xref: /qemu/pc-bios/s390-ccw/bootmap.c (revision bcebf102)
1 /*
2  * QEMU S390 bootmap interpreter
3  *
4  * Copyright (c) 2009 Alexander Graf <agraf@suse.de>
5  *
6  * This work is licensed under the terms of the GNU GPL, version 2 or (at
7  * your option) any later version. See the COPYING file in the top-level
8  * directory.
9  */
10 
11 #include "libc.h"
12 #include "s390-ccw.h"
13 #include "bootmap.h"
14 #include "virtio.h"
15 #include "bswap.h"
16 
17 #ifdef DEBUG
18 /* #define DEBUG_FALLBACK */
19 #endif
20 
21 #ifdef DEBUG_FALLBACK
22 #define dputs(txt) \
23     do { sclp_print("zipl: " txt); } while (0)
24 #else
25 #define dputs(fmt, ...) \
26     do { } while (0)
27 #endif
28 
29 /* Scratch space */
30 static uint8_t sec[MAX_SECTOR_SIZE*4] __attribute__((__aligned__(PAGE_SIZE)));
31 
32 typedef struct ResetInfo {
33     uint32_t ipl_mask;
34     uint32_t ipl_addr;
35     uint32_t ipl_continue;
36 } ResetInfo;
37 
38 static ResetInfo save;
39 
40 const uint8_t el_torito_magic[] = "EL TORITO SPECIFICATION"
41                                   "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0";
42 
43 /*
44  * Match two CCWs located after PSW and eight filler bytes.
45  * From libmagic and arch/s390/kernel/head.S.
46  */
47 const uint8_t linux_s390_magic[] = "\x02\x00\x00\x18\x60\x00\x00\x50\x02\x00"
48                                    "\x00\x68\x60\x00\x00\x50\x40\x40\x40\x40"
49                                    "\x40\x40\x40\x40";
50 
51 static inline bool is_iso_vd_valid(IsoVolDesc *vd)
52 {
53     const uint8_t vol_desc_magic[] = "CD001";
54 
55     return !memcmp(&vd->ident[0], vol_desc_magic, 5) &&
56            vd->version == 0x1 &&
57            vd->type <= VOL_DESC_TYPE_PARTITION;
58 }
59 
60 static void jump_to_IPL_2(void)
61 {
62     ResetInfo *current = 0;
63 
64     void (*ipl)(void) = (void *) (uint64_t) current->ipl_continue;
65     *current = save;
66     ipl(); /* should not return */
67 }
68 
69 static void jump_to_IPL_code(uint64_t address)
70 {
71     /* store the subsystem information _after_ the bootmap was loaded */
72     write_subsystem_identification();
73     /*
74      * The IPL PSW is at address 0. We also must not overwrite the
75      * content of non-BIOS memory after we loaded the guest, so we
76      * save the original content and restore it in jump_to_IPL_2.
77      */
78     ResetInfo *current = 0;
79 
80     save = *current;
81     current->ipl_addr = (uint32_t) (uint64_t) &jump_to_IPL_2;
82     current->ipl_continue = address & 0x7fffffff;
83 
84     debug_print_int("set IPL addr to", current->ipl_continue);
85 
86     /* Ensure the guest output starts fresh */
87     sclp_print("\n");
88 
89     /*
90      * HACK ALERT.
91      * We use the load normal reset to keep r15 unchanged. jump_to_IPL_2
92      * can then use r15 as its stack pointer.
