xref: /openbmc/qemu/pc-bios/s390-ccw/bootmap.c (revision fc8c745d)
1 /*
2  * QEMU S390 bootmap interpreter
3  *
4  * Copyright (c) 2009 Alexander Graf <agraf@suse.de>
5  *
6  * This work is licensed under the terms of the GNU GPL, version 2 or (at
7  * your option) any later version. See the COPYING file in the top-level
8  * directory.
9  */
10 
11 #include "libc.h"
12 #include "s390-ccw.h"
13 #include "s390-arch.h"
14 #include "bootmap.h"
15 #include "virtio.h"
16 #include "bswap.h"
17 
18 #ifdef DEBUG
19 /* #define DEBUG_FALLBACK */
20 #endif
21 
22 #ifdef DEBUG_FALLBACK
23 #define dputs(txt) \
24     do { sclp_print("zipl: " txt); } while (0)
25 #else
26 #define dputs(fmt, ...) \
27     do { } while (0)
28 #endif
29 
30 /* Scratch space */
31 static uint8_t sec[MAX_SECTOR_SIZE*4] __attribute__((__aligned__(PAGE_SIZE)));
32 
33 const uint8_t el_torito_magic[] = "EL TORITO SPECIFICATION"
34                                   "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0";
35 
36 /*
37  * Match two CCWs located after PSW and eight filler bytes.
38  * From libmagic and arch/s390/kernel/head.S.
39  */
40 const uint8_t linux_s390_magic[] = "\x02\x00\x00\x18\x60\x00\x00\x50\x02\x00"
41                                    "\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40"
42                                    "\x40\x40\x40\x40";
43 
44 static inline bool is_iso_vd_valid(IsoVolDesc *vd)
45 {
46     const uint8_t vol_desc_magic[] = "CD001";
47 
48     return !memcmp(&vd->ident[0], vol_desc_magic, 5) &&
49            vd->version == 0x1 &&
50            vd->type <= VOL_DESC_TYPE_PARTITION;
51 }
52 
53 /***********************************************************************
54  * IPL an ECKD DASD (CDL or LDL/CMS format)
55  */
56 
57 static unsigned char _bprs[8*1024]; /* guessed "max" ECKD sector size */
58 static const int max_bprs_entries = sizeof(_bprs) / sizeof(ExtEckdBlockPtr);
59 static uint8_t _s2[MAX_SECTOR_SIZE * 3] __attribute__((__aligned__(PAGE_SIZE)));
60 static void *s2_prev_blk = _s2;
61 static void *s2_cur_blk = _s2 + MAX_SECTOR_SIZE;
62 static void *s2_next_blk = _s2 + MAX_SECTOR_SIZE * 2;
63 
64 static inline void verify_boot_info(BootInfo *bip)
65 {
66     IPL_assert(magic_match(bip->magic, ZIPL_MAGIC), "No zIPL sig in BootInfo");
67     IPL_assert(bip->version == BOOT_INFO_VERSION, "Wrong zIPL version");
68     IPL_assert(bip->bp_type == BOOT_INFO_BP_TYPE_IPL, "DASD is not for IPL");
69     IPL_assert(bip->dev_type == BOOT_INFO_DEV_TYPE_ECKD, "DASD is not ECKD");
70     IPL_assert(bip->flags == BOOT_INFO_FLAGS_ARCH, "Not for this arch");
71     IPL_assert(block_size_ok(bip->bp.ipl.bm_ptr.eckd.bptr.size),
72                "Bad block size in zIPL section of the 1st record.");
73 }
74 
75 static block_number_t eckd_block_num(EckdCHS *chs)
76 {
77     const uint64_t sectors = virtio_get_sectors();
78     const uint64_t heads = virtio_get_heads();
79     const uint64_t cylinder = chs->cylinder
80                             + ((chs->head & 0xfff0) << 12);
81     const uint64_t head = chs->head & 0x000f;
82     const block_number_t block = sectors * heads * cylinder
83                                + sectors * head
84                                + chs->sector
85                                - 1; /* block nr starts with zero */
86     return block;
87 }
88 
89 static bool eckd_valid_address(BootMapPointer *p)
90 {
91     const uint64_t head = p->eckd.chs.head & 0x000f;
92 
93     if (head >= virtio_get_heads()
94         ||  p->eckd.chs.sector > virtio_get_sectors()
95         ||  p->eckd.chs.sector <= 0) {
96         return false;
97     }
98 
99     if (!virtio_guessed_disk_nature() &&
100         eckd_block_num(&p->eckd.chs) >= virtio_get_blocks()) {
