The /chosen FDT node is how the firmware indicates information about
the kernel to the loader code. In a full boot chain this would come
from something like a boot loader. However if we use the generic
loader to load blobs into RAM before launching a hypervisor for
example we can boot directly:

  $QEMU $ARGS  -kernel ~/xen.git/xen/xen \
    -append "dom0_mem=1G,max:1G loglvl=all guest_loglvl=all" \
    -device loader,addr=0x47000000,\
    file=Image,\
    len-fdt-compat=2,\
    fdt-compat[0]='multiboot,,module',\
    fdt-compat[1]='multiboot,,kernel',\
    fdt-bootargs="root=/dev/mapper/vg0-root ro console=hvc0 earlyprintk=xen"

Note the ,, escapes required for the command line parser.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 include/hw/core/generic-loader.h |  4 +++
 hw/core/generic-loader.c         | 42 ++++++++++++++++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/include/hw/core/generic-loader.h b/include/hw/core/generic-loader.h
index 19d87b39c8..98b0452430 100644
--- a/include/hw/core/generic-loader.h
+++ b/include/hw/core/generic-loader.h
@@ -39,6 +39,10 @@ struct GenericLoaderState {
     bool force_raw;
     bool data_be;
     bool set_pc;
+
+    char **fdt_compat;
+    uint32_t fdt_compat_count;
+    char *fdt_bootargs;
 };
 
 #define TYPE_GENERIC_LOADER "loader"
diff --git a/hw/core/generic-loader.c b/hw/core/generic-loader.c
index a242c076f6..8bd8a33e80 100644
--- a/hw/core/generic-loader.c
+++ b/hw/core/generic-loader.c
@@ -40,6 +40,8 @@
 #include "qapi/error.h"
 #include "qemu/module.h"
 #include "hw/core/generic-loader.h"
+#include "sysemu/device_tree.h"
+#include "hw/boards.h"
 
 #define CPU_NONE 0xFFFFFFFF
 
@@ -61,6 +63,39 @@ static void generic_loader_reset(void *opaque)
     }
 }
 
+/*
+ * Insert some FDT nodes for the loaded blob.
+ */
+static void loader_insert_fdt(GenericLoaderState *s, int size, Error **errp)
+{
+    MachineState *machine = MACHINE(qdev_get_machine());
+    void *fdt = machine->fdt;
+    g_autofree char *node = g_strdup_printf("/chosen/module@%#08lx", s->addr);
+    uint64_t reg_attr[2] = {cpu_to_be64(s->addr), cpu_to_be64(size)};
+
+    if (!fdt) {
+        error_setg(errp, "Cannot modify FDT fields if the machine has none");
+        return;
+    }
+
+    qemu_fdt_add_subnode(fdt, node);
+    qemu_fdt_setprop(fdt, node, "reg", &reg_attr, sizeof(reg_attr));
+
+    if (s->fdt_compat) {
+        if (qemu_fdt_setprop_string_array
+            (fdt, node, "compatible", s->fdt_compat, s->fdt_compat_count) < 0) {
+            error_setg(errp, "couldn't set %s/compatible", node);
+            return;
+        }
+    }
+
+    if (s->fdt_bootargs) {
+        if (qemu_fdt_setprop_string(fdt, node, "bootargs", s->fdt_bootargs) < 0) {
+            error_setg(errp, "couldn't set %s/bootargs", node);
+        }
+    }
+}
+
 static void generic_loader_realize(DeviceState *dev, Error **errp)
 {
     GenericLoaderState *s = GENERIC_LOADER(dev);
@@ -171,6 +206,10 @@ static void generic_loader_realize(DeviceState *dev, Error **errp)
     } else {
         s->data = cpu_to_le64(s->data);
     }
+
+    if (s->fdt_compat || s->fdt_bootargs) {
+        loader_insert_fdt(s, size, errp);
+    }
 }
 
 static void generic_loader_unrealize(DeviceState *dev)
@@ -186,6 +225,9 @@ static Property generic_loader_props[] = {
     DEFINE_PROP_UINT32("cpu-num", GenericLoaderState, cpu_num, CPU_NONE),
     DEFINE_PROP_BOOL("force-raw", GenericLoaderState, force_raw, false),
     DEFINE_PROP_STRING("file", GenericLoaderState, file),
+    DEFINE_PROP_ARRAY("fdt-compat", GenericLoaderState, fdt_compat_count,
+                      fdt_compat, qdev_prop_string, char *),
+    DEFINE_PROP_STRING("fdt-bootargs", GenericLoaderState, fdt_bootargs),
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.20.1