xref: /openbmc/qemu/hw/nvram/fw_cfg.c (revision 500eb6db)
1 /*
2  * QEMU Firmware configuration device emulation
3  *
4  * Copyright (c) 2008 Gleb Natapov
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "qemu-common.h"
27 #include "hw/hw.h"
28 #include "sysemu/sysemu.h"
29 #include "sysemu/dma.h"
30 #include "hw/boards.h"
31 #include "hw/nvram/fw_cfg.h"
32 #include "hw/sysbus.h"
33 #include "trace.h"
34 #include "qemu/error-report.h"
35 #include "qemu/option.h"
36 #include "qemu/config-file.h"
37 #include "qemu/cutils.h"
38 #include "qapi/error.h"
39 
40 #define FW_CFG_FILE_SLOTS_DFLT 0x20
41 
42 /* FW_CFG_VERSION bits */
43 #define FW_CFG_VERSION      0x01
44 #define FW_CFG_VERSION_DMA  0x02
45 
46 /* FW_CFG_DMA_CONTROL bits */
47 #define FW_CFG_DMA_CTL_ERROR   0x01
48 #define FW_CFG_DMA_CTL_READ    0x02
49 #define FW_CFG_DMA_CTL_SKIP    0x04
50 #define FW_CFG_DMA_CTL_SELECT  0x08
51 #define FW_CFG_DMA_CTL_WRITE   0x10
52 
53 #define FW_CFG_DMA_SIGNATURE 0x51454d5520434647ULL /* "QEMU CFG" */
54 
55 struct FWCfgEntry {
56     uint32_t len;
57     bool allow_write;
58     uint8_t *data;
59     void *callback_opaque;
60     FWCfgCallback select_cb;
61     FWCfgWriteCallback write_cb;
62 };
63 
64 /**
65  * key_name:
66  *
67  * @key: The uint16 selector key.
68  *
69  * Returns: The stringified name if the selector refers to a well-known
70  *          numerically defined item, or NULL on key lookup failure.
71  */
72 static const char *key_name(uint16_t key)
73 {
74     static const char *fw_cfg_wellknown_keys[FW_CFG_FILE_FIRST] = {
75         [FW_CFG_SIGNATURE] = "signature",
76         [FW_CFG_ID] = "id",
77         [FW_CFG_UUID] = "uuid",
78         [FW_CFG_RAM_SIZE] = "ram_size",
79         [FW_CFG_NOGRAPHIC] = "nographic",
80         [FW_CFG_NB_CPUS] = "nb_cpus",
81         [FW_CFG_MACHINE_ID] = "machine_id",
82         [FW_CFG_KERNEL_ADDR] = "kernel_addr",
83         [FW_CFG_KERNEL_SIZE] = "kernel_size",
84         [FW_CFG_KERNEL_CMDLINE] = "kernel_cmdline",
85         [FW_CFG_INITRD_ADDR] = "initrd_addr",
86         [FW_CFG_INITRD_SIZE] = "initdr_size",
87         [FW_CFG_BOOT_DEVICE] = "boot_device",
88         [FW_CFG_NUMA] = "numa",
89         [FW_CFG_BOOT_MENU] = "boot_menu",
90         [FW_CFG_MAX_CPUS] = "max_cpus",
91         [FW_CFG_KERNEL_ENTRY] = "kernel_entry",
92         [FW_CFG_KERNEL_DATA] = "kernel_data",
93         [FW_CFG_INITRD_DATA] = "initrd_data",
94         [FW_CFG_CMDLINE_ADDR] = "cmdline_addr",
95         [FW_CFG_CMDLINE_SIZE] = "cmdline_size",
96         [FW_CFG_CMDLINE_DATA] = "cmdline_data",
97         [FW_CFG_SETUP_ADDR] = "setup_addr",
98         [FW_CFG_SETUP_SIZE] = "setup_size",
99         [FW_CFG_SETUP_DATA] = "setup_data",
100         [FW_CFG_FILE_DIR] = "file_dir",
101     };
102 
103     if (key & FW_CFG_ARCH_LOCAL) {
104         return fw_cfg_arch_key_name(key);
105     }
106     if (key < FW_CFG_FILE_FIRST) {
107         return fw_cfg_wellknown_keys[key];
108     }
109 
110     return NULL;
111 }
112 
113 static inline const char *trace_key_name(uint16_t key)
114 {
115     const char *name = key_name(key);
116 
117     return name ? name : "unknown";
118 }
119 
120 #define JPG_FILE 0
121 #define BMP_FILE 1
122 
123 static char *read_splashfile(char *filename, gsize *file_sizep,
124                              int *file_typep)
125 {
126     GError *err = NULL;
127     gchar *content;
128     int file_type;
129     unsigned int filehead;
130     int bmp_bpp;
131 
132     if (!g_file_get_contents(filename, &content, file_sizep, &err)) {
133         error_report("failed to read splash file '%s': %s",
134                      filename, err->message);
135         g_error_free(err);
136         return NULL;
137     }
138 
139     /* check file size */
140     if (*file_sizep < 30) {
141         goto error;
142     }
143 
144     /* check magic ID */
145     filehead = lduw_le_p(content);
146     if (filehead == 0xd8ff) {
147         file_type = JPG_FILE;
148     } else if (filehead == 0x4d42) {
149         file_type = BMP_FILE;
150     } else {
151         goto error;
152     }
153 
154     /* check BMP bpp */
155     if (file_type == BMP_FILE) {
156         bmp_bpp = lduw_le_p(&content[28]);
157         if (bmp_bpp != 24) {
158             goto error;
159         }
160     }
161 
162     /* return values */
163     *file_typep = file_type;
164 
165     return content;
166 
167 error:
168     error_report("splash file '%s' format not recognized; must be JPEG "
169                  "or 24 bit BMP", filename);
170     g_free(content);
171     return NULL;
172 }
173 
174 static void fw_cfg_bootsplash(FWCfgState *s)
175 {
176     const char *boot_splash_filename = NULL;
177     const char *boot_splash_time = NULL;
178     char *filename, *file_data;
179     gsize file_size;
180     int file_type;
181 
182     /* get user configuration */
183     QemuOptsList *plist = qemu_find_opts("boot-opts");
184     QemuOpts *opts = QTAILQ_FIRST(&plist->head);
185     boot_splash_filename = qemu_opt_get(opts, "splash");