101         return false;
102     }
103 
104     return true;
105 }
106 
107 static block_number_t load_eckd_segments(block_number_t blk, uint64_t *address)
108 {
109     block_number_t block_nr;
110     int j, rc;
111     BootMapPointer *bprs = (void *)_bprs;
112     bool more_data;
113 
114     memset(_bprs, FREE_SPACE_FILLER, sizeof(_bprs));
115     read_block(blk, bprs, "BPRS read failed");
116 
117     do {
118         more_data = false;
119         for (j = 0;; j++) {
120             block_nr = eckd_block_num(&bprs[j].xeckd.bptr.chs);
121             if (is_null_block_number(block_nr)) { /* end of chunk */
122                 break;
123             }
124 
125             /* we need the updated blockno for the next indirect entry
126              * in the chain, but don't want to advance address
127              */
128             if (j == (max_bprs_entries - 1)) {
129                 break;
130             }
131 
132             IPL_assert(block_size_ok(bprs[j].xeckd.bptr.size),
133                        "bad chunk block size");
134             IPL_assert(eckd_valid_address(&bprs[j]), "bad chunk ECKD addr");
135 
136             if ((bprs[j].xeckd.bptr.count == 0) && unused_space(&(bprs[j+1]),
137                 sizeof(EckdBlockPtr))) {
138                 /* This is a "continue" pointer.
139                  * This ptr should be the last one in the current
140                  * script section.
141                  * I.e. the next ptr must point to the unused memory area
142                  */
143                 memset(_bprs, FREE_SPACE_FILLER, sizeof(_bprs));
144                 read_block(block_nr, bprs, "BPRS continuation read failed");
145                 more_data = true;
146                 break;
147             }
148 
149             /* Load (count+1) blocks of code at (block_nr)
150              * to memory (address).
151              */
152             rc = virtio_read_many(block_nr, (void *)(*address),
153                                   bprs[j].xeckd.bptr.count+1);
154             IPL_assert(rc == 0, "code chunk read failed");
155 
156             *address += (bprs[j].xeckd.bptr.count+1) * virtio_get_block_size();
157         }
158     } while (more_data);
159     return block_nr;
160 }
161 
162 static bool find_zipl_boot_menu_banner(int *offset)
163 {
164     int i;
165 
166     /* Menu banner starts with "zIPL" */
167     for (i = 0; i <= virtio_get_block_size() - 4; i++) {
168         if (magic_match(s2_cur_blk + i, ZIPL_MAGIC_EBCDIC)) {
169             *offset = i;
170             return true;
171         }
172     }
173 
174     return false;
175 }
176 
177 static int eckd_get_boot_menu_index(block_number_t s1b_block_nr)
178 {
179     block_number_t cur_block_nr;
180     block_number_t prev_block_nr = 0;
181     block_number_t next_block_nr = 0;
182     EckdStage1b *s1b = (void *)sec;
183     int banner_offset;
184     int i;
185 
186     /* Get Stage1b data */
187     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
188     read_block(s1b_block_nr, s1b, "Cannot read stage1b boot loader");
189 
190     memset(_s2, FREE_SPACE_FILLER, sizeof(_s2));
191 
192     /* Get Stage2 data */
193     for (i = 0; i < STAGE2_BLK_CNT_MAX; i++) {
194         cur_block_nr = eckd_block_num(&s1b->seek[i].chs);
195 
196         if (!cur_block_nr || is_null_block_number(cur_block_nr)) {
197             break;
198         }
199 
200         read_block(cur_block_nr, s2_cur_blk, "Cannot read stage2 boot loader");
201 
202         if (find_zipl_boot_menu_banner(&banner_offset)) {
203             /*
204              * Load the adjacent blocks to account for the
205              * possibility of menu data spanning multiple blocks.
