xref: /openbmc/qemu/hw/core/loader.c (revision a376a8d5)
1 /*
2  * QEMU Executable loader
3  *
4  * Copyright (c) 2006 Fabrice Bellard
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  *
24  * Gunzip functionality in this file is derived from u-boot:
25  *
26  * (C) Copyright 2008 Semihalf
27  *
28  * (C) Copyright 2000-2005
29  * Wolfgang Denk, DENX Software Engineering, wd@denx.de.
30  *
31  * This program is free software; you can redistribute it and/or
32  * modify it under the terms of the GNU General Public License as
33  * published by the Free Software Foundation; either version 2 of
34  * the License, or (at your option) any later version.
35  *
36  * This program is distributed in the hope that it will be useful,
37  * but WITHOUT ANY WARRANTY; without even the implied warranty of
38  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
39  * GNU General Public License for more details.
40  *
41  * You should have received a copy of the GNU General Public License along
42  * with this program; if not, see <http://www.gnu.org/licenses/>.
43  */
44 
45 #include "qemu/osdep.h"
46 #include "qemu/datadir.h"
47 #include "qemu/error-report.h"
48 #include "qapi/error.h"
49 #include "qapi/qapi-commands-machine.h"
50 #include "qapi/type-helpers.h"
51 #include "trace.h"
52 #include "hw/hw.h"
53 #include "disas/disas.h"
54 #include "migration/vmstate.h"
55 #include "monitor/monitor.h"
56 #include "sysemu/reset.h"
57 #include "sysemu/sysemu.h"
58 #include "uboot_image.h"
59 #include "hw/loader.h"
60 #include "hw/nvram/fw_cfg.h"
61 #include "exec/memory.h"
62 #include "hw/boards.h"
63 #include "qemu/cutils.h"
64 #include "sysemu/runstate.h"
65 #include "tcg/debuginfo.h"
66 
67 #include <zlib.h>
68 
69 static int roms_loaded;
70 
71 /* return the size or -1 if error */
get_image_size(const char * filename)72 int64_t get_image_size(const char *filename)
73 {
74     int fd;
75     int64_t size;
76     fd = open(filename, O_RDONLY | O_BINARY);
77     if (fd < 0)
78         return -1;
79     size = lseek(fd, 0, SEEK_END);
80     close(fd);
81     return size;
82 }
83 
84 /* return the size or -1 if error */
load_image_size(const char * filename,void * addr,size_t size)85 ssize_t load_image_size(const char *filename, void *addr, size_t size)
86 {
87     int fd;
88     ssize_t actsize, l = 0;
89 
90     fd = open(filename, O_RDONLY | O_BINARY);
91     if (fd < 0) {
92         return -1;
93     }
94 
95     while ((actsize = read(fd, addr + l, size - l)) > 0) {
96         l += actsize;
97     }
98 
99     close(fd);
100 
101     return actsize < 0 ? -1 : l;
102 }
103 
104 /* read()-like version */
read_targphys(const char * name,int fd,hwaddr dst_addr,size_t nbytes)105 ssize_t read_targphys(const char *name,
106                       int fd, hwaddr dst_addr, size_t nbytes)
107 {
108     uint8_t *buf;
109     ssize_t did;
110 
111     buf = g_malloc(nbytes);
112     did = read(fd, buf, nbytes);
113     if (did > 0)
114         rom_add_blob_fixed("read", buf, did, dst_addr);
115     g_free(buf);
116     return did;
117 }
118 
load_image_targphys(const char * filename,hwaddr addr,uint64_t max_sz)119 ssize_t load_image_targphys(const char *filename,
120                             hwaddr addr, uint64_t max_sz)
121 {
122     return load_image_targphys_as(filename, addr, max_sz, NULL);
123 }
124 
125 /* return the size or -1 if error */
load_image_targphys_as(const char * filename,hwaddr addr,uint64_t max_sz,AddressSpace * as)126 ssize_t load_image_targphys_as(const char *filename,
127                                hwaddr addr, uint64_t max_sz, AddressSpace *as)
128 {
129     ssize_t size;
130 
131     size = get_image_size(filename);
132     if (size < 0 || size > max_sz) {
133         return -1;
134     }
135     if (size > 0) {
136         if (rom_add_file_fixed_as(filename, addr, -1, as) < 0) {
137             return -1;
138         }
139     }
140     return size;
141 }
142 
load_image_mr(const char * filename,MemoryRegion * mr)143 ssize_t load_image_mr(const char *filename, MemoryRegion *mr)
144 {
145     ssize_t size;
146 
147     if (!memory_access_is_direct(mr, false)) {
148         /* Can only load an image into RAM or ROM */
149         return -1;
150     }
151 
152     size = get_image_size(filename);
153 
154     if (size < 0 || size > memory_region_size(mr)) {
155         return -1;
156     }
157     if (size > 0) {
158         if (rom_add_file_mr(filename, mr, -1) < 0) {
159             return -1;
160         }
161     }
162     return size;
163 }
164 
pstrcpy_targphys(const char * name,hwaddr dest,int buf_size,const char * source)165 void pstrcpy_targphys(const char *name, hwaddr dest, int buf_size,
166                       const char *source)
167 {
168     const char *nulp;
169     char *ptr;
170 
171     if (buf_size <= 0) return;
172     nulp = memchr(source, 0, buf_size);
173     if (nulp) {
174         rom_add_blob_fixed(name, source, (nulp - source) + 1, dest);
175     } else {
176         rom_add_blob_fixed(name, source, buf_size, dest);
177         ptr = rom_ptr(dest + buf_size - 1, sizeof(*ptr));
178         *ptr = 0;
179     }
180 }
181 
182 /* A.OUT loader */
183 
184 struct exec
185 {
186   uint32_t a_info;   /* Use macros N_MAGIC, etc for access */
187   uint32_t a_text;   /* length of text, in bytes */
188   uint32_t a_data;   /* length of data, in bytes */
189   uint32_t a_bss;    /* length of uninitialized data area, in bytes */
190   uint32_t a_syms;   /* length of symbol table data in file, in bytes */
191   uint32_t a_entry;  /* start address */
192   uint32_t a_trsize; /* length of relocation info for text, in bytes */
193   uint32_t a_drsize; /* length of relocation info for data, in bytes */
194 };
195 
bswap_ahdr(struct exec * e)196 static void bswap_ahdr(struct exec *e)
197 {
198     bswap32s(&e->a_info);
199     bswap32s(&e->a_text);
200     bswap32s(&e->a_data);
201     bswap32s(&e->a_bss);
202     bswap32s(&e->a_syms);
203     bswap32s(&e->a_entry);
204     bswap32s(&e->a_trsize);
205     bswap32s(&e->a_drsize);
206 }
207 
208 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
209 #define OMAGIC 0407
210 #define NMAGIC 0410
211 #define ZMAGIC 0413
212 #define QMAGIC 0314
213 #define _N_HDROFF(x) (1024 - sizeof (struct exec))
214 #define N_TXTOFF(x)                                                 \
215     (N_MAGIC(x) == ZMAGIC ? _N_HDROFF((x)) + sizeof (struct exec) : \
216      (N_MAGIC(x) == QMAGIC ? 0 : sizeof (struct exec)))
217 #define N_TXTADDR(x, target_page_size) (N_MAGIC(x) == QMAGIC ? target_page_size : 0)
218 #define _N_SEGMENT_ROUND(x, target_page_size) (((x) + target_page_size - 1) & ~(target_page_size - 1))
219 
220 #define _N_TXTENDADDR(x, target_page_size) (N_TXTADDR(x, target_page_size)+(x).a_text)
221 
222 #define N_DATADDR(x, target_page_size) \
223     (N_MAGIC(x)==OMAGIC? (_N_TXTENDADDR(x, target_page_size)) \
224      : (_N_SEGMENT_ROUND (_N_TXTENDADDR(x, target_page_size), target_page_size)))
225 
226 
load_aout(const char * filename,hwaddr addr,int max_sz,int bswap_needed,hwaddr target_page_size)227 ssize_t load_aout(const char *filename, hwaddr addr, int max_sz,
228                   int bswap_needed, hwaddr target_page_size)
229 {
230     int fd;
231     ssize_t size, ret;
232     struct exec e;
233     uint32_t magic;
234 
235     fd = open(filename, O_RDONLY | O_BINARY);
236     if (fd < 0)
237         return -1;
238 
239     size = read(fd, &e, sizeof(e));
240     if (size < 0)
241         goto fail;
242 
243     if (bswap_needed) {
244         bswap_ahdr(&e);
245     }
246 
247     magic = N_MAGIC(e);
248     switch (magic) {
249     case ZMAGIC:
250     case QMAGIC:
251     case OMAGIC:
252         if (e.a_text + e.a_data > max_sz)
253             goto fail;
254         lseek(fd, N_TXTOFF(e), SEEK_SET);
255         size = read_targphys(filename, fd, addr, e.a_text + e.a_data);
256         if (size < 0)
257             goto fail;
258         break;
259     case NMAGIC:
260         if (N_DATADDR(e, target_page_size) + e.a_data > max_sz)
261             goto fail;
262         lseek(fd, N_TXTOFF(e), SEEK_SET);