186     boot_splash_time = qemu_opt_get(opts, "splash-time");
187 
188     /* insert splash time if user configurated */
189     if (boot_splash_time) {
190         int64_t bst_val = qemu_opt_get_number(opts, "splash-time", -1);
191         uint16_t bst_le16;
192 
193         /* validate the input */
194         if (bst_val < 0 || bst_val > 0xffff) {
195             error_report("splash-time is invalid,"
196                          "it should be a value between 0 and 65535");
197             exit(1);
198         }
199         /* use little endian format */
200         bst_le16 = cpu_to_le16(bst_val);
201         fw_cfg_add_file(s, "etc/boot-menu-wait",
202                         g_memdup(&bst_le16, sizeof bst_le16), sizeof bst_le16);
203     }
204 
205     /* insert splash file if user configurated */
206     if (boot_splash_filename) {
207         filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, boot_splash_filename);
208         if (filename == NULL) {
209             error_report("failed to find file '%s'", boot_splash_filename);
210             return;
211         }
212 
213         /* loading file data */
214         file_data = read_splashfile(filename, &file_size, &file_type);
215         if (file_data == NULL) {
216             g_free(filename);
217             return;
218         }
219         g_free(boot_splash_filedata);
220         boot_splash_filedata = (uint8_t *)file_data;
221 
222         /* insert data */
223         if (file_type == JPG_FILE) {
224             fw_cfg_add_file(s, "bootsplash.jpg",
225                             boot_splash_filedata, file_size);
226         } else {
227             fw_cfg_add_file(s, "bootsplash.bmp",
228                             boot_splash_filedata, file_size);
229         }
230         g_free(filename);
231     }
232 }
233 
234 static void fw_cfg_reboot(FWCfgState *s)
235 {
236     const char *reboot_timeout = NULL;
237     int64_t rt_val = -1;
238     uint32_t rt_le32;
239 
240     /* get user configuration */
241     QemuOptsList *plist = qemu_find_opts("boot-opts");
242     QemuOpts *opts = QTAILQ_FIRST(&plist->head);
243     reboot_timeout = qemu_opt_get(opts, "reboot-timeout");
244 
245     if (reboot_timeout) {
246         rt_val = qemu_opt_get_number(opts, "reboot-timeout", -1);
247         /* validate the input */
248         if (rt_val < 0 || rt_val > 0xffff) {
249             error_report("reboot timeout is invalid,"
250                          "it should be a value between 0 and 65535");
251             exit(1);
252         }
253     }
254 
255     rt_le32 = cpu_to_le32(rt_val);
256     fw_cfg_add_file(s, "etc/boot-fail-wait", g_memdup(&rt_le32, 4), 4);
257 }
258 
259 static void fw_cfg_write(FWCfgState *s, uint8_t value)
260 {
261     /* nothing, write support removed in QEMU v2.4+ */
262 }
263 
264 static inline uint16_t fw_cfg_file_slots(const FWCfgState *s)
265 {
266     return s->file_slots;
267 }
268 
269 /* Note: this function returns an exclusive limit. */
270 static inline uint32_t fw_cfg_max_entry(const FWCfgState *s)
271 {
272     return FW_CFG_FILE_FIRST + fw_cfg_file_slots(s);
273 }
274 
275 static int fw_cfg_select(FWCfgState *s, uint16_t key)
276 {
277     int arch, ret;
278     FWCfgEntry *e;
279 
280     s->cur_offset = 0;
281     if ((key & FW_CFG_ENTRY_MASK) >= fw_cfg_max_entry(s)) {
282         s->cur_entry = FW_CFG_INVALID;
283         ret = 0;
284     } else {
285         s->cur_entry = key;
286         ret = 1;
287         /* entry successfully selected, now run callback if present */
288         arch = !!(key & FW_CFG_ARCH_LOCAL);
289         e = &s->entries[arch][key & FW_CFG_ENTRY_MASK];
290         if (e->select_cb) {
291             e->select_cb(e->callback_opaque);
292         }
293     }
294 
295     trace_fw_cfg_select(s, key, trace_key_name(key), ret);
296     return ret;
297 }
298 
299 static uint64_t fw_cfg_data_read(void *opaque, hwaddr addr, unsigned size)
300 {
301     FWCfgState *s = opaque;
302     int arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
303     FWCfgEntry *e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
304                     &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
305     uint64_t value = 0;
306 
307     assert(size > 0 && size <= sizeof(value));
308     if (s->cur_entry != FW_CFG_INVALID && e->data && s->cur_offset < e->len) {
309         /* The least significant 'size' bytes of the return value are
310          * expected to contain a string preserving portion of the item
311          * data, padded with zeros on the right in case we run out early.
312          * In technical terms, we're composing the host-endian representation
313          * of the big endian interpretation of the fw_cfg string.
314          */
315         do {
316             value = (value << 8) | e->data[s->cur_offset++];
317         } while (--size && s->cur_offset < e->len);
318         /* If size is still not zero, we *did* run out early, so continue
319          * left-shifting, to add the appropriate number of padding zeros
320          * on the right.