206              */
207             if (prev_block_nr) {
208                 read_block(prev_block_nr, s2_prev_blk,
209                            "Cannot read stage2 boot loader");
210             }
211 
212             if (i + 1 < STAGE2_BLK_CNT_MAX) {
213                 next_block_nr = eckd_block_num(&s1b->seek[i + 1].chs);
214             }
215 
216             if (next_block_nr && !is_null_block_number(next_block_nr)) {
217                 read_block(next_block_nr, s2_next_blk,
218                            "Cannot read stage2 boot loader");
219             }
220 
221             return menu_get_zipl_boot_index(s2_cur_blk + banner_offset);
222         }
223 
224         prev_block_nr = cur_block_nr;
225     }
226 
227     sclp_print("No zipl boot menu data found. Booting default entry.");
228     return 0;
229 }
230 
231 static void run_eckd_boot_script(block_number_t bmt_block_nr,
232                                  block_number_t s1b_block_nr)
233 {
234     int i;
235     unsigned int loadparm = get_loadparm_index();
236     block_number_t block_nr;
237     uint64_t address;
238     BootMapTable *bmt = (void *)sec;
239     BootMapScript *bms = (void *)sec;
240 
241     if (menu_is_enabled_zipl()) {
242         loadparm = eckd_get_boot_menu_index(s1b_block_nr);
243     }
244 
245     debug_print_int("loadparm", loadparm);
246     IPL_assert(loadparm < MAX_BOOT_ENTRIES, "loadparm value greater than"
247                " maximum number of boot entries allowed");
248 
249     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
250     read_block(bmt_block_nr, sec, "Cannot read Boot Map Table");
251 
252     block_nr = eckd_block_num(&bmt->entry[loadparm].xeckd.bptr.chs);
253     IPL_assert(block_nr != -1, "Cannot find Boot Map Table Entry");
254 
255     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
256     read_block(block_nr, sec, "Cannot read Boot Map Script");
257 
258     for (i = 0; bms->entry[i].type == BOOT_SCRIPT_LOAD ||
259                 bms->entry[i].type == BOOT_SCRIPT_SIGNATURE; i++) {
260 
261         /* We don't support secure boot yet, so we skip signature entries */
262         if (bms->entry[i].type == BOOT_SCRIPT_SIGNATURE) {
263             continue;
264         }
265 
266         address = bms->entry[i].address.load_address;
267         block_nr = eckd_block_num(&bms->entry[i].blkptr.xeckd.bptr.chs);
268 
269         do {
270             block_nr = load_eckd_segments(block_nr, &address);
271         } while (block_nr != -1);
272     }
273 
274     IPL_assert(bms->entry[i].type == BOOT_SCRIPT_EXEC,
275                "Unknown script entry type");
276     write_reset_psw(bms->entry[i].address.load_address); /* no return */
277     jump_to_IPL_code(0); /* no return */
278 }
279 
280 static void ipl_eckd_cdl(void)
281 {
282     XEckdMbr *mbr;
283     EckdCdlIpl2 *ipl2 = (void *)sec;
284     IplVolumeLabel *vlbl = (void *)sec;
285     block_number_t bmt_block_nr, s1b_block_nr;
286 
287     /* we have just read the block #0 and recognized it as "IPL1" */
288     sclp_print("CDL\n");
289 
290     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
291     read_block(1, ipl2, "Cannot read IPL2 record at block 1");
292 
293     mbr = &ipl2->mbr;
294     if (!magic_match(mbr, ZIPL_MAGIC)) {
295         sclp_print("No zIPL section in IPL2 record.\n");
296         return;
297     }
298     if (!block_size_ok(mbr->blockptr.xeckd.bptr.size)) {
299         sclp_print("Bad block size in zIPL section of IPL2 record.\n");
300         return;
301     }
302     if (mbr->dev_type != DEV_TYPE_ECKD) {
303         sclp_print("Non-ECKD device type in zIPL section of IPL2 record.\n");
304         return;
305     }
306 
307     /* save pointer to Boot Map Table */
308     bmt_block_nr = eckd_block_num(&mbr->blockptr.xeckd.bptr.chs);
309 
