booti에서 ARM64 Linux로 handoff

U-Boot가 넘긴 값을 커널에서 받는 위치

ARM64 직접 부팅에서 최종 DTB의 물리 주소는 x0로, x1~x3은 0으로 전달합니다. Linux head.S는 DTB 주소를 x21과 boot_args에 보존합니다. 이후 fixmap으로 읽을 주소를 준비하고 FDT의 chosen·메모리 정보를 해석합니다. initramfs 위치는 chosen 속성으로 전달하며 x1·x2를 initramfs 인자로 쓰는 규약이 아닙니다.

양쪽 코드를 이어서 읽기

QUESTION

booti에서 ARM64 Linux로 handoff 단계에서 실제로 바뀌는 상태는 무엇인가?

STRUCTURE

객체와 주소가 놓이는 구조

CALL PATH

실행 흐름

STATE LEDGER

단계별 입력과 출력

호출 순서를 함수 이름으로만 외우지 않고, 각 단계가 무엇을 받아 무엇을 공개하는지 적은 표다. 실제 소스에서 생산 필드가 다르면 표를 고치는 방식으로 사용한다.

분석 범위의 전제와 비교해, 다음 단계의 입력 조건을 처음 어긴 생산 단계부터 조사한다.

VISUAL WALKTHROUGH

주소와 객체의 이동을 그림으로 읽기

아래 그림은 호출 이름보다 주소, 객체 수명과 handoff 경계를 먼저 볼 수 있도록 구성했다. 실제 주소와 크기는 사용 중인 보드의 bdinfo, map과 linker symbol을 대입한다.

UPSTREAM SOURCE

원본 코드

아래 코드는 U-Boot v2026.07의 cmd/booti.c에서 88-176줄을 그대로 가져온 것이다. 설명을 위해 실제 코드를 가짜 의사 코드로 바꾸지 않았다.

88	images->ep = relocated_addr;
89	images->os.start = relocated_addr;
90	images->os.end = relocated_addr + image_size;
91
92	ep_addr = (phys_addr_t)images->ep;
93	ret = lmb_alloc_mem(LMB_MEM_ALLOC_ADDR, 0, &ep_addr,
94			    le32_to_cpu(image_size), LMB_NONE);
95	if (ret) {
96		printf("Failed to allocate memory for the image at %#llx\n",
97		       (unsigned long long)images->ep);
98		return 1;
99	}
100
101	/*
102	 * Handle the BOOTM_STATE_FINDOTHER state ourselves as we do not
103	 * have a header that provide this informaiton.
104	 */
105	if (bootm_find_images(image_load_addr, bmi->conf_ramdisk, bmi->conf_fdt,
106			      relocated_addr, image_size))
107		return 1;
108
109	return 0;
110}
111
112int do_booti(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[])
113{
114	struct bootm_info bmi;
115	int states;
116	int ret;
117
118	/* Consume 'booti' */
119	argc--; argv++;
120
121	bootm_init(&bmi);
122	if (argc)
123		bmi.addr_img = argv[0];
124	if (argc > 1)
125		bmi.conf_ramdisk = argv[1];
126	if (argc > 2)
127		bmi.conf_fdt = argv[2];
128	bmi.boot_progress = true;
129	bmi.cmd_name = "booti";
130	/* do not set up argc and argv[] since nothing uses them */
131
132	if (booti_start(&bmi))
133		return 1;
134
135	/*
136	 * We are doing the BOOTM_STATE_LOADOS state ourselves, so must
137	 * disable interrupts ourselves
138	 */
139	bootm_disable_interrupts();
140
141	images.os.os = IH_OS_LINUX;
142	if (IS_ENABLED(CONFIG_RISCV_SMODE))
143		images.os.arch = IH_ARCH_RISCV;
144	else if (IS_ENABLED(CONFIG_ARM64))
145		images.os.arch = IH_ARCH_ARM64;
146
147	states = BOOTM_STATE_MEASURE | BOOTM_STATE_OS_PREP |
148		BOOTM_STATE_OS_FAKE_GO | BOOTM_STATE_OS_GO;
149	if (IS_ENABLED(CONFIG_SYS_BOOT_RAMDISK_HIGH))
150		states |= BOOTM_STATE_RAMDISK;
151
152	ret = bootm_run_states(&bmi, states);
153
154	return ret;
155}
156
157U_BOOT_LONGHELP(booti,
158	"[addr [initrd[:size]] [fdt]]\n"
159	"    - boot Linux flat or compressed 'Image' stored at 'addr'\n"
160	"\tThe argument 'initrd' is optional and specifies the address\n"
161	"\tof an initrd in memory. The optional parameter ':size' allows\n"
162	"\tspecifying the size of a RAW initrd.\n"
163	"\tCurrently only booting from gz, bz2, lzma and lz4 compression\n"
164	"\ttypes are supported. In order to boot from any of these compressed\n"
165	"\timages, user have to set kernel_comp_addr_r and kernel_comp_size environment\n"
166	"\tvariables beforehand.\n"
167#if defined(CONFIG_OF_LIBFDT)
168	"\tSince booting a Linux kernel requires a flat device-tree, a\n"
169	"\tthird argument providing the address of the device-tree blob\n"
170	"\tis required. To boot a kernel with a device-tree blob but\n"
171	"\twithout an initrd image, use a '-' for the initrd argument.\n"
172#endif
173	);
174
175U_BOOT_CMD(
176	booti,	CONFIG_SYS_MAXARGS,	1,	do_booti,