321          */
322         value <<= 8 * size;
323     }
324 
325     trace_fw_cfg_read(s, value);
326     return value;
327 }
328 
329 static void fw_cfg_data_mem_write(void *opaque, hwaddr addr,
330                                   uint64_t value, unsigned size)
331 {
332     FWCfgState *s = opaque;
333     unsigned i = size;
334 
335     do {
336         fw_cfg_write(s, value >> (8 * --i));
337     } while (i);
338 }
339 
340 static void fw_cfg_dma_transfer(FWCfgState *s)
341 {
342     dma_addr_t len;
343     FWCfgDmaAccess dma;
344     int arch;
345     FWCfgEntry *e;
346     int read = 0, write = 0;
347     dma_addr_t dma_addr;
348 
349     /* Reset the address before the next access */
350     dma_addr = s->dma_addr;
351     s->dma_addr = 0;
352 
353     if (dma_memory_read(s->dma_as, dma_addr, &dma, sizeof(dma))) {
354         stl_be_dma(s->dma_as, dma_addr + offsetof(FWCfgDmaAccess, control),
355                    FW_CFG_DMA_CTL_ERROR);
356         return;
357     }
358 
359     dma.address = be64_to_cpu(dma.address);
360     dma.length = be32_to_cpu(dma.length);
361     dma.control = be32_to_cpu(dma.control);
362 
363     if (dma.control & FW_CFG_DMA_CTL_SELECT) {
364         fw_cfg_select(s, dma.control >> 16);
365     }
366 
367     arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
368     e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
369         &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
370 
371     if (dma.control & FW_CFG_DMA_CTL_READ) {
372         read = 1;
373         write = 0;
374     } else if (dma.control & FW_CFG_DMA_CTL_WRITE) {
375         read = 0;
376         write = 1;
377     } else if (dma.control & FW_CFG_DMA_CTL_SKIP) {
378         read = 0;
379         write = 0;
380     } else {
381         dma.length = 0;
382     }
383 
384     dma.control = 0;
385 
386     while (dma.length > 0 && !(dma.control & FW_CFG_DMA_CTL_ERROR)) {
387         if (s->cur_entry == FW_CFG_INVALID || !e->data ||
388                                 s->cur_offset >= e->len) {
389             len = dma.length;
390 
391             /* If the access is not a read access, it will be a skip access,
392              * tested before.
393              */
394             if (read) {
395                 if (dma_memory_set(s->dma_as, dma.address, 0, len)) {
396                     dma.control |= FW_CFG_DMA_CTL_ERROR;
397                 }
398             }
399             if (write) {
400                 dma.control |= FW_CFG_DMA_CTL_ERROR;
401             }
402         } else {
403             if (dma.length <= (e->len - s->cur_offset)) {
404                 len = dma.length;
405             } else {
406                 len = (e->len - s->cur_offset);
407             }
408 
409             /* If the access is not a read access, it will be a skip access,
410              * tested before.
411              */
412             if (read) {
413                 if (dma_memory_write(s->dma_as, dma.address,
414                                     &e->data[s->cur_offset], len)) {
415                     dma.control |= FW_CFG_DMA_CTL_ERROR;
416                 }
417             }
418             if (write) {
419                 if (!e->allow_write ||
420                     len != dma.length ||
421                     dma_memory_read(s->dma_as, dma.address,
422                                     &e->data[s->cur_offset], len)) {
423                     dma.control |= FW_CFG_DMA_CTL_ERROR;
424                 } else if (e->write_cb) {
425                     e->write_cb(e->callback_opaque, s->cur_offset, len);
426                 }
427             }
428 
429             s->cur_offset += len;
430         }
431 
432         dma.address += len;
433         dma.length  -= len;
434 
435     }
436 
437     stl_be_dma(s->dma_as, dma_addr + offsetof(FWCfgDmaAccess, control),
438                 dma.control);
439 
440     trace_fw_cfg_read(s, 0);
441 }
442 
443 static uint64_t fw_cfg_dma_mem_read(void *opaque, hwaddr addr,
444                                     unsigned size)
445 {
446     /* Return a signature value (and handle various read sizes) */
447     return extract64(FW_CFG_DMA_SIGNATURE, (8 - addr - size) * 8, size * 8);
448 }
449 
450 static void fw_cfg_dma_mem_write(void *opaque, hwaddr addr,
451                                  uint64_t value, unsigned size)
452 {
453     FWCfgState *s = opaque;
454 
455     if (size == 4) {
456         if (addr == 0) {
457             /* FWCfgDmaAccess high address */
458             s->dma_addr = value << 32;
459         } else if (addr == 4) {
460             /* FWCfgDmaAccess low address */
461             s->dma_addr |= value;
462             fw_cfg_dma_transfer(s);
463         }
464     } else if (size == 8 && addr == 0) {
465         s->dma_addr = value;
466         fw_cfg_dma_transfer(s);
467     }
468 }
469 
470 static bool fw_cfg_dma_mem_valid(void *opaque, hwaddr addr,
471                                  unsigned size, bool is_write,
472                                  MemTxAttrs attrs)
473 {
474     return !is_write || ((size == 4 && (addr == 0 || addr == 4)) ||
475                          (size == 8 && addr == 0));
476 }
477 
478 static bool fw_cfg_data_mem_valid(void *opaque, hwaddr addr,
479                                   unsigned size, bool is_write,
480                                   MemTxAttrs attrs)
481 {
482     return addr == 0;
483 }
484 
485 static uint64_t fw_cfg_ctl_mem_read(void *opaque, hwaddr addr, unsigned size)
486 {
487     return 0;
488 }
489 
490 static void fw_cfg_ctl_mem_write(void *opaque, hwaddr addr,
491                                  uint64_t value, unsigned size)
492 {