93      */
94     asm volatile("lghi 1,1\n\t"
95                  "diag 1,1,0x308\n\t"
96                  : : : "1", "memory");
97     panic("\n! IPL returns !\n");
98 }
99 
100 /***********************************************************************
101  * IPL an ECKD DASD (CDL or LDL/CMS format)
102  */
103 
104 static unsigned char _bprs[8*1024]; /* guessed "max" ECKD sector size */
105 static const int max_bprs_entries = sizeof(_bprs) / sizeof(ExtEckdBlockPtr);
106 static uint8_t _s2[MAX_SECTOR_SIZE * 3] __attribute__((__aligned__(PAGE_SIZE)));
107 static void *s2_prev_blk = _s2;
108 static void *s2_cur_blk = _s2 + MAX_SECTOR_SIZE;
109 static void *s2_next_blk = _s2 + MAX_SECTOR_SIZE * 2;
110 
111 static inline void verify_boot_info(BootInfo *bip)
112 {
113     IPL_assert(magic_match(bip->magic, ZIPL_MAGIC), "No zIPL sig in BootInfo");
114     IPL_assert(bip->version == BOOT_INFO_VERSION, "Wrong zIPL version");
115     IPL_assert(bip->bp_type == BOOT_INFO_BP_TYPE_IPL, "DASD is not for IPL");
116     IPL_assert(bip->dev_type == BOOT_INFO_DEV_TYPE_ECKD, "DASD is not ECKD");
117     IPL_assert(bip->flags == BOOT_INFO_FLAGS_ARCH, "Not for this arch");
118     IPL_assert(block_size_ok(bip->bp.ipl.bm_ptr.eckd.bptr.size),
119                "Bad block size in zIPL section of the 1st record.");
120 }
121 
122 static block_number_t eckd_block_num(EckdCHS *chs)
123 {
124     const uint64_t sectors = virtio_get_sectors();
125     const uint64_t heads = virtio_get_heads();
126     const uint64_t cylinder = chs->cylinder
127                             + ((chs->head & 0xfff0) << 12);
128     const uint64_t head = chs->head & 0x000f;
129     const block_number_t block = sectors * heads * cylinder
130                                + sectors * head
131                                + chs->sector
132                                - 1; /* block nr starts with zero */
133     return block;
134 }
135 
136 static bool eckd_valid_address(BootMapPointer *p)
137 {
138     const uint64_t head = p->eckd.chs.head & 0x000f;
139 
140     if (head >= virtio_get_heads()
141         ||  p->eckd.chs.sector > virtio_get_sectors()
142         ||  p->eckd.chs.sector <= 0) {
143         return false;
144     }
145 
146     if (!virtio_guessed_disk_nature() &&
147         eckd_block_num(&p->eckd.chs) >= virtio_get_blocks()) {
148         return false;
149     }
150 
151     return true;
152 }
153 
154 static block_number_t load_eckd_segments(block_number_t blk, uint64_t *address)
155 {
156     block_number_t block_nr;
157     int j, rc;
158     BootMapPointer *bprs = (void *)_bprs;
159     bool more_data;
160 
161     memset(_bprs, FREE_SPACE_FILLER, sizeof(_bprs));
162     read_block(blk, bprs, "BPRS read failed");
163 
164     do {
165         more_data = false;
166         for (j = 0;; j++) {
167             block_nr = eckd_block_num(&bprs[j].xeckd.bptr.chs);
168             if (is_null_block_number(block_nr)) { /* end of chunk */
169                 break;
170             }
171 
172             /* we need the updated blockno for the next indirect entry
173              * in the chain, but don't want to advance address
174              */
175             if (j == (max_bprs_entries - 1)) {
176                 break;
177             }
178 
179             IPL_assert(block_size_ok(bprs[j].xeckd.bptr.size),
180                        "bad chunk block size");
181             IPL_assert(eckd_valid_address(&bprs[j]), "bad chunk ECKD addr");
182 
183             if ((bprs[j].xeckd.bptr.count == 0) && unused_space(&(bprs[j+1]),
184                 sizeof(EckdBlockPtr))) {
185                 /* This is a "continue" pointer.
186                  * This ptr should be the last one in the current
187                  * script section.
188                  * I.e. the next ptr must point to the unused memory area
189                  */
190                 memset(_bprs, FREE_SPACE_FILLER, sizeof(_bprs));
191                 read_block(block_nr, bprs, "BPRS continuation read failed");
192                 more_data = true;
193                 break;
194             }
195 
196             /* Load (count+1) blocks of code at (block_nr)
197              * to memory (address).
