2 * QEMU RISC-V Boot Helper
4 * Copyright (c) 2017 SiFive, Inc.
5 * Copyright (c) 2019 Alistair Francis <alistair.francis@wdc.com>
7 * This program is free software; you can redistribute it and/or modify it
8 * under the terms and conditions of the GNU General Public License,
9 * version 2 or later, as published by the Free Software Foundation.
11 * This program is distributed in the hope it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
16 * You should have received a copy of the GNU General Public License along with
17 * this program. If not, see <http://www.gnu.org/licenses/>.
20 #include "qemu/osdep.h"
21 #include "qemu/datadir.h"
22 #include "qemu/units.h"
23 #include "qemu/error-report.h"
24 #include "exec/cpu-defs.h"
25 #include "hw/boards.h"
26 #include "hw/loader.h"
27 #include "hw/riscv/boot.h"
28 #include "hw/riscv/boot_opensbi.h"
30 #include "sysemu/device_tree.h"
31 #include "sysemu/qtest.h"
32 #include "sysemu/kvm.h"
33 #include "sysemu/reset.h"
37 bool riscv_is_32bit(RISCVHartArrayState
*harts
)
39 return harts
->harts
[0].env
.misa_mxl_max
== MXL_RV32
;
43 * Return the per-socket PLIC hart topology configuration string
44 * (caller must free with g_free())
46 char *riscv_plic_hart_config_string(int hart_count
)
48 g_autofree
const char **vals
= g_new(const char *, hart_count
+ 1);
51 for (i
= 0; i
< hart_count
; i
++) {
52 CPUState
*cs
= qemu_get_cpu(i
);
53 CPURISCVState
*env
= &RISCV_CPU(cs
)->env
;
57 } else if (riscv_has_ext(env
, RVS
)) {
65 /* g_strjoinv() obliges us to cast away const here */
66 return g_strjoinv(",", (char **)vals
);
69 target_ulong
riscv_calc_kernel_start_addr(RISCVHartArrayState
*harts
,
70 target_ulong firmware_end_addr
) {
71 if (riscv_is_32bit(harts
)) {
72 return QEMU_ALIGN_UP(firmware_end_addr
, 4 * MiB
);
74 return QEMU_ALIGN_UP(firmware_end_addr
, 2 * MiB
);
78 const char *riscv_default_firmware_name(RISCVHartArrayState
*harts
)
80 if (riscv_is_32bit(harts
)) {
81 return RISCV32_BIOS_BIN
;
84 return RISCV64_BIOS_BIN
;
87 static char *riscv_find_bios(const char *bios_filename
)
91 filename
= qemu_find_file(QEMU_FILE_TYPE_BIOS
, bios_filename
);
92 if (filename
== NULL
) {
93 if (!qtest_enabled()) {
95 * We only ship OpenSBI binary bios images in the QEMU source.
96 * For machines that use images other than the default bios,
97 * running QEMU test will complain hence let's suppress the error
98 * report for QEMU testing.
100 error_report("Unable to find the RISC-V BIOS \"%s\"",
109 char *riscv_find_firmware(const char *firmware_filename
,
110 const char *default_machine_firmware
)
112 char *filename
= NULL
;
114 if ((!firmware_filename
) || (!strcmp(firmware_filename
, "default"))) {
116 * The user didn't specify -bios, or has specified "-bios default".