263         size = read_targphys(filename, fd, addr, e.a_text);
264         if (size < 0)
265             goto fail;
266         ret = read_targphys(filename, fd, addr + N_DATADDR(e, target_page_size),
267                             e.a_data);
268         if (ret < 0)
269             goto fail;
270         size += ret;
271         break;
272     default:
273         goto fail;
274     }
275     close(fd);
276     return size;
277  fail:
278     close(fd);
279     return -1;
280 }
281 
282 /* ELF loader */
283 
load_at(int fd,off_t offset,size_t size)284 static void *load_at(int fd, off_t offset, size_t size)
285 {
286     void *ptr;
287     if (lseek(fd, offset, SEEK_SET) < 0)
288         return NULL;
289     ptr = g_malloc(size);
290     if (read(fd, ptr, size) != size) {
291         g_free(ptr);
292         return NULL;
293     }
294     return ptr;
295 }
296 
297 #ifdef ELF_CLASS
298 #undef ELF_CLASS
299 #endif
300 
301 #define ELF_CLASS   ELFCLASS32
302 #include "elf.h"
303 
304 #define SZ              32
305 #define elf_word        uint32_t
306 #define elf_sword       int32_t
307 #define bswapSZs        bswap32s
308 #include "hw/elf_ops.h.inc"
309 
310 #undef elfhdr
311 #undef elf_phdr
312 #undef elf_shdr
313 #undef elf_sym
314 #undef elf_rela
315 #undef elf_note
316 #undef elf_word
317 #undef elf_sword
318 #undef bswapSZs
319 #undef SZ
320 #define elfhdr          elf64_hdr
321 #define elf_phdr        elf64_phdr
322 #define elf_note        elf64_note
323 #define elf_shdr        elf64_shdr
324 #define elf_sym         elf64_sym
325 #define elf_rela        elf64_rela
326 #define elf_word        uint64_t
327 #define elf_sword       int64_t
328 #define bswapSZs        bswap64s
329 #define SZ              64
330 #include "hw/elf_ops.h.inc"
331 
load_elf_strerror(ssize_t error)332 const char *load_elf_strerror(ssize_t error)
333 {
334     switch (error) {
335     case 0:
336         return "No error";
337     case ELF_LOAD_FAILED:
338         return "Failed to load ELF";
339     case ELF_LOAD_NOT_ELF:
340         return "The image is not ELF";
341     case ELF_LOAD_WRONG_ARCH:
342         return "The image is from incompatible architecture";
343     case ELF_LOAD_WRONG_ENDIAN:
344         return "The image has incorrect endianness";
345     case ELF_LOAD_TOO_BIG:
346         return "The image segments are too big to load";
347     default:
348         return "Unknown error";
349     }
350 }
351 
load_elf_hdr(const char * filename,void * hdr,bool * is64,Error ** errp)352 void load_elf_hdr(const char *filename, void *hdr, bool *is64, Error **errp)
353 {
354     int fd;
355     uint8_t e_ident_local[EI_NIDENT];
356     uint8_t *e_ident;
357     size_t hdr_size, off;
358     bool is64l;
359 
360     if (!hdr) {
361         hdr = e_ident_local;
362     }
363     e_ident = hdr;
364 
365     fd = open(filename, O_RDONLY | O_BINARY);
366     if (fd < 0) {
367         error_setg_errno(errp, errno, "Failed to open file: %s", filename);
368         return;
369     }
370     if (read(fd, hdr, EI_NIDENT) != EI_NIDENT) {
371         error_setg_errno(errp, errno, "Failed to read file: %s", filename);
372         goto fail;
373     }
374     if (e_ident[0] != ELFMAG0 ||
375         e_ident[1] != ELFMAG1 ||
376         e_ident[2] != ELFMAG2 ||
377         e_ident[3] != ELFMAG3) {
378         error_setg(errp, "Bad ELF magic");
379         goto fail;
380     }
381 
382     is64l = e_ident[EI_CLASS] == ELFCLASS64;
383     hdr_size = is64l ? sizeof(Elf64_Ehdr) : sizeof(Elf32_Ehdr);
384     if (is64) {
385         *is64 = is64l;
386     }
387 
388     off = EI_NIDENT;
389     while (hdr != e_ident_local && off < hdr_size) {
390         size_t br = read(fd, hdr + off, hdr_size - off);
391         switch (br) {
392         case 0:
393             error_setg(errp, "File too short: %s", filename);
394             goto fail;
395         case -1:
396             error_setg_errno(errp, errno, "Failed to read file: %s",
397                              filename);
398             goto fail;
399         }
400         off += br;
401     }
402 
403 fail:
404     close(fd);
405 }
406 
407 /* return < 0 if error, otherwise the number of bytes loaded in memory */
load_elf(const char * filename,uint64_t (* elf_note_fn)(void *,void *,bool),uint64_t (* translate_fn)(void *,uint64_t),void * translate_opaque,uint64_t * pentry,uint64_t * lowaddr,uint64_t * highaddr,uint32_t * pflags,int big_endian,int elf_machine,int clear_lsb,int data_swab)408 ssize_t load_elf(const char *filename,
409                  uint64_t (*elf_note_fn)(void *, void *, bool),
410                  uint64_t (*translate_fn)(void *, uint64_t),
411                  void *translate_opaque, uint64_t *pentry, uint64_t *lowaddr,
412                  uint64_t *highaddr, uint32_t *pflags, int big_endian,
413                  int elf_machine, int clear_lsb, int data_swab)
414 {
415     return load_elf_as(filename, elf_note_fn, translate_fn, translate_opaque,
416                        pentry, lowaddr, highaddr, pflags, big_endian,
417                        elf_machine, clear_lsb, data_swab, NULL);
418 }
419 
420 /* return < 0 if error, otherwise the number of bytes loaded in memory */
load_elf_as(const char * filename,uint64_t (* elf_note_fn)(void *,void *,bool),uint64_t (* translate_fn)(void *,uint64_t),void * translate_opaque,uint64_t * pentry,uint64_t * lowaddr,uint64_t * highaddr,uint32_t * pflags,int big_endian,int elf_machine,int clear_lsb,int data_swab,AddressSpace * as)421 ssize_t load_elf_as(const char *filename,
422                     uint64_t (*elf_note_fn)(void *, void *, bool),
423                     uint64_t (*translate_fn)(void *, uint64_t),
424                     void *translate_opaque, uint64_t *pentry, uint64_t *lowaddr,
425                     uint64_t *highaddr, uint32_t *pflags, int big_endian,
426                     int elf_machine, int clear_lsb, int data_swab,
427                     AddressSpace *as)
428 {
429     return load_elf_ram(filename, elf_note_fn, translate_fn, translate_opaque,
430                         pentry, lowaddr, highaddr, pflags, big_endian,
431                         elf_machine, clear_lsb, data_swab, as, true);
432 }
433 
434 /* return < 0 if error, otherwise the number of bytes loaded in memory */
load_elf_ram(const char * filename,uint64_t (* elf_note_fn)(void *,void *,bool),uint64_t (* translate_fn)(void *,uint64_t),void * translate_opaque,uint64_t * pentry,uint64_t * lowaddr,uint64_t * highaddr,uint32_t * pflags,int big_endian,int elf_machine,int clear_lsb,int data_swab,AddressSpace * as,bool load_rom)435 ssize_t load_elf_ram(const char *filename,
436                      uint64_t (*elf_note_fn)(void *, void *, bool),
437                      uint64_t (*translate_fn)(void *, uint64_t),
438                      void *translate_opaque, uint64_t *pentry,
439                      uint64_t *lowaddr, uint64_t *highaddr, uint32_t *pflags,
440                      int big_endian, int elf_machine, int clear_lsb,
441                      int data_swab, AddressSpace *as, bool load_rom)
442 {
443     return load_elf_ram_sym(filename, elf_note_fn,
444                             translate_fn, translate_opaque,
445                             pentry, lowaddr, highaddr, pflags, big_endian,
446                             elf_machine, clear_lsb, data_swab, as,
447                             load_rom, NULL);
448 }
449 
450 /* return < 0 if error, otherwise the number of bytes loaded in memory */
load_elf_ram_sym(const char * filename,uint64_t (* elf_note_fn)(void *,void *,bool),uint64_t (* translate_fn)(void *,uint64_t),void * translate_opaque,uint64_t * pentry,uint64_t * lowaddr,uint64_t * highaddr,uint32_t * pflags,int big_endian,int elf_machine,int clear_lsb,int data_swab,AddressSpace * as,bool load_rom,symbol_fn_t sym_cb)451 ssize_t load_elf_ram_sym(const char *filename,
452                          uint64_t (*elf_note_fn)(void *, void *, bool),
453                          uint64_t (*translate_fn)(void *, uint64_t),
454                          void *translate_opaque, uint64_t *pentry,