READING CONTRACT

발췌 범위와 읽기 기준

원문 88-176줄에는 앞뒤 문맥이 포함됩니다. 기준 구문 int do_booti(struct cmd_tbl *cmdtp은 L112에 있습니다. 발췌 첫 줄을 함수 정의의 시작으로 해석하지 않습니다.

분기 직전에는 bootloader의 편의 기능보다 Linux boot protocol을 우선한다. x0의 FDT 주소, EL, MMU/cache 상태, reserved memory 반영을 체크한다.

RELATED SOURCE

함께 읽어야 하는 원본 코드

첫 코드 조각만으로 동작이 완성되지 않는 경우 호출 매크로, 객체 정의와 실제 실행 목록을 같은 페이지에 묶었다. 각 조각은 같은 기준 commit에서 가져왔다.

21	uint64_t	text_offset;	/* Image load offset, LE */
22	uint64_t	image_size;	/* Effective Image size, LE */
23	uint64_t	flags;		/* Kernel flags, LE */
24	uint64_t	res2;		/* reserved */
25	uint64_t	res3;		/* reserved */
26	uint64_t	res4;		/* reserved */
27	uint32_t	magic;		/* Magic number */
28	uint32_t	res5;
29};
30
31int booti_setup(ulong image, ulong *relocated_addr, ulong *size,
32		bool force_reloc)
33{
34	struct Image_header *ih;
35	uint64_t dst;
36	uint64_t image_size, text_offset;
37
38	*relocated_addr = image;
39
40	ih = (struct Image_header *)map_sysmem(image, 0);
41
42	if (ih->magic != le32_to_cpu(LINUX_ARM64_IMAGE_MAGIC)) {
43		puts("Bad Linux ARM64 Image magic!\n");
44		return 1;
45	}
46
47	/*
48	 * Prior to Linux commit a2c1d73b94ed, the text_offset field
49	 * is of unknown endianness.  In these cases, the image_size
50	 * field is zero, and we can assume a fixed value of 0x80000.
51	 */
52	if (ih->image_size == 0) {
53		puts("Image lacks image_size field, assuming 16MiB\n");
54		image_size = 16 << 20;
55		text_offset = 0x80000;
56	} else {
57		image_size = le64_to_cpu(ih->image_size);
58		text_offset = le64_to_cpu(ih->text_offset);
59	}
60
61	*size = image_size;
62
63	/*
64	 * If bit 3 of the flags field is set, the 2MB aligned base of the
65	 * kernel image can be anywhere in physical memory, so respect
66	 * images->ep.  Otherwise, relocate the image to the base of RAM
67	 * since memory below it is not accessible via the linear mapping.
68	 */
69	if (!force_reloc && (le64_to_cpu(ih->flags) & BIT(3)))
70		dst = image - text_offset;
71	else
72		dst = gd->bd->bi_dram[0].start;
73
74	*relocated_addr = ALIGN(dst, SZ_2M) + text_offset;
75
76	unmap_sysmem(ih);
77
78	return 0;
79}