117 * That means we are going to load the OpenSBI binary included in
120 filename
= riscv_find_bios(default_machine_firmware
);
121 } else if (strcmp(firmware_filename
, "none")) {
122 filename
= riscv_find_bios(firmware_filename
);
128 target_ulong
riscv_find_and_load_firmware(MachineState
*machine
,
129 const char *default_machine_firmware
,
130 hwaddr firmware_load_addr
,
133 char *firmware_filename
;
134 target_ulong firmware_end_addr
= firmware_load_addr
;
136 firmware_filename
= riscv_find_firmware(machine
->firmware
,
137 default_machine_firmware
);
139 if (firmware_filename
) {
140 /* If not "none" load the firmware */
141 firmware_end_addr
= riscv_load_firmware(firmware_filename
,
142 firmware_load_addr
, sym_cb
);
143 g_free(firmware_filename
);
146 return firmware_end_addr
;
149 target_ulong
riscv_load_firmware(const char *firmware_filename
,
150 hwaddr firmware_load_addr
,
153 uint64_t firmware_entry
, firmware_end
;
154 ssize_t firmware_size
;
156 g_assert(firmware_filename
!= NULL
);
158 if (load_elf_ram_sym(firmware_filename
, NULL
, NULL
, NULL
,
159 &firmware_entry
, NULL
, &firmware_end
, NULL
,
160 0, EM_RISCV
, 1, 0, NULL
, true, sym_cb
) > 0) {
164 firmware_size
= load_image_targphys_as(firmware_filename
,
166 current_machine
->ram_size
, NULL
);
168 if (firmware_size
> 0) {
169 return firmware_load_addr
+ firmware_size
;
172 error_report("could not load firmware '%s'", firmware_filename
);
176 static void riscv_load_initrd(MachineState
*machine
, uint64_t kernel_entry
)
178 const char *filename
= machine
->initrd_filename
;
179 uint64_t mem_size
= machine
->ram_size
;
180 void *fdt
= machine
->fdt
;
184 g_assert(filename
!= NULL
);
187 * We want to put the initrd far enough into RAM that when the
188 * kernel is uncompressed it will not clobber the initrd. However
189 * on boards without much RAM we must ensure that we still leave
190 * enough room for a decent sized initrd, and on boards with large
191 * amounts of RAM we must avoid the initrd being so far up in RAM
192 * that it is outside lowmem and inaccessible to the kernel.
193 * So for boards with less than 256MB of RAM we put the initrd
194 * halfway into RAM, and for boards with 256MB of RAM or more we put
195 * the initrd at 128MB.
197 start
= kernel_entry
+ MIN(mem_size
/ 2, 128 * MiB
);
199 size
= load_ramdisk(filename
, start
, mem_size
- start
);
201 size
= load_image_targphys(filename
, start
, mem_size
- start
);
203 error_report("could not load ramdisk '%s'", filename
);
208 /* Some RISC-V machines (e.g. opentitan) don't have a fdt. */
211 qemu_fdt_setprop_cell(fdt
, "/chosen", "linux,initrd-start", start
);
212 qemu_fdt_setprop_cell(fdt
, "/chosen", "linux,initrd-end", end
);
216 target_ulong
riscv_load_kernel(MachineState
*machine
,
217 RISCVHartArrayState
*harts
,
218 target_ulong kernel_start_addr
,
222 const char *kernel_filename
= machine
->kernel_filename
;
223 uint64_t kernel_load_base
, kernel_entry
;
224 void *fdt
= machine
->fdt
;
226 g_assert(kernel_filename
!= NULL
);
229 * NB: Use low address not ELF entry point to ensure that the fw_dynamic
230 * behaviour when loading an ELF matches the fw_payload, fw_jump and BBL
231 * behaviour, as well as fw_dynamic with a raw binary, all of which jump to
232 * the (expected) load address load address. This allows kernels to have
233 * separate SBI and ELF entry points (used by FreeBSD, for example).
235 if (load_elf_ram_sym(kernel_filename
, NULL
, NULL
, NULL
,
236 NULL
, &kernel_load_base
, NULL
, NULL
, 0,
237 EM_RISCV
, 1, 0, NULL
, true, sym_cb
) > 0) {
238 kernel_entry
= kernel_load_base
;
242 if (load_uimage_as(kernel_filename
, &kernel_entry
, NULL
, NULL
,
243 NULL
, NULL
, NULL
) > 0) {
247 if (load_image_targphys_as(kernel_filename
, kernel_start_addr
,
248 current_machine
->ram_size
, NULL
) > 0) {
249 kernel_entry
= kernel_start_addr
;
253 error_report("could not load kernel '%s'", kernel_filename
);
258 * For 32 bit CPUs 'kernel_entry' can be sign-extended by
259 * load_elf_ram_sym().