198              */
199             rc = virtio_read_many(block_nr, (void *)(*address),
200                                   bprs[j].xeckd.bptr.count+1);
201             IPL_assert(rc == 0, "code chunk read failed");
202 
203             *address += (bprs[j].xeckd.bptr.count+1) * virtio_get_block_size();
204         }
205     } while (more_data);
206     return block_nr;
207 }
208 
209 static bool find_zipl_boot_menu_banner(int *offset)
210 {
211     int i;
212 
213     /* Menu banner starts with "zIPL" */
214     for (i = 0; i < virtio_get_block_size() - 4; i++) {
215         if (magic_match(s2_cur_blk + i, ZIPL_MAGIC_EBCDIC)) {
216             *offset = i;
217             return true;
218         }
219     }
220 
221     return false;
222 }
223 
224 static int eckd_get_boot_menu_index(block_number_t s1b_block_nr)
225 {
226     block_number_t cur_block_nr;
227     block_number_t prev_block_nr = 0;
228     block_number_t next_block_nr = 0;
229     EckdStage1b *s1b = (void *)sec;
230     int banner_offset;
231     int i;
232 
233     /* Get Stage1b data */
234     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
235     read_block(s1b_block_nr, s1b, "Cannot read stage1b boot loader");
236 
237     memset(_s2, FREE_SPACE_FILLER, sizeof(_s2));
238 
239     /* Get Stage2 data */
240     for (i = 0; i < STAGE2_BLK_CNT_MAX; i++) {
241         cur_block_nr = eckd_block_num(&s1b->seek[i].chs);
242 
243         if (!cur_block_nr) {
244             break;
245         }
246 
247         read_block(cur_block_nr, s2_cur_blk, "Cannot read stage2 boot loader");
248 
249         if (find_zipl_boot_menu_banner(&banner_offset)) {
250             /*
251              * Load the adjacent blocks to account for the
252              * possibility of menu data spanning multiple blocks.
253              */
254             if (prev_block_nr) {
255                 read_block(prev_block_nr, s2_prev_blk,
256                            "Cannot read stage2 boot loader");
257             }
258 
259             if (i + 1 < STAGE2_BLK_CNT_MAX) {
260                 next_block_nr = eckd_block_num(&s1b->seek[i + 1].chs);
261             }
262 
263             if (next_block_nr) {
264                 read_block(next_block_nr, s2_next_blk,
265                            "Cannot read stage2 boot loader");
266             }
267 
268             return menu_get_zipl_boot_index(s2_cur_blk + banner_offset);
269         }
270 
271         prev_block_nr = cur_block_nr;
272     }
273 
274     sclp_print("No zipl boot menu data found. Booting default entry.");
275     return 0;
276 }
277 
278 static void run_eckd_boot_script(block_number_t bmt_block_nr,
279                                  block_number_t s1b_block_nr)
280 {
281     int i;
282     unsigned int loadparm = get_loadparm_index();
283     block_number_t block_nr;
284     uint64_t address;
285     BootMapTable *bmt = (void *)sec;
286     BootMapScript *bms = (void *)sec;
287 
288     if (menu_is_enabled_zipl()) {
289         loadparm = eckd_get_boot_menu_index(s1b_block_nr);
290     }
291 
292     debug_print_int("loadparm", loadparm);
293     IPL_assert(loadparm <= MAX_TABLE_ENTRIES, "loadparm value greater than"
294                " maximum number of boot entries allowed");
295 
296     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
297     read_block(bmt_block_nr, sec, "Cannot read Boot Map Table");
298 
299     block_nr = eckd_block_num(&bmt->entry[loadparm].xeckd.bptr.chs);
300     IPL_assert(block_nr != -1, "Cannot find Boot Map Table Entry");
301 
302     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
303     read_block(block_nr, sec, "Cannot read Boot Map Script");