520 * boot_ramdisk_high - relocate init ramdisk
521 * @rd_data: ramdisk data start address
522 * @rd_len: ramdisk data length
523 * @initrd_start: pointer to a ulong variable, will hold final init ramdisk
524 *      start address (after possible relocation)
525 * @initrd_end: pointer to a ulong variable, will hold final init ramdisk
526 *      end address (after possible relocation)
527 *
528 * boot_ramdisk_high() takes a relocation hint from "initrd_high" environment
529 * variable and if requested ramdisk data is moved to a specified location.
530 *
531 * Initrd_start and initrd_end are set to final (after relocation) ramdisk
532 * start/end addresses if ramdisk image start and len were provided,
533 * otherwise set initrd_start and initrd_end set to zeros.
534 *
535 * returns:
536 *      0 - success
537 *     -1 - failure
538 */
539int boot_ramdisk_high(ulong rd_data, ulong rd_len, ulong *initrd_start,
540		      ulong *initrd_end)
541{
542	int err;
543	char	*s;
544	phys_addr_t initrd_high;
545	int	initrd_copy_to_ram = 1;
546
547	s = env_get("initrd_high");
548	if (s) {
549		/* a value of "no" or a similar string will act like 0,
550		 * turning the "load high" feature off. This is intentional.
551		 */
552		initrd_high = hextoul(s, NULL);
553		if (initrd_high == ~0)
554			initrd_copy_to_ram = 0;
555	} else {
556		initrd_high = env_get_bootm_mapsize() + env_get_bootm_low();
557	}
558
559	debug("## initrd_high = 0x%llx, copy_to_ram = %d\n",
560	      (u64)initrd_high, initrd_copy_to_ram);
561
562	if (rd_data) {
563		if (!initrd_copy_to_ram) {	/* zero-copy ramdisk support */
564			phys_addr_t initrd_addr;
565
566			debug("   in-place initrd\n");
567			*initrd_start = rd_data;
568			*initrd_end = rd_data + rd_len;
569			initrd_addr = (phys_addr_t)rd_data;
570			err = lmb_alloc_mem(LMB_MEM_ALLOC_ADDR, 0, &initrd_addr,
571					    rd_len, LMB_NONE);
572			if (err) {
573				puts("in-place initrd alloc failed\n");
574				goto error;
575			}
576		} else {
577			enum lmb_mem_type type = initrd_high ?
578				LMB_MEM_ALLOC_MAX : LMB_MEM_ALLOC_ANY;
579
580			err = lmb_alloc_mem(type, 0x1000, &initrd_high, rd_len,
581					    LMB_NONE);
582			if (err) {
583				puts("ramdisk - allocation error\n");
584				goto error;
585			}
586
587			*initrd_start = (ulong)initrd_high;
588			bootstage_mark(BOOTSTAGE_ID_COPY_RAMDISK);
589
590			*initrd_end = *initrd_start + rd_len;
591			printf("   Loading Ramdisk to %08lx, end %08lx ... ",
592			       *initrd_start, *initrd_end);
593
594			memmove_wd((void *)*initrd_start,
595				   (void *)rd_data, rd_len, CHUNKSZ);
596
597			/*
598			 * Ensure the image is flushed to memory to handle
599			 * AMP boot scenarios in which we might not be
600			 * HW cache coherent
601			 */
602			if (IS_ENABLED(CONFIG_MP)) {
603				flush_cache((unsigned long)*initrd_start,
604					    ALIGN(rd_len, ARCH_DMA_MINALIGN));
605			}
606			puts("OK\n");
607		}
608	} else {
609		*initrd_start = 0;
610		*initrd_end = 0;
611	}
612	debug("   ramdisk load start = 0x%08lx, ramdisk load end = 0x%08lx\n",
613	      *initrd_start, *initrd_end);
614
615	return 0;
616
617error:
618	return -1;
619}
620
621int boot_get_setup(struct bootm_headers *images, u8 arch,
622		   ulong *setup_start, ulong *setup_len)
623{
624	if (!CONFIG_IS_ENABLED(FIT))
625		return -ENOENT;
626
627	return boot_get_setup_fit(images, arch, setup_start, setup_len);
628}
629
630int boot_get_fpga(struct bootm_headers *images)
631{
632	ulong tmp_img_addr, img_data, img_len;