493     fw_cfg_select(opaque, (uint16_t)value);
494 }
495 
496 static bool fw_cfg_ctl_mem_valid(void *opaque, hwaddr addr,
497                                  unsigned size, bool is_write,
498                                  MemTxAttrs attrs)
499 {
500     return is_write && size == 2;
501 }
502 
503 static void fw_cfg_comb_write(void *opaque, hwaddr addr,
504                               uint64_t value, unsigned size)
505 {
506     switch (size) {
507     case 1:
508         fw_cfg_write(opaque, (uint8_t)value);
509         break;
510     case 2:
511         fw_cfg_select(opaque, (uint16_t)value);
512         break;
513     }
514 }
515 
516 static bool fw_cfg_comb_valid(void *opaque, hwaddr addr,
517                               unsigned size, bool is_write,
518                               MemTxAttrs attrs)
519 {
520     return (size == 1) || (is_write && size == 2);
521 }
522 
523 static const MemoryRegionOps fw_cfg_ctl_mem_ops = {
524     .read = fw_cfg_ctl_mem_read,
525     .write = fw_cfg_ctl_mem_write,
526     .endianness = DEVICE_BIG_ENDIAN,
527     .valid.accepts = fw_cfg_ctl_mem_valid,
528 };
529 
530 static const MemoryRegionOps fw_cfg_data_mem_ops = {
531     .read = fw_cfg_data_read,
532     .write = fw_cfg_data_mem_write,
533     .endianness = DEVICE_BIG_ENDIAN,
534     .valid = {
535         .min_access_size = 1,
536         .max_access_size = 1,
537         .accepts = fw_cfg_data_mem_valid,
538     },
539 };
540 
541 static const MemoryRegionOps fw_cfg_comb_mem_ops = {
542     .read = fw_cfg_data_read,
543     .write = fw_cfg_comb_write,
544     .endianness = DEVICE_LITTLE_ENDIAN,
545     .valid.accepts = fw_cfg_comb_valid,
546 };
547 
548 static const MemoryRegionOps fw_cfg_dma_mem_ops = {
549     .read = fw_cfg_dma_mem_read,
550     .write = fw_cfg_dma_mem_write,
551     .endianness = DEVICE_BIG_ENDIAN,
552     .valid.accepts = fw_cfg_dma_mem_valid,
553     .valid.max_access_size = 8,
554     .impl.max_access_size = 8,
555 };
556 
557 static void fw_cfg_reset(DeviceState *d)
558 {
559     FWCfgState *s = FW_CFG(d);
560 
561     /* we never register a read callback for FW_CFG_SIGNATURE */
562     fw_cfg_select(s, FW_CFG_SIGNATURE);
563 }
564 
565 /* Save restore 32 bit int as uint16_t
566    This is a Big hack, but it is how the old state did it.
567    Or we broke compatibility in the state, or we can't use struct tm
568  */
569 
570 static int get_uint32_as_uint16(QEMUFile *f, void *pv, size_t size,
571                                 const VMStateField *field)
572 {
573     uint32_t *v = pv;
574     *v = qemu_get_be16(f);
575     return 0;
576 }
577 
578 static int put_unused(QEMUFile *f, void *pv, size_t size,
579                       const VMStateField *field, QJSON *vmdesc)
580 {
581     fprintf(stderr, "uint32_as_uint16 is only used for backward compatibility.\n");
582     fprintf(stderr, "This functions shouldn't be called.\n");
583 
584     return 0;
585 }
586 
587 static const VMStateInfo vmstate_hack_uint32_as_uint16 = {
588     .name = "int32_as_uint16",
589     .get  = get_uint32_as_uint16,
590     .put  = put_unused,
591 };
592 
593 #define VMSTATE_UINT16_HACK(_f, _s, _t)                                    \
594     VMSTATE_SINGLE_TEST(_f, _s, _t, 0, vmstate_hack_uint32_as_uint16, uint32_t)
595 
596 
597 static bool is_version_1(void *opaque, int version_id)
598 {
599     return version_id == 1;
600 }
601 
602 bool fw_cfg_dma_enabled(void *opaque)
603 {
604     FWCfgState *s = opaque;
605 
606     return s->dma_enabled;
607 }
608 
609 static const VMStateDescription vmstate_fw_cfg_dma = {
610     .name = "fw_cfg/dma",
611     .needed = fw_cfg_dma_enabled,
612     .fields = (VMStateField[]) {
613         VMSTATE_UINT64(dma_addr, FWCfgState),
614         VMSTATE_END_OF_LIST()
615     },
616 };
617 
618 static const VMStateDescription vmstate_fw_cfg = {
619     .name = "fw_cfg",
620     .version_id = 2,
621     .minimum_version_id = 1,
622     .fields = (VMStateField[]) {
623         VMSTATE_UINT16(cur_entry, FWCfgState),
624         VMSTATE_UINT16_HACK(cur_offset, FWCfgState, is_version_1),
625         VMSTATE_UINT32_V(cur_offset, FWCfgState, 2),
626         VMSTATE_END_OF_LIST()
627     },
628     .subsections = (const VMStateDescription*[]) {
629         &vmstate_fw_cfg_dma,
630         NULL,
631     }
632 };
633 
634 static void fw_cfg_add_bytes_callback(FWCfgState *s, uint16_t key,
635                                       FWCfgCallback select_cb,
636                                       FWCfgWriteCallback write_cb,
637                                       void *callback_opaque,
638                                       void *data, size_t len,
639                                       bool read_only)
640 {
641     int arch = !!(key & FW_CFG_ARCH_LOCAL);
642 
643     key &= FW_CFG_ENTRY_MASK;
644 
645     assert(key < fw_cfg_max_entry(s) && len < UINT32_MAX);
646     assert(s->entries[arch][key].data == NULL); /* avoid key conflict */
647 
648     s->entries[arch][key].data = data;
649     s->entries[arch][key].len = (uint32_t)len;
650     s->entries[arch][key].select_cb = select_cb;
651     s->entries[arch][key].write_cb = write_cb;
652     s->entries[arch][key].callback_opaque = callback_opaque;
653     s->entries[arch][key].allow_write = !read_only;
654 }
655 
656 static void *fw_cfg_modify_bytes_read(FWCfgState *s, uint16_t key,
657                                               void *data, size_t len)
658 {
659     void *ptr;
660     int arch = !!(key & FW_CFG_ARCH_LOCAL);
661 
662     key &= FW_CFG_ENTRY_MASK;
663 
664     assert(key < fw_cfg_max_entry(s) && len < UINT32_MAX);
665 
666     /* return the old data to the function caller, avoid memory leak */