304 
305     for (i = 0; bms->entry[i].type == BOOT_SCRIPT_LOAD; i++) {
306         address = bms->entry[i].address.load_address;
307         block_nr = eckd_block_num(&bms->entry[i].blkptr.xeckd.bptr.chs);
308 
309         do {
310             block_nr = load_eckd_segments(block_nr, &address);
311         } while (block_nr != -1);
312     }
313 
314     IPL_assert(bms->entry[i].type == BOOT_SCRIPT_EXEC,
315                "Unknown script entry type");
316     jump_to_IPL_code(bms->entry[i].address.load_address); /* no return */
317 }
318 
319 static void ipl_eckd_cdl(void)
320 {
321     XEckdMbr *mbr;
322     EckdCdlIpl2 *ipl2 = (void *)sec;
323     IplVolumeLabel *vlbl = (void *)sec;
324     block_number_t bmt_block_nr, s1b_block_nr;
325 
326     /* we have just read the block #0 and recognized it as "IPL1" */
327     sclp_print("CDL\n");
328 
329     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
330     read_block(1, ipl2, "Cannot read IPL2 record at block 1");
331 
332     mbr = &ipl2->mbr;
333     IPL_assert(magic_match(mbr, ZIPL_MAGIC), "No zIPL section in IPL2 record.");
334     IPL_assert(block_size_ok(mbr->blockptr.xeckd.bptr.size),
335                "Bad block size in zIPL section of IPL2 record.");
336     IPL_assert(mbr->dev_type == DEV_TYPE_ECKD,
337                "Non-ECKD device type in zIPL section of IPL2 record.");
338 
339     /* save pointer to Boot Map Table */
340     bmt_block_nr = eckd_block_num(&mbr->blockptr.xeckd.bptr.chs);
341 
342     /* save pointer to Stage1b Data */
343     s1b_block_nr = eckd_block_num(&ipl2->stage1.seek[0].chs);
344 
345     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
346     read_block(2, vlbl, "Cannot read Volume Label at block 2");
347     IPL_assert(magic_match(vlbl->key, VOL1_MAGIC),
348                "Invalid magic of volume label block");
349     IPL_assert(magic_match(vlbl->f.key, VOL1_MAGIC),
350                "Invalid magic of volser block");
351     print_volser(vlbl->f.volser);
352 
353     run_eckd_boot_script(bmt_block_nr, s1b_block_nr);
354     /* no return */
355 }
356 
357 static void print_eckd_ldl_msg(ECKD_IPL_mode_t mode)
358 {
359     LDL_VTOC *vlbl = (void *)sec; /* already read, 3rd block */
360     char msg[4] = { '?', '.', '\n', '\0' };
361 
362     sclp_print((mode == ECKD_CMS) ? "CMS" : "LDL");
363     sclp_print(" version ");
364     switch (vlbl->LDL_version) {
365     case LDL1_VERSION:
366         msg[0] = '1';
367         break;
368     case LDL2_VERSION:
369         msg[0] = '2';
370         break;
371     default:
372         msg[0] = vlbl->LDL_version;
373         msg[0] &= 0x0f; /* convert EBCDIC   */
374         msg[0] |= 0x30; /* to ASCII (digit) */
375         msg[1] = '?';
376         break;
377     }
378     sclp_print(msg);
379     print_volser(vlbl->volser);
380 }
381 
382 static void ipl_eckd_ldl(ECKD_IPL_mode_t mode)
383 {
384     block_number_t bmt_block_nr, s1b_block_nr;
385     EckdLdlIpl1 *ipl1 = (void *)sec;
386 
387     if (mode != ECKD_LDL_UNLABELED) {
388         print_eckd_ldl_msg(mode);
389     }
390 
391     /* DO NOT read BootMap pointer (only one, xECKD) at block #2 */
392 
393     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
394     read_block(0, sec, "Cannot read block 0 to grab boot info.");
395     if (mode == ECKD_LDL_UNLABELED) {
396         if (!magic_match(ipl1->bip.magic, ZIPL_MAGIC)) {
397             return; /* not applicable layout */
398         }
399         sclp_print("unlabeled LDL.\n");
400     }
401     verify_boot_info(&ipl1->bip);
402 
403     /* save pointer to Boot Map Table */
404     bmt_block_nr = eckd_block_num(&ipl1->bip.bp.ipl.bm_ptr.eckd.bptr.chs);