455                          uint64_t *lowaddr, uint64_t *highaddr,
456                          uint32_t *pflags, int big_endian, int elf_machine,
457                          int clear_lsb, int data_swab,
458                          AddressSpace *as, bool load_rom, symbol_fn_t sym_cb)
459 {
460     int fd, data_order, target_data_order, must_swab;
461     ssize_t ret = ELF_LOAD_FAILED;
462     uint8_t e_ident[EI_NIDENT];
463 
464     fd = open(filename, O_RDONLY | O_BINARY);
465     if (fd < 0) {
466         perror(filename);
467         return -1;
468     }
469     if (read(fd, e_ident, sizeof(e_ident)) != sizeof(e_ident))
470         goto fail;
471     if (e_ident[0] != ELFMAG0 ||
472         e_ident[1] != ELFMAG1 ||
473         e_ident[2] != ELFMAG2 ||
474         e_ident[3] != ELFMAG3) {
475         ret = ELF_LOAD_NOT_ELF;
476         goto fail;
477     }
478 #if HOST_BIG_ENDIAN
479     data_order = ELFDATA2MSB;
480 #else
481     data_order = ELFDATA2LSB;
482 #endif
483     must_swab = data_order != e_ident[EI_DATA];
484     if (big_endian) {
485         target_data_order = ELFDATA2MSB;
486     } else {
487         target_data_order = ELFDATA2LSB;
488     }
489 
490     if (target_data_order != e_ident[EI_DATA]) {
491         ret = ELF_LOAD_WRONG_ENDIAN;
492         goto fail;
493     }
494 
495     lseek(fd, 0, SEEK_SET);
496     if (e_ident[EI_CLASS] == ELFCLASS64) {
497         ret = load_elf64(filename, fd, elf_note_fn,
498                          translate_fn, translate_opaque, must_swab,
499                          pentry, lowaddr, highaddr, pflags, elf_machine,
500                          clear_lsb, data_swab, as, load_rom, sym_cb);
501     } else {
502         ret = load_elf32(filename, fd, elf_note_fn,
503                          translate_fn, translate_opaque, must_swab,
504                          pentry, lowaddr, highaddr, pflags, elf_machine,
505                          clear_lsb, data_swab, as, load_rom, sym_cb);
506     }
507 
508     if (ret > 0) {
509         debuginfo_report_elf(filename, fd, 0);
510     }
511 
512  fail:
513     close(fd);
514     return ret;
515 }
516 
bswap_uboot_header(uboot_image_header_t * hdr)517 static void bswap_uboot_header(uboot_image_header_t *hdr)
518 {
519 #if !HOST_BIG_ENDIAN
520     bswap32s(&hdr->ih_magic);
521     bswap32s(&hdr->ih_hcrc);
522     bswap32s(&hdr->ih_time);
523     bswap32s(&hdr->ih_size);
524     bswap32s(&hdr->ih_load);
525     bswap32s(&hdr->ih_ep);
526     bswap32s(&hdr->ih_dcrc);
527 #endif
528 }
529 
530 
531 #define ZALLOC_ALIGNMENT    16
532 
zalloc(void * x,unsigned items,unsigned size)533 static void *zalloc(void *x, unsigned items, unsigned size)
534 {
535     void *p;
536 
537     size *= items;
538     size = (size + ZALLOC_ALIGNMENT - 1) & ~(ZALLOC_ALIGNMENT - 1);
539 
540     p = g_malloc(size);
541 
542     return (p);
543 }
544 
zfree(void * x,void * addr)545 static void zfree(void *x, void *addr)
546 {
547     g_free(addr);
548 }
549 
550 
551 #define HEAD_CRC    2
552 #define EXTRA_FIELD 4
553 #define ORIG_NAME   8
554 #define COMMENT     0x10
555 #define RESERVED    0xe0
556 
557 #define DEFLATED    8
558 
gunzip(void * dst,size_t dstlen,uint8_t * src,size_t srclen)559 ssize_t gunzip(void *dst, size_t dstlen, uint8_t *src, size_t srclen)
560 {
561     z_stream s = {};
562     ssize_t dstbytes;
563     int r, i, flags;
564 
565     /* skip header */
566     i = 10;
567     if (srclen < 4) {
568         goto toosmall;
569     }
570     flags = src[3];
571     if (src[2] != DEFLATED || (flags & RESERVED) != 0) {
572         puts ("Error: Bad gzipped data\n");
573         return -1;
574     }
575     if ((flags & EXTRA_FIELD) != 0) {
576         if (srclen < 12) {
577             goto toosmall;
578         }
579         i = 12 + src[10] + (src[11] << 8);
580     }
581     if ((flags & ORIG_NAME) != 0) {
582         while (i < srclen && src[i++] != 0) {
583             /* do nothing */
584         }
585     }
586     if ((flags & COMMENT) != 0) {
587         while (i < srclen && src[i++] != 0) {
588             /* do nothing */
589         }
590     }
591     if ((flags & HEAD_CRC) != 0) {
592         i += 2;
593     }
594     if (i >= srclen) {
595         goto toosmall;
596     }
597 
598     s.zalloc = zalloc;
599     s.zfree = zfree;
600 
601     r = inflateInit2(&s, -MAX_WBITS);
602     if (r != Z_OK) {
603         printf ("Error: inflateInit2() returned %d\n", r);
604         return (-1);
605     }
606     s.next_in = src + i;
607     s.avail_in = srclen - i;
608     s.next_out = dst;
609     s.avail_out = dstlen;
610     r = inflate(&s, Z_FINISH);
611     if (r != Z_OK && r != Z_STREAM_END) {
612         printf ("Error: inflate() returned %d\n", r);
613         inflateEnd(&s);
614         return -1;
615     }
616     dstbytes = s.next_out - (unsigned char *) dst;
617     inflateEnd(&s);
618 
619     return dstbytes;
620 
621 toosmall:
622     puts("Error: gunzip out of data in header\n");
623     return -1;
624 }
625 
626 /* Load a U-Boot image.  */
load_uboot_image(const char * filename,hwaddr * ep,hwaddr * loadaddr,int * is_linux,uint8_t image_type,uint64_t (* translate_fn)(void *,uint64_t),void * translate_opaque,AddressSpace * as)627 static ssize_t load_uboot_image(const char *filename, hwaddr *ep,
628                                 hwaddr *loadaddr, int *is_linux,
629                                 uint8_t image_type,
630                                 uint64_t (*translate_fn)(void *, uint64_t),
631                                 void *translate_opaque, AddressSpace *as)
632 {
633     int fd;
634     ssize_t size;
635     hwaddr address;
636     uboot_image_header_t h;
637     uboot_image_header_t *hdr = &h;
638     uint8_t *data = NULL;
639     int ret = -1;
640     int do_uncompress = 0;
641 
642     fd = open(filename, O_RDONLY | O_BINARY);
643     if (fd < 0)
644         return -1;
645 
646     size = read(fd, hdr, sizeof(uboot_image_header_t));
647     if (size < sizeof(uboot_image_header_t)) {
648         goto out;
649     }
650 
651     bswap_uboot_header(hdr);
652 
653     if (hdr->ih_magic != IH_MAGIC)
654         goto out;
655 
656     if (hdr->ih_type != image_type) {
657         if (!(image_type == IH_TYPE_KERNEL &&
658             hdr->ih_type == IH_TYPE_KERNEL_NOLOAD)) {
659             fprintf(stderr, "Wrong image type %d, expected %d\n", hdr->ih_type,
660                     image_type);
661             goto out;
662         }
663     }
664 
665     /* TODO: Implement other image types.  */
666     switch (hdr->ih_type) {
667     case IH_TYPE_KERNEL_NOLOAD:
668         if (!loadaddr || *loadaddr == LOAD_UIMAGE_LOADADDR_INVALID) {
669             fprintf(stderr, "this image format (kernel_noload) cannot be "
670                     "loaded on this machine type");
671             goto out;
672         }
673 
674         hdr->ih_load = *loadaddr + sizeof(*hdr);
675         hdr->ih_ep += hdr->ih_load;
676         /* fall through */
677     case IH_TYPE_KERNEL:
678         address = hdr->ih_load;
679         if (translate_fn) {
680             address = translate_fn(translate_opaque, address);
681         }
682         if (loadaddr) {
683             *loadaddr = hdr->ih_load;
684         }
685 
686         switch (hdr->ih_comp) {
687         case IH_COMP_NONE:
688             break;
689         case IH_COMP_GZIP:
690             do_uncompress = 1;
691             break;
692         default:
693             fprintf(stderr,
694                     "Unable to load u-boot images with compression type %d\n",
695                     hdr->ih_comp);
696             goto out;
697         }
698 
699         if (ep) {
700             *ep = hdr->ih_ep;
701         }
702 
703         /* TODO: Check CPU type.  */
704         if (is_linux) {
705             if (hdr->ih_os == IH_OS_LINUX) {
706                 *is_linux = 1;
707             } else if (hdr->ih_os == IH_OS_VXWORKS) {
708                 /*
709                  * VxWorks 7 uses the same boot interface as the Linux kernel
710                  * on Arm (64-bit only), PowerPC and RISC-V architectures.