667     ptr = s->entries[arch][key].data;
668     s->entries[arch][key].data = data;
669     s->entries[arch][key].len = len;
670     s->entries[arch][key].callback_opaque = NULL;
671     s->entries[arch][key].allow_write = false;
672 
673     return ptr;
674 }
675 
676 void fw_cfg_add_bytes(FWCfgState *s, uint16_t key, void *data, size_t len)
677 {
678     trace_fw_cfg_add_bytes(key, trace_key_name(key), len);
679     fw_cfg_add_bytes_callback(s, key, NULL, NULL, NULL, data, len, true);
680 }
681 
682 void fw_cfg_add_string(FWCfgState *s, uint16_t key, const char *value)
683 {
684     size_t sz = strlen(value) + 1;
685 
686     trace_fw_cfg_add_string(key, trace_key_name(key), value);
687     fw_cfg_add_bytes(s, key, g_memdup(value, sz), sz);
688 }
689 
690 void fw_cfg_add_i16(FWCfgState *s, uint16_t key, uint16_t value)
691 {
692     uint16_t *copy;
693 
694     copy = g_malloc(sizeof(value));
695     *copy = cpu_to_le16(value);
696     trace_fw_cfg_add_i16(key, trace_key_name(key), value);
697     fw_cfg_add_bytes(s, key, copy, sizeof(value));
698 }
699 
700 void fw_cfg_modify_i16(FWCfgState *s, uint16_t key, uint16_t value)
701 {
702     uint16_t *copy, *old;
703 
704     copy = g_malloc(sizeof(value));
705     *copy = cpu_to_le16(value);
706     old = fw_cfg_modify_bytes_read(s, key, copy, sizeof(value));
707     g_free(old);
708 }
709 
710 void fw_cfg_add_i32(FWCfgState *s, uint16_t key, uint32_t value)
711 {
712     uint32_t *copy;
713 
714     copy = g_malloc(sizeof(value));
715     *copy = cpu_to_le32(value);
716     trace_fw_cfg_add_i32(key, trace_key_name(key), value);
717     fw_cfg_add_bytes(s, key, copy, sizeof(value));
718 }
719 
720 void fw_cfg_add_i64(FWCfgState *s, uint16_t key, uint64_t value)
721 {
722     uint64_t *copy;
723 
724     copy = g_malloc(sizeof(value));
725     *copy = cpu_to_le64(value);
726     trace_fw_cfg_add_i64(key, trace_key_name(key), value);
727     fw_cfg_add_bytes(s, key, copy, sizeof(value));
728 }
729 
730 void fw_cfg_set_order_override(FWCfgState *s, int order)
731 {
732     assert(s->fw_cfg_order_override == 0);
733     s->fw_cfg_order_override = order;
734 }
735 
736 void fw_cfg_reset_order_override(FWCfgState *s)
737 {
738     assert(s->fw_cfg_order_override != 0);
739     s->fw_cfg_order_override = 0;
740 }
741 
742 /*
743  * This is the legacy order list.  For legacy systems, files are in
744  * the fw_cfg in the order defined below, by the "order" value.  Note
745  * that some entries (VGA ROMs, NIC option ROMS, etc.) go into a
746  * specific area, but there may be more than one and they occur in the
747  * order that the user specifies them on the command line.  Those are
748  * handled in a special manner, using the order override above.
749  *
750  * For non-legacy, the files are sorted by filename to avoid this kind
751  * of complexity in the future.
752  *
753  * This is only for x86, other arches don't implement versioning so
754  * they won't set legacy mode.
755  */
756 static struct {
757     const char *name;
758     int order;
759 } fw_cfg_order[] = {
760     { "etc/boot-menu-wait", 10 },
761     { "bootsplash.jpg", 11 },
762     { "bootsplash.bmp", 12 },
763     { "etc/boot-fail-wait", 15 },
764     { "etc/smbios/smbios-tables", 20 },
765     { "etc/smbios/smbios-anchor", 30 },
766     { "etc/e820", 40 },
767     { "etc/reserved-memory-end", 50 },
768     { "genroms/kvmvapic.bin", 55 },
769     { "genroms/linuxboot.bin", 60 },
770     { }, /* VGA ROMs from pc_vga_init come here, 70. */
771     { }, /* NIC option ROMs from pc_nic_init come here, 80. */
772     { "etc/system-states", 90 },
773     { }, /* User ROMs come here, 100. */
774     { }, /* Device FW comes here, 110. */
775     { "etc/extra-pci-roots", 120 },
776     { "etc/acpi/tables", 130 },
777     { "etc/table-loader", 140 },
778     { "etc/tpm/log", 150 },
779     { "etc/acpi/rsdp", 160 },
780     { "bootorder", 170 },
781 
782 #define FW_CFG_ORDER_OVERRIDE_LAST 200
783 };
784 
785 static int get_fw_cfg_order(FWCfgState *s, const char *name)
786 {
787     int i;
788 
789     if (s->fw_cfg_order_override > 0) {
790         return s->fw_cfg_order_override;
791     }
792 
793     for (i = 0; i < ARRAY_SIZE(fw_cfg_order); i++) {
794         if (fw_cfg_order[i].name == NULL) {
795             continue;
796         }
797 
798         if (strcmp(name, fw_cfg_order[i].name) == 0) {
799             return fw_cfg_order[i].order;
800         }
801     }
802 
803     /* Stick unknown stuff at the end. */
804     warn_report("Unknown firmware file in legacy mode: %s", name);
805     return FW_CFG_ORDER_OVERRIDE_LAST;
806 }
807 
808 void fw_cfg_add_file_callback(FWCfgState *s,  const char *filename,
809                               FWCfgCallback select_cb,
810                               FWCfgWriteCallback write_cb,
811                               void *callback_opaque,
812                               void *data, size_t len, bool read_only)
813 {
814     int i, index, count;
815     size_t dsize;
816     MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
817     int order = 0;
818 
819     if (!s->files) {
820         dsize = sizeof(uint32_t) + sizeof(FWCfgFile) * fw_cfg_file_slots(s);
821         s->files = g_malloc0(dsize);
822         fw_cfg_add_bytes(s, FW_CFG_FILE_DIR, s->files, dsize);
823     }
824 
825     count = be32_to_cpu(s->files->count);
826     assert(count < fw_cfg_file_slots(s));
827 
828     /* Find the insertion point. */
829     if (mc->legacy_fw_cfg_order) {
830         /*
831          * Sort by order. For files with the same order, we keep them
832          * in the sequence in which they were added.