405 
406     /* save pointer to Stage1b Data */
407     s1b_block_nr = eckd_block_num(&ipl1->stage1.seek[0].chs);
408 
409     run_eckd_boot_script(bmt_block_nr, s1b_block_nr);
410     /* no return */
411 }
412 
413 static void print_eckd_msg(void)
414 {
415     char msg[] = "Using ECKD scheme (block size *****), ";
416     char *p = &msg[34], *q = &msg[30];
417     int n = virtio_get_block_size();
418 
419     /* Fill in the block size and show up the message */
420     if (n > 0 && n <= 99999) {
421         while (n) {
422             *p-- = '0' + (n % 10);
423             n /= 10;
424         }
425         while (p >= q) {
426             *p-- = ' ';
427         }
428     }
429     sclp_print(msg);
430 }
431 
432 static void ipl_eckd(void)
433 {
434     XEckdMbr *mbr = (void *)sec;
435     LDL_VTOC *vlbl = (void *)sec;
436 
437     print_eckd_msg();
438 
439     /* Grab the MBR again */
440     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
441     read_block(0, mbr, "Cannot read block 0 on DASD");
442 
443     if (magic_match(mbr->magic, IPL1_MAGIC)) {
444         ipl_eckd_cdl(); /* no return */
445     }
446 
447     /* LDL/CMS? */
448     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
449     read_block(2, vlbl, "Cannot read block 2");
450 
451     if (magic_match(vlbl->magic, CMS1_MAGIC)) {
452         ipl_eckd_ldl(ECKD_CMS); /* no return */
453     }
454     if (magic_match(vlbl->magic, LNX1_MAGIC)) {
455         ipl_eckd_ldl(ECKD_LDL); /* no return */
456     }
457 
458     ipl_eckd_ldl(ECKD_LDL_UNLABELED); /* it still may return */
459     /*
460      * Ok, it is not a LDL by any means.
461      * It still might be a CDL with zero record keys for IPL1 and IPL2
462      */
463     ipl_eckd_cdl();
464 }
465 
466 /***********************************************************************
467  * IPL a SCSI disk
468  */
469 
470 static void zipl_load_segment(ComponentEntry *entry)
471 {
472     const int max_entries = (MAX_SECTOR_SIZE / sizeof(ScsiBlockPtr));
473     ScsiBlockPtr *bprs = (void *)sec;
474     const int bprs_size = sizeof(sec);
475     block_number_t blockno;
476     uint64_t address;
477     int i;
478     char err_msg[] = "zIPL failed to read BPRS at 0xZZZZZZZZZZZZZZZZ";
479     char *blk_no = &err_msg[30]; /* where to print blockno in (those ZZs) */
480 
481     blockno = entry->data.blockno;
482     address = entry->load_address;
483 
484     debug_print_int("loading segment at block", blockno);
485     debug_print_int("addr", address);
486 
487     do {
488         memset(bprs, FREE_SPACE_FILLER, bprs_size);
489         fill_hex_val(blk_no, &blockno, sizeof(blockno));
490         read_block(blockno, bprs, err_msg);
491 
492         for (i = 0;; i++) {
493             uint64_t *cur_desc = (void *)&bprs[i];
494 
495             blockno = bprs[i].blockno;
496             if (!blockno) {
497                 break;
498             }
499 
500             /* we need the updated blockno for the next indirect entry in the
501                chain, but don't want to advance address */
502             if (i == (max_entries - 1)) {
503                 break;
504             }
505 
506             if (bprs[i].blockct == 0 && unused_space(&bprs[i + 1],
507                 sizeof(ScsiBlockPtr))) {
508                 /* This is a "continue" pointer.
509                  * This ptr is the last one in the current script section.
510                  * I.e. the next ptr must point to the unused memory area.
511                  * The blockno is not zero, so the upper loop must continue
512                  * reading next section of BPRS.