711                  */
712                 switch (hdr->ih_arch) {
713                 case IH_ARCH_ARM64:
714                 case IH_ARCH_PPC:
715                 case IH_ARCH_RISCV:
716                     *is_linux = 1;
717                     break;
718                 default:
719                     *is_linux = 0;
720                     break;
721                 }
722             } else {
723                 *is_linux = 0;
724             }
725         }
726 
727         break;
728     case IH_TYPE_RAMDISK:
729         address = *loadaddr;
730         break;
731     default:
732         fprintf(stderr, "Unsupported u-boot image type %d\n", hdr->ih_type);
733         goto out;
734     }
735 
736     data = g_malloc(hdr->ih_size);
737 
738     if (read(fd, data, hdr->ih_size) != hdr->ih_size) {
739         fprintf(stderr, "Error reading file\n");
740         goto out;
741     }
742 
743     if (do_uncompress) {
744         uint8_t *compressed_data;
745         size_t max_bytes;
746         ssize_t bytes;
747 
748         compressed_data = data;
749         max_bytes = UBOOT_MAX_GUNZIP_BYTES;
750         data = g_malloc(max_bytes);
751 
752         bytes = gunzip(data, max_bytes, compressed_data, hdr->ih_size);
753         g_free(compressed_data);
754         if (bytes < 0) {
755             fprintf(stderr, "Unable to decompress gzipped image!\n");
756             goto out;
757         }
758         hdr->ih_size = bytes;
759     }
760 
761     rom_add_blob_fixed_as(filename, data, hdr->ih_size, address, as);
762 
763     ret = hdr->ih_size;
764 
765 out:
766     g_free(data);
767     close(fd);
768     return ret;
769 }
770 
load_uimage(const char * filename,hwaddr * ep,hwaddr * loadaddr,int * is_linux,uint64_t (* translate_fn)(void *,uint64_t),void * translate_opaque)771 ssize_t load_uimage(const char *filename, hwaddr *ep, hwaddr *loadaddr,
772                     int *is_linux,
773                     uint64_t (*translate_fn)(void *, uint64_t),
774                     void *translate_opaque)
775 {
776     return load_uboot_image(filename, ep, loadaddr, is_linux, IH_TYPE_KERNEL,
777                             translate_fn, translate_opaque, NULL);
778 }
779 
load_uimage_as(const char * filename,hwaddr * ep,hwaddr * loadaddr,int * is_linux,uint64_t (* translate_fn)(void *,uint64_t),void * translate_opaque,AddressSpace * as)780 ssize_t load_uimage_as(const char *filename, hwaddr *ep, hwaddr *loadaddr,
781                        int *is_linux,
782                        uint64_t (*translate_fn)(void *, uint64_t),
783                        void *translate_opaque, AddressSpace *as)
784 {
785     return load_uboot_image(filename, ep, loadaddr, is_linux, IH_TYPE_KERNEL,
786                             translate_fn, translate_opaque, as);
787 }
788 
789 /* Load a ramdisk.  */
load_ramdisk(const char * filename,hwaddr addr,uint64_t max_sz)790 ssize_t load_ramdisk(const char *filename, hwaddr addr, uint64_t max_sz)
791 {
792     return load_ramdisk_as(filename, addr, max_sz, NULL);
793 }
794 
load_ramdisk_as(const char * filename,hwaddr addr,uint64_t max_sz,AddressSpace * as)795 ssize_t load_ramdisk_as(const char *filename, hwaddr addr, uint64_t max_sz,
796                         AddressSpace *as)
797 {
798     return load_uboot_image(filename, NULL, &addr, NULL, IH_TYPE_RAMDISK,
799                             NULL, NULL, as);
800 }
801 
802 /* Load a gzip-compressed kernel to a dynamically allocated buffer. */
load_image_gzipped_buffer(const char * filename,uint64_t max_sz,uint8_t ** buffer)803 ssize_t load_image_gzipped_buffer(const char *filename, uint64_t max_sz,
804                                   uint8_t **buffer)
805 {
806     uint8_t *compressed_data = NULL;
807     uint8_t *data = NULL;
808     gsize len;
809     ssize_t bytes;
810     int ret = -1;
811 
812     if (!g_file_get_contents(filename, (char **) &compressed_data, &len,
813                              NULL)) {
814         goto out;
815     }
816 
817     /* Is it a gzip-compressed file? */
818     if (len < 2 ||
819         compressed_data[0] != 0x1f ||
820         compressed_data[1] != 0x8b) {
821         goto out;
822     }
823 
824     if (max_sz > LOAD_IMAGE_MAX_GUNZIP_BYTES) {
825         max_sz = LOAD_IMAGE_MAX_GUNZIP_BYTES;
826     }
827 
828     data = g_malloc(max_sz);
829     bytes = gunzip(data, max_sz, compressed_data, len);
830     if (bytes < 0) {
831         fprintf(stderr, "%s: unable to decompress gzipped kernel file\n",
832                 filename);
833         goto out;
834     }
835 
836     /* trim to actual size and return to caller */
837     *buffer = g_realloc(data, bytes);
838     ret = bytes;
839     /* ownership has been transferred to caller */
840     data = NULL;
841 
842  out:
843     g_free(compressed_data);
844     g_free(data);
845     return ret;
846 }
847 
848 
849 /* The PE/COFF MS-DOS stub magic number */
850 #define EFI_PE_MSDOS_MAGIC        "MZ"
851 
852 /*
853  * The Linux header magic number for a EFI PE/COFF
854  * image targeting an unspecified architecture.
855  */
856 #define EFI_PE_LINUX_MAGIC        "\xcd\x23\x82\x81"
857 
858 /*
859  * Bootable Linux kernel images may be packaged as EFI zboot images, which are
860  * self-decompressing executables when loaded via EFI. The compressed payload
861  * can also be extracted from the image and decompressed by a non-EFI loader.
862  *
863  * The de facto specification for this format is at the following URL:
864  *
865  * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/firmware/efi/libstub/zboot-header.S
866  *
867  * This definition is based on Linux upstream commit 29636a5ce87beba.
868  */
869 struct linux_efi_zboot_header {
870     uint8_t     msdos_magic[2];         /* PE/COFF 'MZ' magic number */
871     uint8_t     reserved0[2];
872     uint8_t     zimg[4];                /* "zimg" for Linux EFI zboot images */
873     uint32_t    payload_offset;         /* LE offset to compressed payload */
874     uint32_t    payload_size;           /* LE size of the compressed payload */
875     uint8_t     reserved1[8];
876     char        compression_type[32];   /* Compression type, NUL terminated */
877     uint8_t     linux_magic[4];         /* Linux header magic */
878     uint32_t    pe_header_offset;       /* LE offset to the PE header */
879 };
880 
881 /*
882  * Check whether *buffer points to a Linux EFI zboot image in memory.
883  *
884  * If it does, attempt to decompress it to a new buffer, and free the old one.
885  * If any of this fails, return an error to the caller.
886  *
887  * If the image is not a Linux EFI zboot image, do nothing and return success.
888  */
unpack_efi_zboot_image(uint8_t ** buffer,int * size)889 ssize_t unpack_efi_zboot_image(uint8_t **buffer, int *size)
890 {
891     const struct linux_efi_zboot_header *header;
892     uint8_t *data = NULL;
893     int ploff, plsize;
894     ssize_t bytes;
895 
896     /* ignore if this is too small to be a EFI zboot image */
897     if (*size < sizeof(*header)) {
898         return 0;
899     }
900 
901     header = (struct linux_efi_zboot_header *)*buffer;
902 
903     /* ignore if this is not a Linux EFI zboot image */
904     if (memcmp(&header->msdos_magic, EFI_PE_MSDOS_MAGIC, 2) != 0 ||
905         memcmp(&header->zimg, "zimg", 4) != 0 ||
906         memcmp(&header->linux_magic, EFI_PE_LINUX_MAGIC, 4) != 0) {
907         return 0;
908     }
909 
910     if (strcmp(header->compression_type, "gzip") != 0) {
911         fprintf(stderr,
912                 "unable to handle EFI zboot image with \"%.*s\" compression\n",
913                 (int)sizeof(header->compression_type) - 1,
914                 header->compression_type);
915         return -1;
916     }
917 
918     ploff = ldl_le_p(&header->payload_offset);
919     plsize = ldl_le_p(&header->payload_size);
920 
921     if (ploff < 0 || plsize < 0 || ploff + plsize > *size) {
922         fprintf(stderr, "unable to handle corrupt EFI zboot image\n");
923         return -1;
924     }
925 
926     data = g_malloc(LOAD_IMAGE_MAX_GUNZIP_BYTES);
927     bytes = gunzip(data, LOAD_IMAGE_MAX_GUNZIP_BYTES, *buffer + ploff, plsize);
928     if (bytes < 0) {
929         fprintf(stderr, "failed to decompress EFI zboot image\n");
930         g_free(data);
931         return -1;
932     }
933 
934     g_free(*buffer);
935     *buffer = g_realloc(data, bytes);
936     *size = bytes;
937     return bytes;
938 }
939 
940 /*
941  * Functions for reboot-persistent memory regions.
942  *  - used for vga bios and option roms.
943  *  - also linux kernel (-kernel / -initrd).
944  */
945 
946 typedef struct Rom Rom;
947 
948 struct Rom {
949     char *name;
950     char *path;
951 
952     /* datasize is the amount of memory allocated in "data". If datasize is less
953      * than romsize, it means that the area from datasize to romsize is filled
954      * with zeros.