833          */
834         order = get_fw_cfg_order(s, filename);
835         for (index = count;
836              index > 0 && order < s->entry_order[index - 1];
837              index--);
838     } else {
839         /* Sort by file name. */
840         for (index = count;
841              index > 0 && strcmp(filename, s->files->f[index - 1].name) < 0;
842              index--);
843     }
844 
845     /*
846      * Move all the entries from the index point and after down one
847      * to create a slot for the new entry.  Because calculations are
848      * being done with the index, make it so that "i" is the current
849      * index and "i - 1" is the one being copied from, thus the
850      * unusual start and end in the for statement.
851      */
852     for (i = count; i > index; i--) {
853         s->files->f[i] = s->files->f[i - 1];
854         s->files->f[i].select = cpu_to_be16(FW_CFG_FILE_FIRST + i);
855         s->entries[0][FW_CFG_FILE_FIRST + i] =
856             s->entries[0][FW_CFG_FILE_FIRST + i - 1];
857         s->entry_order[i] = s->entry_order[i - 1];
858     }
859 
860     memset(&s->files->f[index], 0, sizeof(FWCfgFile));
861     memset(&s->entries[0][FW_CFG_FILE_FIRST + index], 0, sizeof(FWCfgEntry));
862 
863     pstrcpy(s->files->f[index].name, sizeof(s->files->f[index].name), filename);
864     for (i = 0; i <= count; i++) {
865         if (i != index &&
866             strcmp(s->files->f[index].name, s->files->f[i].name) == 0) {
867             error_report("duplicate fw_cfg file name: %s",
868                          s->files->f[index].name);
869             exit(1);
870         }
871     }
872 
873     fw_cfg_add_bytes_callback(s, FW_CFG_FILE_FIRST + index,
874                               select_cb, write_cb,
875                               callback_opaque, data, len,
876                               read_only);
877 
878     s->files->f[index].size   = cpu_to_be32(len);
879     s->files->f[index].select = cpu_to_be16(FW_CFG_FILE_FIRST + index);
880     s->entry_order[index] = order;
881     trace_fw_cfg_add_file(s, index, s->files->f[index].name, len);
882 
883     s->files->count = cpu_to_be32(count+1);
884 }
885 
886 void fw_cfg_add_file(FWCfgState *s,  const char *filename,
887                      void *data, size_t len)
888 {
889     fw_cfg_add_file_callback(s, filename, NULL, NULL, NULL, data, len, true);
890 }
891 
892 void *fw_cfg_modify_file(FWCfgState *s, const char *filename,
893                         void *data, size_t len)
894 {
895     int i, index;
896     void *ptr = NULL;
897 
898     assert(s->files);
899 
900     index = be32_to_cpu(s->files->count);
901 
902     for (i = 0; i < index; i++) {
903         if (strcmp(filename, s->files->f[i].name) == 0) {
904             ptr = fw_cfg_modify_bytes_read(s, FW_CFG_FILE_FIRST + i,
905                                            data, len);
906             s->files->f[i].size   = cpu_to_be32(len);
907             return ptr;
908         }
909     }
910 
911     assert(index < fw_cfg_file_slots(s));
912 
913     /* add new one */
914     fw_cfg_add_file_callback(s, filename, NULL, NULL, NULL, data, len, true);
915     return NULL;
916 }
917 
918 static void fw_cfg_machine_reset(void *opaque)
919 {
920     void *ptr;
921     size_t len;
922     FWCfgState *s = opaque;
923     char *bootindex = get_boot_devices_list(&len);
924 
925     ptr = fw_cfg_modify_file(s, "bootorder", (uint8_t *)bootindex, len);
926     g_free(ptr);
927 }
928 
929 static void fw_cfg_machine_ready(struct Notifier *n, void *data)
930 {
931     FWCfgState *s = container_of(n, FWCfgState, machine_ready);
932     qemu_register_reset(fw_cfg_machine_reset, s);
933 }
934 
935 
936 
937 static void fw_cfg_common_realize(DeviceState *dev, Error **errp)
938 {
939     FWCfgState *s = FW_CFG(dev);
940     MachineState *machine = MACHINE(qdev_get_machine());
941     uint32_t version = FW_CFG_VERSION;
942 
943     if (!fw_cfg_find()) {
944         error_setg(errp, "at most one %s device is permitted", TYPE_FW_CFG);
945         return;
946     }
947 
948     fw_cfg_add_bytes(s, FW_CFG_SIGNATURE, (char *)"QEMU", 4);
949     fw_cfg_add_bytes(s, FW_CFG_UUID, &qemu_uuid, 16);
950     fw_cfg_add_i16(s, FW_CFG_NOGRAPHIC, (uint16_t)!machine->enable_graphics);
951     fw_cfg_add_i16(s, FW_CFG_BOOT_MENU, (uint16_t)boot_menu);
952     fw_cfg_bootsplash(s);
953     fw_cfg_reboot(s);
954 
955     if (s->dma_enabled) {
956         version |= FW_CFG_VERSION_DMA;