513                  */
514                 break;
515             }
516             address = virtio_load_direct(cur_desc[0], cur_desc[1], 0,
517                                          (void *)address);
518             IPL_assert(address != -1, "zIPL load segment failed");
519         }
520     } while (blockno);
521 }
522 
523 /* Run a zipl program */
524 static void zipl_run(ScsiBlockPtr *pte)
525 {
526     ComponentHeader *header;
527     ComponentEntry *entry;
528     uint8_t tmp_sec[MAX_SECTOR_SIZE];
529 
530     read_block(pte->blockno, tmp_sec, "Cannot read header");
531     header = (ComponentHeader *)tmp_sec;
532 
533     IPL_assert(magic_match(tmp_sec, ZIPL_MAGIC), "No zIPL magic in header");
534     IPL_assert(header->type == ZIPL_COMP_HEADER_IPL, "Bad header type");
535 
536     dputs("start loading images\n");
537 
538     /* Load image(s) into RAM */
539     entry = (ComponentEntry *)(&header[1]);
540     while (entry->component_type == ZIPL_COMP_ENTRY_LOAD) {
541         zipl_load_segment(entry);
542 
543         entry++;
544 
545         IPL_assert((uint8_t *)(&entry[1]) <= (tmp_sec + MAX_SECTOR_SIZE),
546                    "Wrong entry value");
547     }
548 
549     IPL_assert(entry->component_type == ZIPL_COMP_ENTRY_EXEC, "No EXEC entry");
550 
551     /* should not return */
552     jump_to_IPL_code(entry->load_address);
553 }
554 
555 static void ipl_scsi(void)
556 {
557     ScsiMbr *mbr = (void *)sec;
558     int program_table_entries = 0;
559     BootMapTable *prog_table = (void *)sec;
560     unsigned int loadparm = get_loadparm_index();
561 
562     /* Grab the MBR */
563     memset(sec, FREE_SPACE_FILLER, sizeof(sec));
564     read_block(0, mbr, "Cannot read block 0");
565 
566     if (!magic_match(mbr->magic, ZIPL_MAGIC)) {
567         return;
568     }
569 
570     sclp_print("Using SCSI scheme.\n");
571     debug_print_int("MBR Version", mbr->version_id);
572     IPL_check(mbr->version_id == 1,
573               "Unknown MBR layout version, assuming version 1");
574     debug_print_int("program table", mbr->pt.blockno);
575     IPL_assert(mbr->pt.blockno, "No Program Table");
576 
577     /* Parse the program table */
578     read_block(mbr->pt.blockno, sec, "Error reading Program Table");
579     IPL_assert(magic_match(sec, ZIPL_MAGIC), "No zIPL magic in PT");
580 
581     while (program_table_entries <= MAX_TABLE_ENTRIES) {
582         if (!prog_table->entry[program_table_entries].scsi.blockno) {
583             break;
584         }
585         program_table_entries++;
586     }
587 
588     debug_print_int("program table entries", program_table_entries);
589     IPL_assert(program_table_entries != 0, "Empty Program Table");
590 
591     if (menu_is_enabled_enum()) {
592         loadparm = menu_get_enum_boot_index(program_table_entries);
593     }
594 
595     debug_print_int("loadparm", loadparm);
596     IPL_assert(loadparm <= MAX_TABLE_ENTRIES, "loadparm value greater than"
597                " maximum number of boot entries allowed");
598 
599     zipl_run(&prog_table->entry[loadparm].scsi); /* no return */
600 }
601 
602 /***********************************************************************
603  * IPL El Torito ISO9660 image or DVD
604  */
605 
606 static bool is_iso_bc_entry_compatible(IsoBcSection *s)
607 {
608     uint8_t *magic_sec = (uint8_t *)(sec + ISO_SECTOR_SIZE);
609 
610     if (s->unused || !s->sector_count) {
611         return false;
612     }
613     read_iso_sector(bswap32(s->load_rba), magic_sec,
614                     "Failed to read image sector 0");
615 
616     /* Checking bytes 8 - 32 for S390 Linux magic */
617     return !memcmp(magic_sec + 8, linux_s390_magic, 24);
618 }
619 
620 /* Location of the current sector of the directory */
621 static uint32_t sec_loc[ISO9660_MAX_DIR_DEPTH];
622 /* Offset in the current sector of the directory */
623 static uint32_t sec_offset[ISO9660_MAX_DIR_DEPTH];
624 /* Remained directory space in bytes */
