
741     IsoVolDesc *vd = (IsoVolDesc *)sec;
742     uint32_t block_num = ISO_PRIMARY_VD_SECTOR;
743 
744     if (virtio_read_many(block_num++, sec, 1)) {
745         /* If primary vd cannot be read, there is no boot catalog */
746         return 0;
747     }
748 
749     while (is_iso_vd_valid(vd) && vd->type != VOL_DESC_TERMINATOR) {
750         if (vd->type == VOL_DESC_TYPE_BOOT) {
751             IsoVdElTorito *et = &vd->vd.boot;
752 
753             if (!memcmp(&et->el_torito[0], el_torito_magic, 32)) {
754                 return bswap32(et->bc_offset);
755             }
756         }
757         read_iso_sector(block_num++, sec,
758                         "Failed to read ISO volume descriptor");
759     }
760 
761     return 0;
762 }
763 
764 static IsoBcSection *find_iso_bc_entry(void)
765 {
766     IsoBcEntry *e = (IsoBcEntry *)sec;
767     uint32_t offset = find_iso_bc();
768     int i;
769     unsigned int loadparm = get_loadparm_index();
770 
771     if (!offset) {
772         return NULL;
773     }
774 
775     read_iso_sector(offset, sec, "Failed to read El Torito boot catalog");
776 
777     if (!is_iso_bc_valid(e)) {
778         /* The validation entry is mandatory */
779         panic("No valid boot catalog found!\n");
780         return NULL;
781     }
782 
783     /*
784      * Each entry has 32 bytes size, so one sector cannot contain > 64 entries.
785      * We consider only boot catalogs with no more than 64 entries.
786      */
787     for (i = 1; i < ISO_BC_ENTRY_PER_SECTOR; i++) {
788         if (e[i].id == ISO_BC_BOOTABLE_SECTION) {
789             if (is_iso_bc_entry_compatible(&e[i].body.sect)) {
790                 if (loadparm <= 1) {
791                     /* found, default, or unspecified */
792                     return &e[i].body.sect;
793                 }
794                 loadparm--;
795             }
796         }
797     }
798 
799     panic("No suitable boot entry found on ISO-9660 media!\n");
800 
801     return NULL;
802 }
803 
804 static void ipl_iso_el_torito(void)
805 {
806     IsoBcSection *s = find_iso_bc_entry();
807 
808     if (s) {
809         load_iso_bc_entry(s);
810         /* no return */
811     }
812 }
813 
814 /***********************************************************************
815  * Bus specific IPL sequences
816  */
817 
818 static void zipl_load_vblk(void)
819 {
820     if (virtio_guessed_disk_nature()) {
821         virtio_assume_iso9660();
822     }
823     ipl_iso_el_torito();
824 
825     if (virtio_guessed_disk_nature()) {
826         sclp_print("Using guessed DASD geometry.\n");
827         virtio_assume_eckd();
828     }
829     ipl_eckd();
830 }
831 
832 static void zipl_load_vscsi(void)
833 {
834     if (virtio_get_block_size() == VIRTIO_ISO_BLOCK_SIZE) {
835         /* Is it an ISO image in non-CD drive? */
836         ipl_iso_el_torito();
837     }
838 
839     sclp_print("Using guessed DASD geometry.\n");
840     virtio_assume_eckd();
841     ipl_eckd();
842 }
843 
844 /***********************************************************************
845  * IPL starts here
846  */
847 
848 void zipl_load(void)
849 {
850     VDev *vdev = virtio_get_device();
851 
852     if (vdev->is_cdrom) {
853         ipl_iso_el_torito();
854         panic("\n! Cannot IPL this ISO image !\n");
855     }
856 
857     if (virtio_get_device_type() == VIRTIO_ID_NET) {
858         jump_to_IPL_code(vdev->netboot_start_addr);
859     }
860 
861     ipl_scsi();
862 
863     switch (virtio_get_device_type()) {
864     case VIRTIO_ID_BLOCK:
865         zipl_load_vblk();
866         break;
867     case VIRTIO_ID_SCSI:
868         zipl_load_vscsi();
869         break;
870     default:
871         panic("\n! Unknown IPL device type !\n");
872     }
873 
874     panic("\n* this can never happen *\n");
875 }
876