955      */
956     size_t romsize;
957     size_t datasize;
958 
959     uint8_t *data;
960     MemoryRegion *mr;
961     AddressSpace *as;
962     int isrom;
963     char *fw_dir;
964     char *fw_file;
965     GMappedFile *mapped_file;
966 
967     bool committed;
968 
969     hwaddr addr;
970     QTAILQ_ENTRY(Rom) next;
971 };
972 
973 static FWCfgState *fw_cfg;
974 static QTAILQ_HEAD(, Rom) roms = QTAILQ_HEAD_INITIALIZER(roms);
975 
976 /*
977  * rom->data can be heap-allocated or memory-mapped (e.g. when added with
978  * rom_add_elf_program())
979  */
rom_free_data(Rom * rom)980 static void rom_free_data(Rom *rom)
981 {
982     if (rom->mapped_file) {
983         g_mapped_file_unref(rom->mapped_file);
984         rom->mapped_file = NULL;
985     } else {
986         g_free(rom->data);
987     }
988 
989     rom->data = NULL;
990 }
991 
rom_free(Rom * rom)992 static void rom_free(Rom *rom)
993 {
994     rom_free_data(rom);
995     g_free(rom->path);
996     g_free(rom->name);
997     g_free(rom->fw_dir);
998     g_free(rom->fw_file);
999     g_free(rom);
1000 }
1001 
rom_order_compare(Rom * rom,Rom * item)1002 static inline bool rom_order_compare(Rom *rom, Rom *item)
1003 {
1004     return ((uintptr_t)(void *)rom->as > (uintptr_t)(void *)item->as) ||
1005            (rom->as == item->as && rom->addr >= item->addr);
1006 }
1007 
rom_insert(Rom * rom)1008 static void rom_insert(Rom *rom)
1009 {
1010     Rom *item;
1011 
1012     if (roms_loaded) {
1013         hw_error ("ROM images must be loaded at startup\n");
1014     }
1015 
1016     /* The user didn't specify an address space, this is the default */
1017     if (!rom->as) {
1018         rom->as = &address_space_memory;
1019     }
1020 
1021     rom->committed = false;
1022 
1023     /* List is ordered by load address in the same address space */
1024     QTAILQ_FOREACH(item, &roms, next) {
1025         if (rom_order_compare(rom, item)) {
1026             continue;
1027         }
1028         QTAILQ_INSERT_BEFORE(item, rom, next);
1029         return;
1030     }
1031     QTAILQ_INSERT_TAIL(&roms, rom, next);
1032 }
1033 
fw_cfg_resized(const char * id,uint64_t length,void * host)1034 static void fw_cfg_resized(const char *id, uint64_t length, void *host)
1035 {
1036     if (fw_cfg) {
1037         fw_cfg_modify_file(fw_cfg, id + strlen("/rom@"), host, length);
1038     }
1039 }
1040 
rom_set_mr(Rom * rom,Object * owner,const char * name,bool ro)1041 static void *rom_set_mr(Rom *rom, Object *owner, const char *name, bool ro)
1042 {
1043     void *data;
1044 
1045     rom->mr = g_malloc(sizeof(*rom->mr));
1046     memory_region_init_resizeable_ram(rom->mr, owner, name,
1047                                       rom->datasize, rom->romsize,
1048                                       fw_cfg_resized,
1049                                       &error_fatal);
1050     memory_region_set_readonly(rom->mr, ro);
1051     vmstate_register_ram_global(rom->mr);
1052 
1053     data = memory_region_get_ram_ptr(rom->mr);
1054     memcpy(data, rom->data, rom->datasize);
1055 
1056     return data;
1057 }
1058 
rom_add_file(const char * file,const char * fw_dir,hwaddr addr,int32_t bootindex,bool has_option_rom,MemoryRegion * mr,AddressSpace * as)1059 ssize_t rom_add_file(const char *file, const char *fw_dir,
1060                      hwaddr addr, int32_t bootindex,
1061                      bool has_option_rom, MemoryRegion *mr,
1062                      AddressSpace *as)
1063 {
1064     MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
1065     Rom *rom;
1066     gsize size;
1067     g_autoptr(GError) gerr = NULL;
1068     char devpath[100];
1069 
1070     if (as && mr) {
1071         fprintf(stderr, "Specifying an Address Space and Memory Region is " \
1072                 "not valid when loading a rom\n");
1073         /* We haven't allocated anything so we don't need any cleanup */
1074         return -1;
1075     }
1076 
1077     rom = g_malloc0(sizeof(*rom));
1078     rom->name = g_strdup(file);
1079     rom->path = qemu_find_file(QEMU_FILE_TYPE_BIOS, rom->name);
1080     rom->as = as;
1081     if (rom->path == NULL) {
1082         rom->path = g_strdup(file);
1083     }
1084 
1085     if (!g_file_get_contents(rom->path, (gchar **) &rom->data,
1086                              &size, &gerr)) {
1087         fprintf(stderr, "rom: file %-20s: error %s\n",
1088                 rom->name, gerr->message);
1089         goto err;
1090     }
1091 
1092     if (fw_dir) {
1093         rom->fw_dir  = g_strdup(fw_dir);
1094         rom->fw_file = g_strdup(file);
1095     }
1096     rom->addr     = addr;
1097     rom->romsize  = size;
1098     rom->datasize = rom->romsize;
1099     rom_insert(rom);
1100     if (rom->fw_file && fw_cfg) {
1101         const char *basename;
1102         char fw_file_name[FW_CFG_MAX_FILE_PATH];
1103         void *data;
1104 
1105         basename = strrchr(rom->fw_file, '/');
1106         if (basename) {
1107             basename++;
1108         } else {
1109             basename = rom->fw_file;
1110         }
1111         snprintf(fw_file_name, sizeof(fw_file_name), "%s/%s", rom->fw_dir,
1112                  basename);
1113         snprintf(devpath, sizeof(devpath), "/rom@%s", fw_file_name);
1114 
1115         if ((!has_option_rom || mc->option_rom_has_mr) && mc->rom_file_has_mr) {
1116             data = rom_set_mr(rom, OBJECT(fw_cfg), devpath, true);
1117         } else {
1118             data = rom->data;
1119         }
1120 
1121         fw_cfg_add_file(fw_cfg, fw_file_name, data, rom->romsize);
1122     } else {
1123         if (mr) {
1124             rom->mr = mr;
1125             snprintf(devpath, sizeof(devpath), "/rom@%s", file);
1126         } else {
1127             snprintf(devpath, sizeof(devpath), "/rom@" HWADDR_FMT_plx, addr);
1128         }
1129     }
1130 
1131     add_boot_device_path(bootindex, NULL, devpath);
1132     return 0;
1133 
1134 err:
1135     rom_free(rom);
1136     return -1;
1137 }
1138 
rom_add_blob(const char * name,const void * blob,size_t len,size_t max_len,hwaddr addr,const char * fw_file_name,FWCfgCallback fw_callback,void * callback_opaque,AddressSpace * as,bool read_only)1139 MemoryRegion *rom_add_blob(const char *name, const void *blob, size_t len,
1140                    size_t max_len, hwaddr addr, const char *fw_file_name,
1141                    FWCfgCallback fw_callback, void *callback_opaque,
1142                    AddressSpace *as, bool read_only)
1143 {
1144     MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
1145     Rom *rom;
1146     MemoryRegion *mr = NULL;
1147 
1148     rom           = g_malloc0(sizeof(*rom));
1149     rom->name     = g_strdup(name);
1150     rom->as       = as;
1151     rom->addr     = addr;
1152     rom->romsize  = max_len ? max_len : len;
1153     rom->datasize = len;
1154     g_assert(rom->romsize >= rom->datasize);
1155     rom->data     = g_malloc0(rom->datasize);
1156     memcpy(rom->data, blob, len);
1157     rom_insert(rom);
1158     if (fw_file_name && fw_cfg) {
1159         char devpath[100];
1160         void *data;
1161 
1162         if (read_only) {
1163             snprintf(devpath, sizeof(devpath), "/rom@%s", fw_file_name);
1164         } else {
1165             snprintf(devpath, sizeof(devpath), "/ram@%s", fw_file_name);
1166         }
1167 
1168         if (mc->rom_file_has_mr) {
1169             data = rom_set_mr(rom, OBJECT(fw_cfg), devpath, read_only);
1170             mr = rom->mr;
1171         } else {
1172             data = rom->data;
1173         }
1174 
1175         fw_cfg_add_file_callback(fw_cfg, fw_file_name,
1176                                  fw_callback, NULL, callback_opaque,
1177                                  data, rom->datasize, read_only);
1178     }
1179     return mr;
1180 }
1181 
1182 /* This function is specific for elf program because we don't need to allocate
1183  * all the rom. We just allocate the first part and the rest is just zeros. This
1184  * is why romsize and datasize are different. Also, this function takes its own
1185  * reference to "mapped_file", so we don't have to allocate and copy the buffer.