625 static uint32_t dir_rem[ISO9660_MAX_DIR_DEPTH];
626 
627 static inline uint32_t iso_get_file_size(uint32_t load_rba)
628 {
629     IsoVolDesc *vd = (IsoVolDesc *)sec;
630     IsoDirHdr *cur_record = &vd->vd.primary.rootdir;
631     uint8_t *temp = sec + ISO_SECTOR_SIZE;
632     int level = 0;
633 
634     read_iso_sector(ISO_PRIMARY_VD_SECTOR, sec,
635                     "Failed to read ISO primary descriptor");
636     sec_loc[0] = iso_733_to_u32(cur_record->ext_loc);
637     dir_rem[0] = 0;
638     sec_offset[0] = 0;
639 
640     while (level >= 0) {
641         IPL_assert(sec_offset[level] <= ISO_SECTOR_SIZE,
642                    "Directory tree structure violation");
643 
644         cur_record = (IsoDirHdr *)(temp + sec_offset[level]);
645 
646         if (sec_offset[level] == 0) {
647             read_iso_sector(sec_loc[level], temp,
648                             "Failed to read ISO directory");
649             if (dir_rem[level] == 0) {
650                 /* Skip self and parent records */
651                 dir_rem[level] = iso_733_to_u32(cur_record->data_len) -
652                                  cur_record->dr_len;
653                 sec_offset[level] += cur_record->dr_len;
654 
655                 cur_record = (IsoDirHdr *)(temp + sec_offset[level]);
656                 dir_rem[level] -= cur_record->dr_len;
657                 sec_offset[level] += cur_record->dr_len;
658                 continue;
659             }
660         }
661 
662         if (!cur_record->dr_len || sec_offset[level] == ISO_SECTOR_SIZE) {
663             /* Zero-padding and/or the end of current sector */
664             dir_rem[level] -= ISO_SECTOR_SIZE - sec_offset[level];
665             sec_offset[level] = 0;
666             sec_loc[level]++;
667         } else {
668             /* The directory record is valid */
669             if (load_rba == iso_733_to_u32(cur_record->ext_loc)) {
670                 return iso_733_to_u32(cur_record->data_len);
671             }
672 
673             dir_rem[level] -= cur_record->dr_len;
674             sec_offset[level] += cur_record->dr_len;
675 
676             if (cur_record->file_flags & 0x2) {
677                 /* Subdirectory */
678                 if (level == ISO9660_MAX_DIR_DEPTH - 1) {
679                     sclp_print("ISO-9660 directory depth limit exceeded\n");
680                 } else {
681                     level++;
682                     sec_loc[level] = iso_733_to_u32(cur_record->ext_loc);
683                     sec_offset[level] = 0;
684                     dir_rem[level] = 0;
685                     continue;
686                 }
687             }
688         }
689 
690         if (dir_rem[level] == 0) {
691             /* Nothing remaining */
692             level--;
693             read_iso_sector(sec_loc[level], temp,
694                             "Failed to read ISO directory");
695         }
696     }
697 
698     return 0;
699 }
700 
701 static void load_iso_bc_entry(IsoBcSection *load)
702 {
703     IsoBcSection s = *load;
704     /*
705      * According to spec, extent for each file
706      * is padded and ISO_SECTOR_SIZE bytes aligned
707      */
708     uint32_t blks_to_load = bswap16(s.sector_count) >> ET_SECTOR_SHIFT;
709     uint32_t real_size = iso_get_file_size(bswap32(s.load_rba));
710 
711     if (real_size) {
712         /* Round up blocks to load */
713         blks_to_load = (real_size + ISO_SECTOR_SIZE - 1) / ISO_SECTOR_SIZE;
714         sclp_print("ISO boot image size verified\n");
715     } else {
716         sclp_print("ISO boot image size could not be verified\n");
717     }
718 
719     read_iso_boot_image(bswap32(s.load_rba),
720                         (void *)((uint64_t)bswap16(s.load_segment)),
721                         blks_to_load);
722 
723     /* Trying to get PSW at zero address */
724     if (*((uint64_t *)0) & IPL_PSW_MASK) {
725         jump_to_IPL_code((*((uint64_t *)0)) & 0x7fffffff);
726     }