310     /* save pointer to Stage1b Data */
311     s1b_block_nr = eckd_block_num(&ipl2->stage1.seek[0].chs);
312 
313     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
314     read_block(2, vlbl, "Cannot read Volume Label at block 2");
315     if (!magic_match(vlbl->key, VOL1_MAGIC)) {
316         sclp_print("Invalid magic of volume label block.\n");
317         return;
318     }
319     if (!magic_match(vlbl->f.key, VOL1_MAGIC)) {
320         sclp_print("Invalid magic of volser block.\n");
321         return;
322     }
323     print_volser(vlbl->f.volser);
324 
325     run_eckd_boot_script(bmt_block_nr, s1b_block_nr);
326     /* no return */
327 }
328 
329 static void print_eckd_ldl_msg(ECKD_IPL_mode_t mode)
330 {
331     LDL_VTOC *vlbl = (void *)sec; /* already read, 3rd block */
332     char msg[4] = { '?', '.', '\n', '\0' };
333 
334     sclp_print((mode == ECKD_CMS) ? "CMS" : "LDL");
335     sclp_print(" version ");
336     switch (vlbl->LDL_version) {
337     case LDL1_VERSION:
338         msg[0] = '1';
339         break;
340     case LDL2_VERSION:
341         msg[0] = '2';
342         break;
343     default:
344         msg[0] = ebc2asc[vlbl->LDL_version];
345         msg[1] = '?';
346         break;
347     }
348     sclp_print(msg);
349     print_volser(vlbl->volser);
350 }
351 
352 static void ipl_eckd_ldl(ECKD_IPL_mode_t mode)
353 {
354     block_number_t bmt_block_nr, s1b_block_nr;
355     EckdLdlIpl1 *ipl1 = (void *)sec;
356 
357     if (mode != ECKD_LDL_UNLABELED) {
358         print_eckd_ldl_msg(mode);
359     }
360 
361     /* DO NOT read BootMap pointer (only one, xECKD) at block #2 */
362 
363     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
364     read_block(0, sec, "Cannot read block 0 to grab boot info.");
365     if (mode == ECKD_LDL_UNLABELED) {
366         if (!magic_match(ipl1->bip.magic, ZIPL_MAGIC)) {
367             return; /* not applicable layout */
368         }
369         sclp_print("unlabeled LDL.\n");
370     }
371     verify_boot_info(&ipl1->bip);
372 
373     /* save pointer to Boot Map Table */
374     bmt_block_nr = eckd_block_num(&ipl1->bip.bp.ipl.bm_ptr.eckd.bptr.chs);
375 
376     /* save pointer to Stage1b Data */
377     s1b_block_nr = eckd_block_num(&ipl1->stage1.seek[0].chs);
378 
379     run_eckd_boot_script(bmt_block_nr, s1b_block_nr);
380     /* no return */
381 }
382 
383 static void print_eckd_msg(void)
384 {
385     char msg[] = "Using ECKD scheme (block size *****), ";
386     char *p = &msg[34], *q = &msg[30];
387     int n = virtio_get_block_size();
388 
389     /* Fill in the block size and show up the message */
390     if (n > 0 && n <= 99999) {
391         while (n) {
392             *p-- = '0' + (n % 10);
393             n /= 10;
394         }
395         while (p >= q) {
396             *p-- = ' ';
397         }
398     }
399     sclp_print(msg);
400 }
401 
402 static void ipl_eckd(void)
403 {
404     XEckdMbr *mbr = (void *)sec;
405     LDL_VTOC *vlbl = (void *)sec;
406 
407     print_eckd_msg();
408 
409     /* Grab the MBR again */
410     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
411     read_block(0, mbr, "Cannot read block 0 on DASD");
412 
413     if (magic_match(mbr->magic, IPL1_MAGIC)) {
414         ipl_eckd_cdl();         /* only returns in case of error */
415         return;
416     }
417 
418     /* LDL/CMS? */
419     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
420     read_block(2, vlbl, "Cannot read block 2");
421 
422     if (magic_match(vlbl->magic, CMS1_MAGIC)) {
423         ipl_eckd_ldl(ECKD_CMS); /* no return */
424     }
425     if (magic_match(vlbl->magic, LNX1_MAGIC)) {
426         ipl_eckd_ldl(ECKD_LDL); /* no return */
427     }
428 
429     ipl_eckd_ldl(ECKD_LDL_UNLABELED); /* it still may return */
430     /*
431      * Ok, it is not a LDL by any means.