1186  */
rom_add_elf_program(const char * name,GMappedFile * mapped_file,void * data,size_t datasize,size_t romsize,hwaddr addr,AddressSpace * as)1187 int rom_add_elf_program(const char *name, GMappedFile *mapped_file, void *data,
1188                         size_t datasize, size_t romsize, hwaddr addr,
1189                         AddressSpace *as)
1190 {
1191     Rom *rom;
1192 
1193     rom           = g_malloc0(sizeof(*rom));
1194     rom->name     = g_strdup(name);
1195     rom->addr     = addr;
1196     rom->datasize = datasize;
1197     rom->romsize  = romsize;
1198     rom->data     = data;
1199     rom->as       = as;
1200 
1201     if (mapped_file && data) {
1202         g_mapped_file_ref(mapped_file);
1203         rom->mapped_file = mapped_file;
1204     }
1205 
1206     rom_insert(rom);
1207     return 0;
1208 }
1209 
rom_add_vga(const char * file)1210 ssize_t rom_add_vga(const char *file)
1211 {
1212     return rom_add_file(file, "vgaroms", 0, -1, true, NULL, NULL);
1213 }
1214 
rom_add_option(const char * file,int32_t bootindex)1215 ssize_t rom_add_option(const char *file, int32_t bootindex)
1216 {
1217     return rom_add_file(file, "genroms", 0, bootindex, true, NULL, NULL);
1218 }
1219 
rom_reset(void * unused)1220 static void rom_reset(void *unused)
1221 {
1222     Rom *rom;
1223 
1224     QTAILQ_FOREACH(rom, &roms, next) {
1225         if (rom->fw_file) {
1226             continue;
1227         }
1228         /*
1229          * We don't need to fill in the RAM with ROM data because we'll fill
1230          * the data in during the next incoming migration in all cases.  Note
1231          * that some of those RAMs can actually be modified by the guest.
1232          */
1233         if (runstate_check(RUN_STATE_INMIGRATE)) {
1234             if (rom->data && rom->isrom) {
1235                 /*
1236                  * Free it so that a rom_reset after migration doesn't
1237                  * overwrite a potentially modified 'rom'.
1238                  */
1239                 rom_free_data(rom);
1240             }
1241             continue;
1242         }
1243 
1244         if (rom->data == NULL) {
1245             continue;
1246         }
1247         if (rom->mr) {
1248             void *host = memory_region_get_ram_ptr(rom->mr);
1249             memcpy(host, rom->data, rom->datasize);
1250             memset(host + rom->datasize, 0, rom->romsize - rom->datasize);
1251         } else {
1252             address_space_write_rom(rom->as, rom->addr, MEMTXATTRS_UNSPECIFIED,
1253                                     rom->data, rom->datasize);
1254             address_space_set(rom->as, rom->addr + rom->datasize, 0,
1255                               rom->romsize - rom->datasize,
1256                               MEMTXATTRS_UNSPECIFIED);
1257         }
1258         if (rom->isrom) {
1259             /* rom needs to be written only once */
1260             rom_free_data(rom);
1261         }
1262         /*
1263          * The rom loader is really on the same level as firmware in the guest
1264          * shadowing a ROM into RAM. Such a shadowing mechanism needs to ensure
1265          * that the instruction cache for that new region is clear, so that the
1266          * CPU definitely fetches its instructions from the just written data.
1267          */
1268         cpu_flush_icache_range(rom->addr, rom->datasize);
1269 
1270         trace_loader_write_rom(rom->name, rom->addr, rom->datasize, rom->isrom);
1271     }
1272 }
1273 
1274 /* Return true if two consecutive ROMs in the ROM list overlap */
roms_overlap(Rom * last_rom,Rom * this_rom)1275 static bool roms_overlap(Rom *last_rom, Rom *this_rom)
1276 {
1277     if (!last_rom) {
1278         return false;
1279     }
1280     return last_rom->as == this_rom->as &&
1281         last_rom->addr + last_rom->romsize > this_rom->addr;
1282 }
1283 
rom_as_name(Rom * rom)1284 static const char *rom_as_name(Rom *rom)
1285 {
1286     const char *name = rom->as ? rom->as->name : NULL;
1287     return name ?: "anonymous";
1288 }
1289 
rom_print_overlap_error_header(void)1290 static void rom_print_overlap_error_header(void)
1291 {
1292     error_report("Some ROM regions are overlapping");
1293     error_printf(
1294         "These ROM regions might have been loaded by "
1295         "direct user request or by default.\n"
1296         "They could be BIOS/firmware images, a guest kernel, "
1297         "initrd or some other file loaded into guest memory.\n"
1298         "Check whether you intended to load all this guest code, and "
1299         "whether it has been built to load to the correct addresses.\n");
1300 }
1301 
rom_print_one_overlap_error(Rom * last_rom,Rom * rom)1302 static void rom_print_one_overlap_error(Rom *last_rom, Rom *rom)
1303 {
1304     error_printf(
1305         "\nThe following two regions overlap (in the %s address space):\n",
1306         rom_as_name(rom));
1307     error_printf(
1308         "  %s (addresses 0x" HWADDR_FMT_plx " - 0x" HWADDR_FMT_plx ")\n",
1309         last_rom->name, last_rom->addr, last_rom->addr + last_rom->romsize);
1310     error_printf(
1311         "  %s (addresses 0x" HWADDR_FMT_plx " - 0x" HWADDR_FMT_plx ")\n",
1312         rom->name, rom->addr, rom->addr + rom->romsize);
1313 }
1314 
rom_check_and_register_reset(void)1315 int rom_check_and_register_reset(void)
1316 {
1317     MemoryRegionSection section;
1318     Rom *rom, *last_rom = NULL;
1319     bool found_overlap = false;
1320 
1321     QTAILQ_FOREACH(rom, &roms, next) {
1322         if (rom->fw_file) {
1323             continue;
1324         }
1325         if (!rom->mr) {
1326             if (roms_overlap(last_rom, rom)) {
1327                 if (!found_overlap) {
1328                     found_overlap = true;
1329                     rom_print_overlap_error_header();
1330                 }
1331                 rom_print_one_overlap_error(last_rom, rom);
1332                 /* Keep going through the list so we report all overlaps */
1333             }
1334             last_rom = rom;
1335         }
1336         section = memory_region_find(rom->mr ? rom->mr : get_system_memory(),
1337                                      rom->addr, 1);
1338         rom->isrom = int128_nz(section.size) && memory_region_is_rom(section.mr);
1339         memory_region_unref(section.mr);
1340     }
1341     if (found_overlap) {
1342         return -1;
1343     }
1344 
1345     qemu_register_reset(rom_reset, NULL);
1346     roms_loaded = 1;
1347     return 0;
1348 }
1349 
rom_set_fw(FWCfgState * f)1350 void rom_set_fw(FWCfgState *f)
1351 {
1352     fw_cfg = f;
1353 }
1354 
rom_set_order_override(int order)1355 void rom_set_order_override(int order)
1356 {
1357     if (!fw_cfg)
1358         return;
1359     fw_cfg_set_order_override(fw_cfg, order);
1360 }
1361 
rom_reset_order_override(void)1362 void rom_reset_order_override(void)
1363 {
1364     if (!fw_cfg)
1365         return;
1366     fw_cfg_reset_order_override(fw_cfg);
1367 }
1368 
rom_transaction_begin(void)1369 void rom_transaction_begin(void)
1370 {
1371     Rom *rom;
1372 
1373     /* Ignore ROMs added without the transaction API */
1374     QTAILQ_FOREACH(rom, &roms, next) {
1375         rom->committed = true;
1376     }
1377 }
1378 
rom_transaction_end(bool commit)1379 void rom_transaction_end(bool commit)
1380 {
1381     Rom *rom;
1382     Rom *tmp;
1383 
1384     QTAILQ_FOREACH_SAFE(rom, &roms, next, tmp) {
1385         if (rom->committed) {
1386             continue;
1387         }
1388         if (commit) {
1389             rom->committed = true;
1390         } else {
1391             QTAILQ_REMOVE(&roms, rom, next);
1392             rom_free(rom);
1393         }
1394     }
1395 }
1396 
find_rom(hwaddr addr,size_t size)1397 static Rom *find_rom(hwaddr addr, size_t size)
1398 {
1399     Rom *rom;
1400 
1401     QTAILQ_FOREACH(rom, &roms, next) {
1402         if (rom->fw_file) {
1403             continue;
1404         }
1405         if (rom->mr) {
1406             continue;
1407         }
1408         if (rom->addr > addr) {
1409             continue;
1410         }
1411         if (rom->addr + rom->romsize < addr + size) {
1412             continue;
1413         }
1414         return rom;
1415     }
1416     return NULL;
1417 }
1418 
1419 typedef struct RomSec {
1420     hwaddr base;
1421     int se; /* start/end flag */
1422 } RomSec;
1423 
1424 
1425 /*
1426  * Sort into address order. We break ties between rom-startpoints
1427  * and rom-endpoints in favour of the startpoint, by sorting the 0->1
1428  * transition before the 1->0 transition. Either way round would
1429  * work, but this way saves a little work later by avoiding
1430  * dealing with "gaps" of 0 length.