261 if (riscv_is_32bit(harts
)) {
262 kernel_entry
= extract64(kernel_entry
, 0, 32);
265 if (load_initrd
&& machine
->initrd_filename
) {
266 riscv_load_initrd(machine
, kernel_entry
);
269 if (fdt
&& machine
->kernel_cmdline
&& *machine
->kernel_cmdline
) {
270 qemu_fdt_setprop_string(fdt
, "/chosen", "bootargs",
271 machine
->kernel_cmdline
);
278 * This function makes an assumption that the DRAM interval
279 * 'dram_base' + 'dram_size' is contiguous.
281 * Considering that 'dram_end' is the lowest value between
282 * the end of the DRAM block and MachineState->ram_size, the
283 * FDT location will vary according to 'dram_base':
285 * - if 'dram_base' is less that 3072 MiB, the FDT will be
286 * put at the lowest value between 3072 MiB and 'dram_end';
288 * - if 'dram_base' is higher than 3072 MiB, the FDT will be
291 * The FDT is fdt_packed() during the calculation.
293 uint64_t riscv_compute_fdt_addr(hwaddr dram_base
, hwaddr dram_size
,
296 int ret
= fdt_pack(ms
->fdt
);
297 hwaddr dram_end
, temp
;
300 /* Should only fail if we've built a corrupted tree */
303 fdtsize
= fdt_totalsize(ms
->fdt
);
305 error_report("invalid device-tree");
310 * A dram_size == 0, usually from a MemMapEntry[].size element,
311 * means that the DRAM block goes all the way to ms->ram_size.
313 dram_end
= dram_base
;
314 dram_end
+= dram_size
? MIN(ms
->ram_size
, dram_size
) : ms
->ram_size
;
317 * We should put fdt as far as possible to avoid kernel/initrd overwriting
318 * its content. But it should be addressable by 32 bit system as well.
319 * Thus, put it at an 2MB aligned address that less than fdt size from the
320 * end of dram or 3GB whichever is lesser.
322 temp
= (dram_base
< 3072 * MiB
) ? MIN(dram_end
, 3072 * MiB
) : dram_end
;
324 return QEMU_ALIGN_DOWN(temp
- fdtsize
, 2 * MiB
);
328 * 'fdt_addr' is received as hwaddr because boards might put
329 * the FDT beyond 32-bit addressing boundary.
331 void riscv_load_fdt(hwaddr fdt_addr
, void *fdt
)
333 uint32_t fdtsize
= fdt_totalsize(fdt
);
335 /* copy in the device tree */
336 qemu_fdt_dumpdtb(fdt
, fdtsize
);
338 rom_add_blob_fixed_as("fdt", fdt
, fdtsize
, fdt_addr
,
339 &address_space_memory
);
340 qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds
,
341 rom_ptr_for_as(&address_space_memory
, fdt_addr
, fdtsize
));
344 void riscv_rom_copy_firmware_info(MachineState
*machine
, hwaddr rom_base
,
345 hwaddr rom_size
, uint32_t reset_vec_size
,
346 uint64_t kernel_entry
)
348 struct fw_dynamic_info dinfo
;
351 if (sizeof(dinfo
.magic
) == 4) {
352 dinfo
.magic
= cpu_to_le32(FW_DYNAMIC_INFO_MAGIC_VALUE
);
353 dinfo
.version
= cpu_to_le32(FW_DYNAMIC_INFO_VERSION
);
354 dinfo
.next_mode
= cpu_to_le32(FW_DYNAMIC_INFO_NEXT_MODE_S
);
355 dinfo
.next_addr
= cpu_to_le32(kernel_entry
);
357 dinfo
.magic
= cpu_to_le64(FW_DYNAMIC_INFO_MAGIC_VALUE
);
358 dinfo
.version
= cpu_to_le64(FW_DYNAMIC_INFO_VERSION
);
359 dinfo
.next_mode
= cpu_to_le64(FW_DYNAMIC_INFO_NEXT_MODE_S
);
360 dinfo
.next_addr
= cpu_to_le64(kernel_entry
);
364 dinfo_len
= sizeof(dinfo
);
367 * copy the dynamic firmware info. This information is specific to
368 * OpenSBI but doesn't break any other firmware as long as they don't
369 * expect any certain value in "a2" register.