432      * It still might be a CDL with zero record keys for IPL1 and IPL2
433      */
434     ipl_eckd_cdl();
435 }
436 
437 /***********************************************************************
438  * IPL a SCSI disk
439  */
440 
441 static void zipl_load_segment(ComponentEntry *entry)
442 {
443     const int max_entries = (MAX_SECTOR_SIZE / sizeof(ScsiBlockPtr));
444     ScsiBlockPtr *bprs = (void *)sec;
445     const int bprs_size = sizeof(sec);
446     block_number_t blockno;
447     uint64_t address;
448     int i;
449     char err_msg[] = "zIPL failed to read BPRS at 0xZZZZZZZZZZZZZZZZ";
450     char *blk_no = &err_msg[30]; /* where to print blockno in (those ZZs) */
451 
452     blockno = entry->data.blockno;
453     address = entry->compdat.load_addr;
454 
455     debug_print_int("loading segment at block", blockno);
456     debug_print_int("addr", address);
457 
458     do {
459         memset(bprs, FREE_SPACE_FILLER, bprs_size);
460         fill_hex_val(blk_no, &blockno, sizeof(blockno));
461         read_block(blockno, bprs, err_msg);
462 
463         for (i = 0;; i++) {
464             uint64_t *cur_desc = (void *)&bprs[i];
465 
466             blockno = bprs[i].blockno;
467             if (!blockno) {
468                 break;
469             }
470 
471             /* we need the updated blockno for the next indirect entry in the
472                chain, but don't want to advance address */
473             if (i == (max_entries - 1)) {
474                 break;
475             }
476 
477             if (bprs[i].blockct == 0 && unused_space(&bprs[i + 1],
478                 sizeof(ScsiBlockPtr))) {
479                 /* This is a "continue" pointer.
480                  * This ptr is the last one in the current script section.
481                  * I.e. the next ptr must point to the unused memory area.
482                  * The blockno is not zero, so the upper loop must continue
483                  * reading next section of BPRS.