1431  */
sort_secs(gconstpointer a,gconstpointer b)1432 static gint sort_secs(gconstpointer a, gconstpointer b)
1433 {
1434     RomSec *ra = (RomSec *) a;
1435     RomSec *rb = (RomSec *) b;
1436 
1437     if (ra->base == rb->base) {
1438         return ra->se - rb->se;
1439     }
1440     return ra->base > rb->base ? 1 : -1;
1441 }
1442 
add_romsec_to_list(GList * secs,hwaddr base,int se)1443 static GList *add_romsec_to_list(GList *secs, hwaddr base, int se)
1444 {
1445    RomSec *cand = g_new(RomSec, 1);
1446    cand->base = base;
1447    cand->se = se;
1448    return g_list_prepend(secs, cand);
1449 }
1450 
rom_find_largest_gap_between(hwaddr base,size_t size)1451 RomGap rom_find_largest_gap_between(hwaddr base, size_t size)
1452 {
1453     Rom *rom;
1454     RomSec *cand;
1455     RomGap res = {0, 0};
1456     hwaddr gapstart = base;
1457     GList *it, *secs = NULL;
1458     int count = 0;
1459 
1460     QTAILQ_FOREACH(rom, &roms, next) {
1461         /* Ignore blobs being loaded to special places */
1462         if (rom->mr || rom->fw_file) {
1463             continue;
1464         }
1465         /* ignore anything finishing below base */
1466         if (rom->addr + rom->romsize <= base) {
1467             continue;
1468         }
1469         /* ignore anything starting above the region */
1470         if (rom->addr >= base + size) {
1471             continue;
1472         }
1473 
1474         /* Save the start and end of each relevant ROM */
1475         secs = add_romsec_to_list(secs, rom->addr, 1);
1476 
1477         if (rom->addr + rom->romsize < base + size) {
1478             secs = add_romsec_to_list(secs, rom->addr + rom->romsize, -1);
1479         }
1480     }
1481 
1482     /* sentinel */
1483     secs = add_romsec_to_list(secs, base + size, 1);
1484 
1485     secs = g_list_sort(secs, sort_secs);
1486 
1487     for (it = g_list_first(secs); it; it = g_list_next(it)) {
1488         cand = (RomSec *) it->data;
1489         if (count == 0 && count + cand->se == 1) {
1490             size_t gap = cand->base - gapstart;
1491             if (gap > res.size) {
1492                 res.base = gapstart;
1493                 res.size = gap;
1494             }
1495         } else if (count == 1 && count + cand->se == 0) {
1496             gapstart = cand->base;
1497         }
1498         count += cand->se;
1499     }
1500 
1501     g_list_free_full(secs, g_free);
1502     return res;
1503 }
1504 
1505 /*
1506  * Copies memory from registered ROMs to dest. Any memory that is contained in
1507  * a ROM between addr and addr + size is copied. Note that this can involve
1508  * multiple ROMs, which need not start at addr and need not end at addr + size.
1509  */
rom_copy(uint8_t * dest,hwaddr addr,size_t size)1510 int rom_copy(uint8_t *dest, hwaddr addr, size_t size)
1511 {
1512     hwaddr end = addr + size;
1513     uint8_t *s, *d = dest;
1514     size_t l = 0;
1515     Rom *rom;
1516 
1517     QTAILQ_FOREACH(rom, &roms, next) {
1518         if (rom->fw_file) {
1519             continue;
1520         }
1521         if (rom->mr) {
1522             continue;
1523         }
1524         if (rom->addr + rom->romsize < addr) {
1525             continue;
1526         }
1527         if (rom->addr > end || rom->addr < addr) {
1528             break;
1529         }
1530 
1531         d = dest + (rom->addr - addr);
1532         s = rom->data;
1533         l = rom->datasize;
1534 
1535         if ((d + l) > (dest + size)) {
1536             l = dest - d;
1537         }
1538 
1539         if (l > 0) {
1540             memcpy(d, s, l);
1541         }
1542 
1543         if (rom->romsize > rom->datasize) {
1544             /* If datasize is less than romsize, it means that we didn't
1545              * allocate all the ROM because the trailing data are only zeros.
1546              */
1547 
1548             d += l;
1549             l = rom->romsize - rom->datasize;
1550 
1551             if ((d + l) > (dest + size)) {
1552                 /* Rom size doesn't fit in the destination area. Adjust to avoid
1553                  * overflow.
1554                  */
1555                 l = dest - d;
1556             }
1557 
1558             if (l > 0) {
1559                 memset(d, 0x0, l);
1560             }
1561         }
1562     }
1563 
1564     return (d + l) - dest;
1565 }
1566 
rom_ptr(hwaddr addr,size_t size)1567 void *rom_ptr(hwaddr addr, size_t size)
1568 {
1569     Rom *rom;
1570 
1571     rom = find_rom(addr, size);
1572     if (!rom || !rom->data)
1573         return NULL;
1574     return rom->data + (addr - rom->addr);
1575 }
1576 
1577 typedef struct FindRomCBData {
1578     size_t size; /* Amount of data we want from ROM, in bytes */
1579     MemoryRegion *mr; /* MR at the unaliased guest addr */
1580     hwaddr xlat; /* Offset of addr within mr */
1581     void *rom; /* Output: rom data pointer, if found */
1582 } FindRomCBData;
1583 
find_rom_cb(Int128 start,Int128 len,const MemoryRegion * mr,hwaddr offset_in_region,void * opaque)1584 static bool find_rom_cb(Int128 start, Int128 len, const MemoryRegion *mr,
1585                         hwaddr offset_in_region, void *opaque)
1586 {
1587     FindRomCBData *cbdata = opaque;
1588     hwaddr alias_addr;
1589 
1590     if (mr != cbdata->mr) {
1591         return false;
1592     }
1593 
1594     alias_addr = int128_get64(start) + cbdata->xlat - offset_in_region;
1595     cbdata->rom = rom_ptr(alias_addr, cbdata->size);
1596     if (!cbdata->rom) {
1597         return false;
1598     }
1599     /* Found a match, stop iterating */
1600     return true;
1601 }
1602 
rom_ptr_for_as(AddressSpace * as,hwaddr addr,size_t size)1603 void *rom_ptr_for_as(AddressSpace *as, hwaddr addr, size_t size)
1604 {
1605     /*
1606      * Find any ROM data for the given guest address range.  If there
1607      * is a ROM blob then return a pointer to the host memory
1608      * corresponding to 'addr'; otherwise return NULL.
1609      *
1610      * We look not only for ROM blobs that were loaded directly to
1611      * addr, but also for ROM blobs that were loaded to aliases of
1612      * that memory at other addresses within the AddressSpace.
1613      *
1614      * Note that we do not check @as against the 'as' member in the
1615      * 'struct Rom' returned by rom_ptr(). The Rom::as is the
1616      * AddressSpace which the rom blob should be written to, whereas
1617      * our @as argument is the AddressSpace which we are (effectively)
1618      * reading from, and the same underlying RAM will often be visible
1619      * in multiple AddressSpaces. (A common example is a ROM blob
1620      * written to the 'system' address space but then read back via a
1621      * CPU's cpu->as pointer.) This does mean we might potentially
1622      * return a false-positive match if a ROM blob was loaded into an
1623      * AS which is entirely separate and distinct from the one we're
1624      * querying, but this issue exists also for rom_ptr() and hasn't
1625      * caused any problems in practice.
1626      */
1627     FlatView *fv;
1628     void *rom;
1629     hwaddr len_unused;
1630     FindRomCBData cbdata = {};
1631 
1632     /* Easy case: there's data at the actual address */
1633     rom = rom_ptr(addr, size);
1634     if (rom) {
1635         return rom;
1636     }
1637 
1638     RCU_READ_LOCK_GUARD();
1639 
1640     fv = address_space_to_flatview(as);
1641     cbdata.mr = flatview_translate(fv, addr, &cbdata.xlat, &len_unused,
1642                                    false, MEMTXATTRS_UNSPECIFIED);
1643     if (!cbdata.mr) {
1644         /* Nothing at this address, so there can't be any aliasing */
1645         return NULL;
1646     }
1647     cbdata.size = size;
1648     flatview_for_each_range(fv, find_rom_cb, &cbdata);
1649     return cbdata.rom;
1650 }
1651 
qmp_x_query_roms(Error ** errp)1652 HumanReadableText *qmp_x_query_roms(Error **errp)
1653 {
1654     Rom *rom;
1655     g_autoptr(GString) buf = g_string_new("");
1656 
1657     QTAILQ_FOREACH(rom, &roms, next) {
1658         if (rom->mr) {
1659             g_string_append_printf(buf, "%s"
1660                                    " size=0x%06zx name=\"%s\"\n",
1661                                    memory_region_name(rom->mr),
1662                                    rom->romsize,
1663                                    rom->name);
1664         } else if (!rom->fw_file) {
1665             g_string_append_printf(buf, "addr=" HWADDR_FMT_plx
1666                                    " size=0x%06zx mem=%s name=\"%s\"\n",
1667                                    rom->addr, rom->romsize,
1668                                    rom->isrom ? "rom" : "ram",
1669                                    rom->name);
1670         } else {
1671             g_string_append_printf(buf, "fw=%s/%s"
1672                                    " size=0x%06zx name=\"%s\"\n",
1673                                    rom->fw_dir,
1674                                    rom->fw_file,
1675                                    rom->romsize,
1676                                    rom->name);
1677         }
1678     }
1679 
1680     return human_readable_text_from_str(buf);
1681 }
1682 
1683 typedef enum HexRecord HexRecord;
1684 enum HexRecord {
1685     DATA_RECORD = 0,
1686     EOF_RECORD,
1687     EXT_SEG_ADDR_RECORD,
1688     START_SEG_ADDR_RECORD,
1689     EXT_LINEAR_ADDR_RECORD,
1690     START_LINEAR_ADDR_RECORD,
1691 };
1692 
1693 /* Each record contains a 16-bit address which is combined with the upper 16
1694  * bits of the implicit "next address" to form a 32-bit address.