141
142/**
143 * boot_relocate_fdt - relocate flat device tree
144 * @of_flat_tree: pointer to a char* variable, will hold fdt start address
145 * @of_size: pointer to a ulong variable, will hold fdt length
146 *
147 * boot_relocate_fdt() allocates a region of memory within the bootmap and
148 * relocates the of_flat_tree into that region, even if the fdt is already in
149 * the bootmap.  It also expands the size of the fdt by CONFIG_SYS_FDT_PAD
150 * bytes.
151 *
152 * of_flat_tree and of_size are set to final (after relocation) values
153 *
154 * returns:
155 *      0 - success
156 *      1 - failure
157 */
158int boot_relocate_fdt(char **of_flat_tree, ulong *of_size)
159{
160	u64	start, size, usable, low, mapsize;
161	void	*fdt_blob = *of_flat_tree;
162	void	*of_start = NULL;
163	char	*fdt_high;
164	ulong	of_len = 0;
165	int	bank;
166	int	err;
167	int	disable_relocation = 0;
168	phys_addr_t addr;
169
170	/* nothing to do */
171	if (*of_size == 0)
172		return 0;
173
174	if (fdt_check_header(fdt_blob) != 0) {
175		fdt_error("image is not a fdt");
176		goto error;
177	}
178
179	/* position on a 4K boundary before the alloc_current */
180	/* Pad the FDT by a specified amount */
181	of_len = *of_size + CONFIG_SYS_FDT_PAD;
182
183	/* If fdt_high is set use it to select the relocation address */
184	fdt_high = env_get("fdt_high");
185	if (fdt_high) {
186		ulong high_addr = hextoul(fdt_high, NULL);
187
188		if (high_addr == ~0UL) {
189			/* All ones means use fdt in place */
190			of_start = fdt_blob;
191			addr = map_to_sysmem(fdt_blob);
192			printf("WARNING:\n"
193			       "The 'fdt_high' environment variable is set to ~0. This is known to cause\n"
194			       "boot failures due to placement of DT at non-8-byte-aligned addresses.\n"
195			       "This system will likely fail to boot. Unset the 'fdt_high' environment\n"
196			       "variable and submit a fix upstream.\n");
197
198			err = lmb_alloc_mem(LMB_MEM_ALLOC_ADDR, 0, &addr,
199					    of_len, LMB_NONE);
200			if (err) {
201				printf("Failed to reserve memory for fdt at %#llx\n",
202				       (u64)addr);
203				goto error;
204			}
205
206			disable_relocation = 1;
207		} else {
208			enum lmb_mem_type type = high_addr ?
209				LMB_MEM_ALLOC_MAX : LMB_MEM_ALLOC_ANY;
210
211			addr = high_addr;
212			err = lmb_alloc_mem(type, 0x1000, &addr, of_len,
213					    LMB_NONE);
214			if (err) {
215				puts("Failed to allocate memory for Device Tree relocation\n");
216				goto error;
217			}
218			of_start = map_sysmem(addr, of_len);
219		}
220	} else {
221		mapsize = env_get_bootm_mapsize();
222		low = env_get_bootm_low();
223		of_start = NULL;
224
225		for (bank = 0; bank < CONFIG_NR_DRAM_BANKS; bank++) {
226			start = gd->bd->bi_dram[bank].start;
227			size = gd->bd->bi_dram[bank].size;
228
229			/* DRAM bank addresses are too low, skip it. */
230			if (start + size < low)
231				continue;
232
233			/*
234			 * At least part of this DRAM bank is usable, try
235			 * using the DRAM bank up to 'usable' address limit
236			 * for LMB allocation.
237			 */
238			usable = min(start + size, low + mapsize);
239			addr = usable;
240			err = lmb_alloc_mem(LMB_MEM_ALLOC_MAX, 0x1000,
241					    &addr, of_len, LMB_NONE);
242			if (!err) {
243				of_start = map_sysmem(addr, of_len);
244				/* Allocation succeeded, use this block. */
245				if (of_start)
246					break;
247			}
248
249			/*
250			 * Reduce the mapping size in the next bank
251			 * by the size of attempt in current bank.
252			 */
253			mapsize -= usable - max(start, low);
254			if (!mapsize)
255				break;
256		}
257	}
258
259	if (of_start == NULL) {
260		puts("device tree - allocation error\n");
261		goto error;