484                  */
485                 break;
486             }
487             address = virtio_load_direct(cur_desc[0], cur_desc[1], 0,
488                                          (void *)address);
489             IPL_assert(address != -1, "zIPL load segment failed");
490         }
491     } while (blockno);
492 }
493 
494 /* Run a zipl program */
495 static void zipl_run(ScsiBlockPtr *pte)
496 {
497     ComponentHeader *header;
498     ComponentEntry *entry;
499     uint8_t tmp_sec[MAX_SECTOR_SIZE];
500 
501     read_block(pte->blockno, tmp_sec, "Cannot read header");
502     header = (ComponentHeader *)tmp_sec;
503 
504     IPL_assert(magic_match(tmp_sec, ZIPL_MAGIC), "No zIPL magic in header");
505     IPL_assert(header->type == ZIPL_COMP_HEADER_IPL, "Bad header type");
506 
507     dputs("start loading images\n");
508 
509     /* Load image(s) into RAM */
510     entry = (ComponentEntry *)(&header[1]);
511     while (entry->component_type == ZIPL_COMP_ENTRY_LOAD ||
512            entry->component_type == ZIPL_COMP_ENTRY_SIGNATURE) {
513 
514         /* We don't support secure boot yet, so we skip signature entries */
515         if (entry->component_type == ZIPL_COMP_ENTRY_SIGNATURE) {
516             entry++;
517             continue;
518         }
519 
520         zipl_load_segment(entry);
521 
522         entry++;
523 
524         IPL_assert((uint8_t *)(&entry[1]) <= (tmp_sec + MAX_SECTOR_SIZE),
525                    "Wrong entry value");
526     }
527 
528     IPL_assert(entry->component_type == ZIPL_COMP_ENTRY_EXEC, "No EXEC entry");
529 
530     /* should not return */
531     write_reset_psw(entry->compdat.load_psw);
532     jump_to_IPL_code(0);
533 }
534 
535 static void ipl_scsi(void)
536 {
537     ScsiMbr *mbr = (void *)sec;
538     int program_table_entries = 0;
539     BootMapTable *prog_table = (void *)sec;
540     unsigned int loadparm = get_loadparm_index();
541     bool valid_entries[MAX_BOOT_ENTRIES] = {false};
542     size_t i;
543 
544     /* Grab the MBR */
545     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
546     read_block(0, mbr, "Cannot read block 0");
547 
548     if (!magic_match(mbr->magic, ZIPL_MAGIC)) {
549         return;
550     }
551 
552     sclp_print("Using SCSI scheme.\n");
553     debug_print_int("MBR Version", mbr->version_id);
554     IPL_check(mbr->version_id == 1,
555               "Unknown MBR layout version, assuming version 1");
556     debug_print_int("program table", mbr->pt.blockno);
557     IPL_assert(mbr->pt.blockno, "No Program Table");
558 
559     /* Parse the program table */
560     read_block(mbr->pt.blockno, sec, "Error reading Program Table");
561     IPL_assert(magic_match(sec, ZIPL_MAGIC), "No zIPL magic in PT");
562 
563     for (i = 0; i < MAX_BOOT_ENTRIES; i++) {
564         if (prog_table->entry[i].scsi.blockno) {
565             valid_entries[i] = true;
566             program_table_entries++;
567         }
568     }
569 
570     debug_print_int("program table entries", program_table_entries);
571     IPL_assert(program_table_entries != 0, "Empty Program Table");
572 
573     if (menu_is_enabled_enum()) {
574         loadparm = menu_get_enum_boot_index(valid_entries);
575     }
576 
577     debug_print_int("loadparm", loadparm);
578     IPL_assert(loadparm < MAX_BOOT_ENTRIES, "loadparm value greater than"
579                " maximum number of boot entries allowed");
580 
581     zipl_run(&prog_table->entry[loadparm].scsi); /* no return */
582 }
583 
584 /***********************************************************************
585  * IPL El Torito ISO9660 image or DVD
586  */
587 
588 static bool is_iso_bc_entry_compatible(IsoBcSection *s)
589 {
590     uint8_t *magic_sec = (uint8_t *)(sec + ISO_SECTOR_SIZE);
591 
592     if (s->unused || !s->sector_count) {
593         return false;
594     }
595     read_iso_sector(bswap32(s->load_rba), magic_sec,
596                     "Failed to read image sector 0");
597 
598     /* Checking bytes 8 - 32 for S390 Linux magic */