1695  */
1696 #define NEXT_ADDR_MASK 0xffff0000
1697 
1698 #define DATA_FIELD_MAX_LEN 0xff
1699 #define LEN_EXCEPT_DATA 0x5
1700 /* 0x5 = sizeof(byte_count) + sizeof(address) + sizeof(record_type) +
1701  *       sizeof(checksum) */
1702 typedef struct {
1703     uint8_t byte_count;
1704     uint16_t address;
1705     uint8_t record_type;
1706     uint8_t data[DATA_FIELD_MAX_LEN];
1707     uint8_t checksum;
1708 } HexLine;
1709 
1710 /* return 0 or -1 if error */
parse_record(HexLine * line,uint8_t * our_checksum,const uint8_t c,uint32_t * index,const bool in_process)1711 static bool parse_record(HexLine *line, uint8_t *our_checksum, const uint8_t c,
1712                          uint32_t *index, const bool in_process)
1713 {
1714     /* +-------+---------------+-------+---------------------+--------+
1715      * | byte  |               |record |                     |        |
1716      * | count |    address    | type  |        data         |checksum|
1717      * +-------+---------------+-------+---------------------+--------+
1718      * ^       ^               ^       ^                     ^        ^
1719      * |1 byte |    2 bytes    |1 byte |     0-255 bytes     | 1 byte |
1720      */
1721     uint8_t value = 0;
1722     uint32_t idx = *index;
1723     /* ignore space */
1724     if (g_ascii_isspace(c)) {
1725         return true;
1726     }
1727     if (!g_ascii_isxdigit(c) || !in_process) {
1728         return false;
1729     }
1730     value = g_ascii_xdigit_value(c);
1731     value = (idx & 0x1) ? (value & 0xf) : (value << 4);
1732     if (idx < 2) {
1733         line->byte_count |= value;
1734     } else if (2 <= idx && idx < 6) {
1735         line->address <<= 4;
1736         line->address += g_ascii_xdigit_value(c);
1737     } else if (6 <= idx && idx < 8) {
1738         line->record_type |= value;
1739     } else if (8 <= idx && idx < 8 + 2 * line->byte_count) {
1740         line->data[(idx - 8) >> 1] |= value;
1741     } else if (8 + 2 * line->byte_count <= idx &&
1742                idx < 10 + 2 * line->byte_count) {
1743         line->checksum |= value;
1744     } else {
1745         return false;
1746     }
1747     *our_checksum += value;
1748     ++(*index);
1749     return true;
1750 }
1751 
1752 typedef struct {
1753     const char *filename;
1754     HexLine line;
1755     uint8_t *bin_buf;
1756     hwaddr *start_addr;
1757     int total_size;
1758     uint32_t next_address_to_write;
1759     uint32_t current_address;
1760     uint32_t current_rom_index;
1761     uint32_t rom_start_address;
1762     AddressSpace *as;
1763     bool complete;
1764 } HexParser;
1765 
1766 /* return size or -1 if error */
handle_record_type(HexParser * parser)1767 static int handle_record_type(HexParser *parser)
1768 {
1769     HexLine *line = &(parser->line);
1770     switch (line->record_type) {
1771     case DATA_RECORD:
1772         parser->current_address =
1773             (parser->next_address_to_write & NEXT_ADDR_MASK) | line->address;
1774         /* verify this is a contiguous block of memory */
1775         if (parser->current_address != parser->next_address_to_write) {
1776             if (parser->current_rom_index != 0) {
1777                 rom_add_blob_fixed_as(parser->filename, parser->bin_buf,
1778                                       parser->current_rom_index,
1779                                       parser->rom_start_address, parser->as);
1780             }
1781             parser->rom_start_address = parser->current_address;
1782             parser->current_rom_index = 0;
1783         }
1784 
1785         /* copy from line buffer to output bin_buf */
1786         memcpy(parser->bin_buf + parser->current_rom_index, line->data,
1787                line->byte_count);
1788         parser->current_rom_index += line->byte_count;
1789         parser->total_size += line->byte_count;
1790         /* save next address to write */
1791         parser->next_address_to_write =
1792             parser->current_address + line->byte_count;
1793         break;
1794 
1795     case EOF_RECORD:
1796         if (parser->current_rom_index != 0) {
1797             rom_add_blob_fixed_as(parser->filename, parser->bin_buf,
1798                                   parser->current_rom_index,
1799                                   parser->rom_start_address, parser->as);
1800         }
1801         parser->complete = true;
1802         return parser->total_size;
1803     case EXT_SEG_ADDR_RECORD:
1804     case EXT_LINEAR_ADDR_RECORD:
1805         if (line->byte_count != 2 && line->address != 0) {
1806             return -1;
1807         }
1808 
1809         if (parser->current_rom_index != 0) {
1810             rom_add_blob_fixed_as(parser->filename, parser->bin_buf,
1811                                   parser->current_rom_index,
1812                                   parser->rom_start_address, parser->as);
1813         }
1814 
1815         /* save next address to write,
1816          * in case of non-contiguous block of memory */
1817         parser->next_address_to_write = (line->data[0] << 12) |
1818                                         (line->data[1] << 4);
1819         if (line->record_type == EXT_LINEAR_ADDR_RECORD) {
1820             parser->next_address_to_write <<= 12;
1821         }
1822 
1823         parser->rom_start_address = parser->next_address_to_write;
1824         parser->current_rom_index = 0;
1825         break;
1826 
1827     case START_SEG_ADDR_RECORD:
1828         if (line->byte_count != 4 && line->address != 0) {
1829             return -1;
1830         }
1831 
1832         /* x86 16-bit CS:IP segmented addressing */
1833         *(parser->start_addr) = (((line->data[0] << 8) | line->data[1]) << 4) +
1834                                 ((line->data[2] << 8) | line->data[3]);
1835         break;
1836 
1837     case START_LINEAR_ADDR_RECORD:
1838         if (line->byte_count != 4 && line->address != 0) {
1839             return -1;
1840         }
1841 
1842         *(parser->start_addr) = ldl_be_p(line->data);
1843         break;
1844 
1845     default:
1846         return -1;
1847     }
1848 
1849     return parser->total_size;
1850 }
1851 
1852 /* return size or -1 if error */
parse_hex_blob(const char * filename,hwaddr * addr,uint8_t * hex_blob,size_t hex_blob_size,AddressSpace * as)1853 static int parse_hex_blob(const char *filename, hwaddr *addr, uint8_t *hex_blob,
1854                           size_t hex_blob_size, AddressSpace *as)
1855 {
1856     bool in_process = false; /* avoid re-enter and
1857                               * check whether record begin with ':' */
1858     uint8_t *end = hex_blob + hex_blob_size;
1859     uint8_t our_checksum = 0;
1860     uint32_t record_index = 0;
1861     HexParser parser = {
1862         .filename = filename,
1863         .bin_buf = g_malloc(hex_blob_size),
1864         .start_addr = addr,
1865         .as = as,
1866         .complete = false
1867     };
1868 
1869     rom_transaction_begin();
1870 
1871     for (; hex_blob < end && !parser.complete; ++hex_blob) {
1872         switch (*hex_blob) {
1873         case '\r':
1874         case '\n':
1875             if (!in_process) {
1876                 break;
1877             }
1878 
1879             in_process = false;
1880             if ((LEN_EXCEPT_DATA + parser.line.byte_count) * 2 !=
1881                     record_index ||
1882                 our_checksum != 0) {
1883                 parser.total_size = -1;
1884                 goto out;
1885             }
1886 
1887             if (handle_record_type(&parser) == -1) {
1888                 parser.total_size = -1;
1889                 goto out;
1890             }
1891             break;
1892 
1893         /* start of a new record. */
1894         case ':':
1895             memset(&parser.line, 0, sizeof(HexLine));
1896             in_process = true;
1897             record_index = 0;
1898             break;
1899 
1900         /* decoding lines */
1901         default:
1902             if (!parse_record(&parser.line, &our_checksum, *hex_blob,
1903                               &record_index, in_process)) {
1904                 parser.total_size = -1;
1905                 goto out;
1906             }
1907             break;
1908         }
1909     }
1910 
1911 out:
1912     g_free(parser.bin_buf);
1913     rom_transaction_end(parser.total_size != -1);
1914     return parser.total_size;
1915 }
1916 
1917 /* return size or -1 if error */
load_targphys_hex_as(const char * filename,hwaddr * entry,AddressSpace * as)1918 ssize_t load_targphys_hex_as(const char *filename, hwaddr *entry,
1919                              AddressSpace *as)
1920 {
1921     gsize hex_blob_size;
1922     gchar *hex_blob;
1923     ssize_t total_size = 0;
1924 
1925     if (!g_file_get_contents(filename, &hex_blob, &hex_blob_size, NULL)) {
1926         return -1;
1927     }
1928 
1929     total_size = parse_hex_blob(filename, entry, (uint8_t *)hex_blob,
1930                                 hex_blob_size, as);
1931 
1932     g_free(hex_blob);
1933     return total_size;
1934 }
1935