957     }
958 
959     fw_cfg_add_i32(s, FW_CFG_ID, version);
960 
961     s->machine_ready.notify = fw_cfg_machine_ready;
962     qemu_add_machine_init_done_notifier(&s->machine_ready);
963 }
964 
965 FWCfgState *fw_cfg_init_io_dma(uint32_t iobase, uint32_t dma_iobase,
966                                 AddressSpace *dma_as)
967 {
968     DeviceState *dev;
969     SysBusDevice *sbd;
970     FWCfgIoState *ios;
971     FWCfgState *s;
972     bool dma_requested = dma_iobase && dma_as;
973 
974     dev = qdev_create(NULL, TYPE_FW_CFG_IO);
975     if (!dma_requested) {
976         qdev_prop_set_bit(dev, "dma_enabled", false);
977     }
978 
979     object_property_add_child(OBJECT(qdev_get_machine()), TYPE_FW_CFG,
980                               OBJECT(dev), NULL);
981     qdev_init_nofail(dev);
982 
983     sbd = SYS_BUS_DEVICE(dev);
984     ios = FW_CFG_IO(dev);
985     sysbus_add_io(sbd, iobase, &ios->comb_iomem);
986 
987     s = FW_CFG(dev);
988 
989     if (s->dma_enabled) {
990         /* 64 bits for the address field */
991         s->dma_as = dma_as;
992         s->dma_addr = 0;
993         sysbus_add_io(sbd, dma_iobase, &s->dma_iomem);
994     }
995 
996     return s;
997 }
998 
999 FWCfgState *fw_cfg_init_io(uint32_t iobase)
1000 {
1001     return fw_cfg_init_io_dma(iobase, 0, NULL);
1002 }
1003 
1004 FWCfgState *fw_cfg_init_mem_wide(hwaddr ctl_addr,
1005                                  hwaddr data_addr, uint32_t data_width,
1006                                  hwaddr dma_addr, AddressSpace *dma_as)
1007 {
1008     DeviceState *dev;
1009     SysBusDevice *sbd;
1010     FWCfgState *s;
1011     bool dma_requested = dma_addr && dma_as;
1012 
1013     dev = qdev_create(NULL, TYPE_FW_CFG_MEM);
1014     qdev_prop_set_uint32(dev, "data_width", data_width);
1015     if (!dma_requested) {
1016         qdev_prop_set_bit(dev, "dma_enabled", false);
1017     }
1018 
1019     object_property_add_child(OBJECT(qdev_get_machine()), TYPE_FW_CFG,
1020                               OBJECT(dev), NULL);
1021     qdev_init_nofail(dev);
1022 
1023     sbd = SYS_BUS_DEVICE(dev);
1024     sysbus_mmio_map(sbd, 0, ctl_addr);
1025     sysbus_mmio_map(sbd, 1, data_addr);
1026 
1027     s = FW_CFG(dev);
1028 
1029     if (s->dma_enabled) {
1030         s->dma_as = dma_as;
1031         s->dma_addr = 0;
1032         sysbus_mmio_map(sbd, 2, dma_addr);
1033     }
1034 
1035     return s;
1036 }
1037 
1038 FWCfgState *fw_cfg_init_mem(hwaddr ctl_addr, hwaddr data_addr)
1039 {
1040     return fw_cfg_init_mem_wide(ctl_addr, data_addr,
1041                                 fw_cfg_data_mem_ops.valid.max_access_size,
1042                                 0, NULL);
1043 }
1044 
1045 
1046 FWCfgState *fw_cfg_find(void)
1047 {
1048     /* Returns NULL unless there is exactly one fw_cfg device */
1049     return FW_CFG(object_resolve_path_type("", TYPE_FW_CFG, NULL));
1050 }
1051 
1052 
1053 static void fw_cfg_class_init(ObjectClass *klass, void *data)
1054 {
1055     DeviceClass *dc = DEVICE_CLASS(klass);
1056 
1057     dc->reset = fw_cfg_reset;
1058     dc->vmsd = &vmstate_fw_cfg;
1059 }
1060 
1061 static const TypeInfo fw_cfg_info = {
1062     .name          = TYPE_FW_CFG,
1063     .parent        = TYPE_SYS_BUS_DEVICE,
1064     .abstract      = true,
1065     .instance_size = sizeof(FWCfgState),
1066     .class_init    = fw_cfg_class_init,
1067 };
1068 
1069 static void fw_cfg_file_slots_allocate(FWCfgState *s, Error **errp)
1070 {
1071     uint16_t file_slots_max;
1072 
1073     if (fw_cfg_file_slots(s) < FW_CFG_FILE_SLOTS_MIN) {
1074         error_setg(errp, "\"file_slots\" must be at least 0x%x",
1075                    FW_CFG_FILE_SLOTS_MIN);
1076         return;
1077     }
1078 
1079     /* (UINT16_MAX & FW_CFG_ENTRY_MASK) is the highest inclusive selector value
1080      * that we permit. The actual (exclusive) value coming from the
1081      * configuration is (FW_CFG_FILE_FIRST + fw_cfg_file_slots(s)). */
1082     file_slots_max = (UINT16_MAX & FW_CFG_ENTRY_MASK) - FW_CFG_FILE_FIRST + 1;
1083     if (fw_cfg_file_slots(s) > file_slots_max) {
1084         error_setg(errp, "\"file_slots\" must not exceed 0x%" PRIx16,
1085                    file_slots_max);
1086         return;
1087     }
1088 
1089     s->entries[0] = g_new0(FWCfgEntry, fw_cfg_max_entry(s));
1090     s->entries[1] = g_new0(FWCfgEntry, fw_cfg_max_entry(s));
1091     s->entry_order = g_new0(int, fw_cfg_max_entry(s));
1092 }
1093 
1094 static Property fw_cfg_io_properties[] = {