599     return !memcmp(magic_sec + 8, linux_s390_magic, 24);
600 }
601 
602 /* Location of the current sector of the directory */
603 static uint32_t sec_loc[ISO9660_MAX_DIR_DEPTH];
604 /* Offset in the current sector of the directory */
605 static uint32_t sec_offset[ISO9660_MAX_DIR_DEPTH];
606 /* Remained directory space in bytes */
607 static uint32_t dir_rem[ISO9660_MAX_DIR_DEPTH];
608 
609 static inline uint32_t iso_get_file_size(uint32_t load_rba)
610 {
611     IsoVolDesc *vd = (IsoVolDesc *)sec;
612     IsoDirHdr *cur_record = &vd->vd.primary.rootdir;
613     uint8_t *temp = sec + ISO_SECTOR_SIZE;
614     int level = 0;
615 
616     read_iso_sector(ISO_PRIMARY_VD_SECTOR, sec,
617                     "Failed to read ISO primary descriptor");
618     sec_loc[0] = iso_733_to_u32(cur_record->ext_loc);
619     dir_rem[0] = 0;
620     sec_offset[0] = 0;
621 
622     while (level >= 0) {
623         IPL_assert(sec_offset[level] <= ISO_SECTOR_SIZE,
624                    "Directory tree structure violation");
625 
626         cur_record = (IsoDirHdr *)(temp + sec_offset[level]);
627 
628         if (sec_offset[level] == 0) {
629             read_iso_sector(sec_loc[level], temp,
630                             "Failed to read ISO directory");
631             if (dir_rem[level] == 0) {
632                 /* Skip self and parent records */
633                 dir_rem[level] = iso_733_to_u32(cur_record->data_len) -
634                                  cur_record->dr_len;
635                 sec_offset[level] += cur_record->dr_len;
636 
637                 cur_record = (IsoDirHdr *)(temp + sec_offset[level]);
638                 dir_rem[level] -= cur_record->dr_len;
639                 sec_offset[level] += cur_record->dr_len;
640                 continue;
641             }
642         }
643 
644         if (!cur_record->dr_len || sec_offset[level] == ISO_SECTOR_SIZE) {
645             /* Zero-padding and/or the end of current sector */
646             dir_rem[level] -= ISO_SECTOR_SIZE - sec_offset[level];
647             sec_offset[level] = 0;
648             sec_loc[level]++;
649         } else {
650             /* The directory record is valid */
651             if (load_rba == iso_733_to_u32(cur_record->ext_loc)) {
652                 return iso_733_to_u32(cur_record->data_len);
653             }
654 
655             dir_rem[level] -= cur_record->dr_len;
656             sec_offset[level] += cur_record->dr_len;
657 
658             if (cur_record->file_flags & 0x2) {
659                 /* Subdirectory */
660                 if (level == ISO9660_MAX_DIR_DEPTH - 1) {
661                     sclp_print("ISO-9660 directory depth limit exceeded\n");
662                 } else {
663                     level++;
664                     sec_loc[level] = iso_733_to_u32(cur_record->ext_loc);
665                     sec_offset[level] = 0;
666                     dir_rem[level] = 0;
667                     continue;
668                 }
669             }
670         }
671 
672         if (dir_rem[level] == 0) {
673             /* Nothing remaining */
674             level--;
675             read_iso_sector(sec_loc[level], temp,
676                             "Failed to read ISO directory");
677         }
678     }
679 
680     return 0;
681 }
682 
683 static void load_iso_bc_entry(IsoBcSection *load)
684 {
685     IsoBcSection s = *load;
686     /*
687      * According to spec, extent for each file
688      * is padded and ISO_SECTOR_SIZE bytes aligned
689      */
690     uint32_t blks_to_load = bswap16(s.sector_count) >> ET_SECTOR_SHIFT;
691     uint32_t real_size = iso_get_file_size(bswap32(s.load_rba));
692 
693     if (real_size) {
694         /* Round up blocks to load */
695         blks_to_load = (real_size + ISO_SECTOR_SIZE - 1) / ISO_SECTOR_SIZE;
696         sclp_print("ISO boot image size verified\n");
697     } else {
698         sclp_print("ISO boot image size could not be verified\n");
699     }
700 
701     read_iso_boot_image(bswap32(s.load_rba),