371 if (dinfo_len
> (rom_size
- reset_vec_size
)) {
372 error_report("not enough space to store dynamic firmware info");
376 rom_add_blob_fixed_as("mrom.finfo", &dinfo
, dinfo_len
,
377 rom_base
+ reset_vec_size
,
378 &address_space_memory
);
381 void riscv_setup_rom_reset_vec(MachineState
*machine
, RISCVHartArrayState
*harts
,
383 hwaddr rom_base
, hwaddr rom_size
,
384 uint64_t kernel_entry
,
385 uint64_t fdt_load_addr
)
388 uint32_t start_addr_hi32
= 0x00000000;
389 uint32_t fdt_load_addr_hi32
= 0x00000000;
391 if (!riscv_is_32bit(harts
)) {
392 start_addr_hi32
= start_addr
>> 32;
393 fdt_load_addr_hi32
= fdt_load_addr
>> 32;
396 uint32_t reset_vec
[10] = {
397 0x00000297, /* 1: auipc t0, %pcrel_hi(fw_dyn) */
398 0x02828613, /* addi a2, t0, %pcrel_lo(1b) */
399 0xf1402573, /* csrr a0, mhartid */
402 0x00028067, /* jr t0 */
403 start_addr
, /* start: .dword */
405 fdt_load_addr
, /* fdt_laddr: .dword */
409 if (riscv_is_32bit(harts
)) {
410 reset_vec
[3] = 0x0202a583; /* lw a1, 32(t0) */
411 reset_vec
[4] = 0x0182a283; /* lw t0, 24(t0) */
413 reset_vec
[3] = 0x0202b583; /* ld a1, 32(t0) */
414 reset_vec
[4] = 0x0182b283; /* ld t0, 24(t0) */
417 if (!harts
->harts
[0].cfg
.ext_icsr
) {
419 * The Zicsr extension has been disabled, so let's ensure we don't
420 * run the CSR instruction. Let's fill the address with a non
423 reset_vec
[2] = 0x00000013; /* addi x0, x0, 0 */
426 /* copy in the reset vector in little_endian byte order */
427 for (i
= 0; i
< ARRAY_SIZE(reset_vec
); i
++) {
428 reset_vec
[i
] = cpu_to_le32(reset_vec
[i
]);
430 rom_add_blob_fixed_as("mrom.reset", reset_vec
, sizeof(reset_vec
),
431 rom_base
, &address_space_memory
);
432 riscv_rom_copy_firmware_info(machine
, rom_base
, rom_size
, sizeof(reset_vec
),
436 void riscv_setup_direct_kernel(hwaddr kernel_addr
, hwaddr fdt_addr
)
440 for (cs
= first_cpu
; cs
; cs
= CPU_NEXT(cs
)) {
441 RISCVCPU
*riscv_cpu
= RISCV_CPU(cs
);
442 riscv_cpu
->env
.kernel_addr
= kernel_addr
;
443 riscv_cpu
->env
.fdt_addr
= fdt_addr
;
447 void riscv_setup_firmware_boot(MachineState
*machine
)
449 if (machine
->kernel_filename
) {
451 fw_cfg
= fw_cfg_find();
455 * Expose the kernel, the command line, and the initrd in fw_cfg.
456 * We don't process them here at all, it's all left to the
459 load_image_to_fw_cfg(fw_cfg
,
460 FW_CFG_KERNEL_SIZE
, FW_CFG_KERNEL_DATA
,
461 machine
->kernel_filename
,
463 load_image_to_fw_cfg(fw_cfg
,
464 FW_CFG_INITRD_SIZE
, FW_CFG_INITRD_DATA
,
465 machine
->initrd_filename
, false);
467 if (machine
->kernel_cmdline
) {
468 fw_cfg_add_i32(fw_cfg
, FW_CFG_CMDLINE_SIZE
,
469 strlen(machine
->kernel_cmdline
) + 1);
470 fw_cfg_add_string(fw_cfg
, FW_CFG_CMDLINE_DATA
,
471 machine
->kernel_cmdline
);