1095     DEFINE_PROP_BOOL("dma_enabled", FWCfgIoState, parent_obj.dma_enabled,
1096                      true),
1097     DEFINE_PROP_UINT16("x-file-slots", FWCfgIoState, parent_obj.file_slots,
1098                        FW_CFG_FILE_SLOTS_DFLT),
1099     DEFINE_PROP_END_OF_LIST(),
1100 };
1101 
1102 static void fw_cfg_io_realize(DeviceState *dev, Error **errp)
1103 {
1104     FWCfgIoState *s = FW_CFG_IO(dev);
1105     Error *local_err = NULL;
1106 
1107     fw_cfg_file_slots_allocate(FW_CFG(s), &local_err);
1108     if (local_err) {
1109         error_propagate(errp, local_err);
1110         return;
1111     }
1112 
1113     /* when using port i/o, the 8-bit data register ALWAYS overlaps
1114      * with half of the 16-bit control register. Hence, the total size
1115      * of the i/o region used is FW_CFG_CTL_SIZE */
1116     memory_region_init_io(&s->comb_iomem, OBJECT(s), &fw_cfg_comb_mem_ops,
1117                           FW_CFG(s), "fwcfg", FW_CFG_CTL_SIZE);
1118 
1119     if (FW_CFG(s)->dma_enabled) {
1120         memory_region_init_io(&FW_CFG(s)->dma_iomem, OBJECT(s),
1121                               &fw_cfg_dma_mem_ops, FW_CFG(s), "fwcfg.dma",
1122                               sizeof(dma_addr_t));
1123     }
1124 
1125     fw_cfg_common_realize(dev, errp);
1126 }
1127 
1128 static void fw_cfg_io_class_init(ObjectClass *klass, void *data)
1129 {
1130     DeviceClass *dc = DEVICE_CLASS(klass);
1131 
1132     dc->realize = fw_cfg_io_realize;
1133     dc->props = fw_cfg_io_properties;
1134 }
1135 
1136 static const TypeInfo fw_cfg_io_info = {
1137     .name          = TYPE_FW_CFG_IO,
1138     .parent        = TYPE_FW_CFG,
1139     .instance_size = sizeof(FWCfgIoState),
1140     .class_init    = fw_cfg_io_class_init,
1141 };
1142 
1143 
1144 static Property fw_cfg_mem_properties[] = {
1145     DEFINE_PROP_UINT32("data_width", FWCfgMemState, data_width, -1),
1146     DEFINE_PROP_BOOL("dma_enabled", FWCfgMemState, parent_obj.dma_enabled,
1147                      true),
1148     DEFINE_PROP_UINT16("x-file-slots", FWCfgMemState, parent_obj.file_slots,
1149                        FW_CFG_FILE_SLOTS_DFLT),
1150     DEFINE_PROP_END_OF_LIST(),
1151 };
1152 
1153 static void fw_cfg_mem_realize(DeviceState *dev, Error **errp)
1154 {
1155     FWCfgMemState *s = FW_CFG_MEM(dev);
1156     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1157     const MemoryRegionOps *data_ops = &fw_cfg_data_mem_ops;
1158     Error *local_err = NULL;
1159 
1160     fw_cfg_file_slots_allocate(FW_CFG(s), &local_err);
1161     if (local_err) {
1162         error_propagate(errp, local_err);
1163         return;
1164     }
1165 
1166     memory_region_init_io(&s->ctl_iomem, OBJECT(s), &fw_cfg_ctl_mem_ops,
1167                           FW_CFG(s), "fwcfg.ctl", FW_CFG_CTL_SIZE);
1168     sysbus_init_mmio(sbd, &s->ctl_iomem);
1169 
1170     if (s->data_width > data_ops->valid.max_access_size) {
1171         s->wide_data_ops = *data_ops;
1172 
1173         s->wide_data_ops.valid.max_access_size = s->data_width;
1174         s->wide_data_ops.impl.max_access_size  = s->data_width;
1175         data_ops = &s->wide_data_ops;
1176     }
1177     memory_region_init_io(&s->data_iomem, OBJECT(s), data_ops, FW_CFG(s),
1178                           "fwcfg.data", data_ops->valid.max_access_size);
1179     sysbus_init_mmio(sbd, &s->data_iomem);
1180 
1181     if (FW_CFG(s)->dma_enabled) {
1182         memory_region_init_io(&FW_CFG(s)->dma_iomem, OBJECT(s),
1183                               &fw_cfg_dma_mem_ops, FW_CFG(s), "fwcfg.dma",
1184                               sizeof(dma_addr_t));
1185         sysbus_init_mmio(sbd, &FW_CFG(s)->dma_iomem);
1186     }
1187 
1188     fw_cfg_common_realize(dev, errp);
1189 }
1190 
1191 static void fw_cfg_mem_class_init(ObjectClass *klass, void *data)
1192 {
1193     DeviceClass *dc = DEVICE_CLASS(klass);
1194 
1195     dc->realize = fw_cfg_mem_realize;
1196     dc->props = fw_cfg_mem_properties;
1197 }
1198 
1199 static const TypeInfo fw_cfg_mem_info = {
1200     .name          = TYPE_FW_CFG_MEM,
1201     .parent        = TYPE_FW_CFG,
1202     .instance_size = sizeof(FWCfgMemState),
1203     .class_init    = fw_cfg_mem_class_init,
1204 };
1205 
1206 
1207 static void fw_cfg_register_types(void)
1208 {
1209     type_register_static(&fw_cfg_info);
1210     type_register_static(&fw_cfg_io_info);
1211     type_register_static(&fw_cfg_mem_info);
1212 }
1213 
1214 type_init(fw_cfg_register_types)
1215