727 
728     /* Try default linux start address */
729     jump_to_IPL_code(KERN_IMAGE_START);
730 }
731 
732 static uint32_t find_iso_bc(void)
733 {
734     IsoVolDesc *vd = (IsoVolDesc *)sec;
735     uint32_t block_num = ISO_PRIMARY_VD_SECTOR;
736 
737     if (virtio_read_many(block_num++, sec, 1)) {
738         /* If primary vd cannot be read, there is no boot catalog */
739         return 0;
740     }
741 
742     while (is_iso_vd_valid(vd) && vd->type != VOL_DESC_TERMINATOR) {
743         if (vd->type == VOL_DESC_TYPE_BOOT) {
744             IsoVdElTorito *et = &vd->vd.boot;
745 
746             if (!memcmp(&et->el_torito[0], el_torito_magic, 32)) {
747                 return bswap32(et->bc_offset);
748             }
749         }
750         read_iso_sector(block_num++, sec,
751                         "Failed to read ISO volume descriptor");
752     }
753 
754     return 0;
755 }
756 
757 static IsoBcSection *find_iso_bc_entry(void)
758 {
759     IsoBcEntry *e = (IsoBcEntry *)sec;
760     uint32_t offset = find_iso_bc();
761     int i;
762     unsigned int loadparm = get_loadparm_index();
763 
764     if (!offset) {
765         return NULL;
766     }
767 
768     read_iso_sector(offset, sec, "Failed to read El Torito boot catalog");
769 
770     if (!is_iso_bc_valid(e)) {
771         /* The validation entry is mandatory */
772         panic("No valid boot catalog found!\n");
773         return NULL;
774     }
775 
776     /*
777      * Each entry has 32 bytes size, so one sector cannot contain > 64 entries.
778      * We consider only boot catalogs with no more than 64 entries.
779      */
780     for (i = 1; i < ISO_BC_ENTRY_PER_SECTOR; i++) {
781         if (e[i].id == ISO_BC_BOOTABLE_SECTION) {
782             if (is_iso_bc_entry_compatible(&e[i].body.sect)) {
783                 if (loadparm <= 1) {
784                     /* found, default, or unspecified */
785                     return &e[i].body.sect;
786                 }
787                 loadparm--;
788             }
789         }
790     }
791 
792     panic("No suitable boot entry found on ISO-9660 media!\n");
793 
794     return NULL;
795 }
796 
797 static void ipl_iso_el_torito(void)
798 {
799     IsoBcSection *s = find_iso_bc_entry();
800 
801     if (s) {
802         load_iso_bc_entry(s);
803         /* no return */
804     }
805 }
806 
807 /***********************************************************************
808  * Bus specific IPL sequences
809  */
810 
811 static void zipl_load_vblk(void)
812 {
813     if (virtio_guessed_disk_nature()) {
814         virtio_assume_iso9660();
815     }
816     ipl_iso_el_torito();
817 
818     if (virtio_guessed_disk_nature()) {
819         sclp_print("Using guessed DASD geometry.\n");
820         virtio_assume_eckd();
821     }
822     ipl_eckd();
823 }
824 
825 static void zipl_load_vscsi(void)
826 {
827     if (virtio_get_block_size() == VIRTIO_ISO_BLOCK_SIZE) {
828         /* Is it an ISO image in non-CD drive? */
829         ipl_iso_el_torito();
830     }
831 
832     sclp_print("Using guessed DASD geometry.\n");
833     virtio_assume_eckd();
834     ipl_eckd();
835 }
836 
837 /***********************************************************************
838  * IPL starts here
839  */
840 
841 void zipl_load(void)
842 {
843     VDev *vdev = virtio_get_device();
844 
845     if (vdev->is_cdrom) {
846         ipl_iso_el_torito();
847         panic("\n! Cannot IPL this ISO image !\n");
848     }
849 
850     if (virtio_get_device_type() == VIRTIO_ID_NET) {
851         jump_to_IPL_code(vdev->netboot_start_addr);
852     }
853 
854     ipl_scsi();
855 
856     switch (virtio_get_device_type()) {
857     case VIRTIO_ID_BLOCK:
858         zipl_load_vblk();
859         break;
860     case VIRTIO_ID_SCSI:
861         zipl_load_vscsi();
862         break;
863     default:
864         panic("\n! Unknown IPL device type !\n");
865     }
866 
867     panic("\n* this can never happen *\n");
868 }
869