702                         (void *)((uint64_t)bswap16(s.load_segment)),
703                         blks_to_load);
704 
705     jump_to_low_kernel();
706 }
707 
708 static uint32_t find_iso_bc(void)
709 {
710     IsoVolDesc *vd = (IsoVolDesc *)sec;
711     uint32_t block_num = ISO_PRIMARY_VD_SECTOR;
712 
713     if (virtio_read_many(block_num++, sec, 1)) {
714         /* If primary vd cannot be read, there is no boot catalog */
715         return 0;
716     }
717 
718     while (is_iso_vd_valid(vd) && vd->type != VOL_DESC_TERMINATOR) {
719         if (vd->type == VOL_DESC_TYPE_BOOT) {
720             IsoVdElTorito *et = &vd->vd.boot;
721 
722             if (!memcmp(&et->el_torito[0], el_torito_magic, 32)) {
723                 return bswap32(et->bc_offset);
724             }
725         }
726         read_iso_sector(block_num++, sec,
727                         "Failed to read ISO volume descriptor");
728     }
729 
730     return 0;
731 }
732 
733 static IsoBcSection *find_iso_bc_entry(void)
734 {
735     IsoBcEntry *e = (IsoBcEntry *)sec;
736     uint32_t offset = find_iso_bc();
737     int i;
738     unsigned int loadparm = get_loadparm_index();
739 
740     if (!offset) {
741         return NULL;
742     }
743 
744     read_iso_sector(offset, sec, "Failed to read El Torito boot catalog");
745 
746     if (!is_iso_bc_valid(e)) {
747         /* The validation entry is mandatory */
748         panic("No valid boot catalog found!\n");
749         return NULL;
750     }
751 
752     /*
753      * Each entry has 32 bytes size, so one sector cannot contain > 64 entries.
754      * We consider only boot catalogs with no more than 64 entries.
755      */
756     for (i = 1; i < ISO_BC_ENTRY_PER_SECTOR; i++) {
757         if (e[i].id == ISO_BC_BOOTABLE_SECTION) {
758             if (is_iso_bc_entry_compatible(&e[i].body.sect)) {
759                 if (loadparm <= 1) {
760                     /* found, default, or unspecified */
761                     return &e[i].body.sect;
762                 }
763                 loadparm--;
764             }
765         }
766     }
767 
768     panic("No suitable boot entry found on ISO-9660 media!\n");
769 
770     return NULL;
771 }
772 
773 static void ipl_iso_el_torito(void)
774 {
775     IsoBcSection *s = find_iso_bc_entry();
776 
777     if (s) {
778         load_iso_bc_entry(s);
779         /* no return */
780     }
781 }
782 
783 /***********************************************************************
784  * Bus specific IPL sequences
785  */
786 
787 static void zipl_load_vblk(void)
788 {
789     if (virtio_guessed_disk_nature()) {
790         virtio_assume_iso9660();
791     }
792     ipl_iso_el_torito();
793 
794     if (virtio_guessed_disk_nature()) {
795         sclp_print("Using guessed DASD geometry.\n");
796         virtio_assume_eckd();
797     }
798     ipl_eckd();
799 }
800 
801 static void zipl_load_vscsi(void)
802 {
803     if (virtio_get_block_size() == VIRTIO_ISO_BLOCK_SIZE) {
804         /* Is it an ISO image in non-CD drive? */
805         ipl_iso_el_torito();
806     }
807 
808     sclp_print("Using guessed DASD geometry.\n");
809     virtio_assume_eckd();
810     ipl_eckd();
811 }
812 
813 /***********************************************************************
814  * IPL starts here
815  */
816 
817 void zipl_load(void)
818 {
819     VDev *vdev = virtio_get_device();
820 
821     if (vdev->is_cdrom) {
822         ipl_iso_el_torito();
823         panic("\n! Cannot IPL this ISO image !\n");
824     }
825 
826     if (virtio_get_device_type() == VIRTIO_ID_NET) {
827         jump_to_IPL_code(vdev->netboot_start_addr);
828     }
829 
830     ipl_scsi();
831 
832     switch (virtio_get_device_type()) {
833     case VIRTIO_ID_BLOCK:
834         zipl_load_vblk();
835         break;
836     case VIRTIO_ID_SCSI:
837         zipl_load_vscsi();
838         break;
839     default:
840         panic("\n! Unknown IPL device type !\n");
841     }
842 
843     sclp_print("zIPL load failed.\n");
844 }
845