212			printf("WARNING: could not set serial-number %s.\n",
213			       fdt_strerror(err));
214			return err;
215		}
216	}
217
218	return 0;
219}
220
221int fdt_initrd(void *fdt, ulong initrd_start, ulong initrd_end)
222{
223	int   nodeoffset;
224	int   err, j, total;
225	int is_u64;
226	uint64_t addr, size;
227
228	/* just return if the size of initrd is zero */
229	if (initrd_start == initrd_end)
230		return 0;
231
232	/* find or create "/chosen" node. */
233	nodeoffset = fdt_find_or_add_subnode(fdt, 0, "chosen");
234	if (nodeoffset < 0)
235		return nodeoffset;
236
237	total = fdt_num_mem_rsv(fdt);
238
239	/*
240	 * Look for an existing entry and update it.  If we don't find
241	 * the entry, we will j be the next available slot.
242	 */
243	for (j = 0; j < total; j++) {
244		err = fdt_get_mem_rsv(fdt, j, &addr, &size);
245		if (addr == initrd_start) {
246			fdt_del_mem_rsv(fdt, j);
247			break;
248		}
249	}
250
251	err = fdt_add_mem_rsv(fdt, initrd_start, initrd_end - initrd_start);
252	if (err < 0) {
253		printf("fdt_initrd: %s\n", fdt_strerror(err));
254		return err;
255	}
256
257	is_u64 = (fdt_address_cells(fdt, 0) == 2);
258
259	err = fdt_setprop_uxx(fdt, nodeoffset, "linux,initrd-start",
260			      (uint64_t)initrd_start, is_u64);
261
262	if (err < 0) {
263		printf("WARNING: could not set linux,initrd-start %s.\n",
264		       fdt_strerror(err));
265		return err;
266	}
267
268	err = fdt_setprop_uxx(fdt, nodeoffset, "linux,initrd-end",
269			      (uint64_t)initrd_end, is_u64);
270
271	if (err < 0) {
272		printf("WARNING: could not set linux,initrd-end %s.\n",
273		       fdt_strerror(err));
274
275		return err;
276	}
277
278	return 0;
279}
280
281int fdt_kaslrseed(void *fdt, bool overwrite)
282{
283	int len, err, nodeoffset;

DETAILS

내부 동작을 더 깊게 읽기

IMPLEMENTATION NOTES

구현을 읽을 때 놓치기 쉬운 부분

OBJECT LIFETIME

객체와 수명

FAILURE PATH

실패 지점과 증상

로그가 끊긴 마지막 함수만 고치지 않는다. 그 함수가 받은 주소, size, flag가 만들어진 앞 단계까지 올라가고, 오류 뒤 등록 객체와 hardware 상태가 남았는지도 확인한다.

EVIDENCE

소스 밖에서 확인할 증거

소스 해석은 실제 빌드 산출물과 target 로그로 닫아야 한다. 아래 명령의 보드 이름과 toolchain prefix는 사용 중인 빌드 환경에 맞게 바꾼다.

LAB

직접 확인할 실험

1. 01
   booti 직전 booti_start/size 로그 추가

   Image header 진입 전후에 ARM64 Image의 주소·크기·반환값과 timestamp를 함께 남긴다.

2. 02
   FDT chosen과 initrd 주소를 kernel early log와 대조

   bootm states 진입 전후에 bootm_headers의 주소·크기·반환값과 timestamp를 함께 남긴다.

3. 03
   분기 직전 CurrentEL, SCTLR, x0 기록

   FDT/initrd setup 진입 전후에 working FDT의 주소·크기·반환값과 timestamp를 함께 남긴다.

PRIMARY REFERENCES

원문과 다음 글