xref: /openbmc/qemu/hw/nvram/fw_cfg.c (revision 64552b6b)
1 /*
2  * QEMU Firmware configuration device emulation
3  *
4  * Copyright (c) 2008 Gleb Natapov
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "qemu-common.h"
27 #include "hw/hw.h"
28 #include "sysemu/sysemu.h"
29 #include "sysemu/dma.h"
30 #include "sysemu/reset.h"
31 #include "hw/boards.h"
32 #include "hw/nvram/fw_cfg.h"
33 #include "hw/sysbus.h"
34 #include "migration/qemu-file-types.h"
35 #include "trace.h"
36 #include "qemu/error-report.h"
37 #include "qemu/option.h"
38 #include "qemu/config-file.h"
39 #include "qemu/cutils.h"
40 #include "qapi/error.h"
41 
42 #define FW_CFG_FILE_SLOTS_DFLT 0x20
43 
44 /* FW_CFG_VERSION bits */
45 #define FW_CFG_VERSION      0x01
46 #define FW_CFG_VERSION_DMA  0x02
47 
48 /* FW_CFG_DMA_CONTROL bits */
49 #define FW_CFG_DMA_CTL_ERROR   0x01
50 #define FW_CFG_DMA_CTL_READ    0x02
51 #define FW_CFG_DMA_CTL_SKIP    0x04
52 #define FW_CFG_DMA_CTL_SELECT  0x08
53 #define FW_CFG_DMA_CTL_WRITE   0x10
54 
55 #define FW_CFG_DMA_SIGNATURE 0x51454d5520434647ULL /* "QEMU CFG" */
56 
57 struct FWCfgEntry {
58     uint32_t len;
59     bool allow_write;
60     uint8_t *data;
61     void *callback_opaque;
62     FWCfgCallback select_cb;
63     FWCfgWriteCallback write_cb;
64 };
65 
66 /**
67  * key_name:
68  *
69  * @key: The uint16 selector key.
70  *
71  * Returns: The stringified name if the selector refers to a well-known
72  *          numerically defined item, or NULL on key lookup failure.
73  */
74 static const char *key_name(uint16_t key)
75 {
76     static const char *fw_cfg_wellknown_keys[FW_CFG_FILE_FIRST] = {
77         [FW_CFG_SIGNATURE] = "signature",
78         [FW_CFG_ID] = "id",
79         [FW_CFG_UUID] = "uuid",
80         [FW_CFG_RAM_SIZE] = "ram_size",
81         [FW_CFG_NOGRAPHIC] = "nographic",
82         [FW_CFG_NB_CPUS] = "nb_cpus",
83         [FW_CFG_MACHINE_ID] = "machine_id",
84         [FW_CFG_KERNEL_ADDR] = "kernel_addr",
85         [FW_CFG_KERNEL_SIZE] = "kernel_size",
86         [FW_CFG_KERNEL_CMDLINE] = "kernel_cmdline",
87         [FW_CFG_INITRD_ADDR] = "initrd_addr",
88         [FW_CFG_INITRD_SIZE] = "initdr_size",
89         [FW_CFG_BOOT_DEVICE] = "boot_device",
90         [FW_CFG_NUMA] = "numa",
91         [FW_CFG_BOOT_MENU] = "boot_menu",
92         [FW_CFG_MAX_CPUS] = "max_cpus",
93         [FW_CFG_KERNEL_ENTRY] = "kernel_entry",
94         [FW_CFG_KERNEL_DATA] = "kernel_data",
95         [FW_CFG_INITRD_DATA] = "initrd_data",
96         [FW_CFG_CMDLINE_ADDR] = "cmdline_addr",
97         [FW_CFG_CMDLINE_SIZE] = "cmdline_size",
98         [FW_CFG_CMDLINE_DATA] = "cmdline_data",
99         [FW_CFG_SETUP_ADDR] = "setup_addr",
100         [FW_CFG_SETUP_SIZE] = "setup_size",
101         [FW_CFG_SETUP_DATA] = "setup_data",
102         [FW_CFG_FILE_DIR] = "file_dir",
103     };
104 
105     if (key & FW_CFG_ARCH_LOCAL) {
106         return fw_cfg_arch_key_name(key);
107     }
108     if (key < FW_CFG_FILE_FIRST) {
109         return fw_cfg_wellknown_keys[key];
110     }
111 
112     return NULL;
113 }
114 
115 static inline const char *trace_key_name(uint16_t key)
116 {
117     const char *name = key_name(key);
118 
119     return name ? name : "unknown";
120 }
121 
122 #define JPG_FILE 0
123 #define BMP_FILE 1
124 
125 static char *read_splashfile(char *filename, gsize *file_sizep,
126                              int *file_typep)
127 {
128     GError *err = NULL;
129     gchar *content;
130     int file_type;
131     unsigned int filehead;
132     int bmp_bpp;
133 
134     if (!g_file_get_contents(filename, &content, file_sizep, &err)) {
135         error_report("failed to read splash file '%s': %s",
136                      filename, err->message);
137         g_error_free(err);
138         return NULL;
139     }
140 
141     /* check file size */
142     if (*file_sizep < 30) {
143         goto error;
144     }
145 
146     /* check magic ID */
147     filehead = lduw_le_p(content);
148     if (filehead == 0xd8ff) {
149         file_type = JPG_FILE;
150     } else if (filehead == 0x4d42) {
151         file_type = BMP_FILE;
152     } else {
153         goto error;
154     }
155 
156     /* check BMP bpp */
157     if (file_type == BMP_FILE) {
158         bmp_bpp = lduw_le_p(&content[28]);
159         if (bmp_bpp != 24) {
160             goto error;
161         }
162     }
163 
164     /* return values */
165     *file_typep = file_type;
166 
167     return content;
168 
169 error:
170     error_report("splash file '%s' format not recognized; must be JPEG "
171                  "or 24 bit BMP", filename);
172     g_free(content);
173     return NULL;
174 }
175 
176 static void fw_cfg_bootsplash(FWCfgState *s)
177 {
178     const char *boot_splash_filename = NULL;
179     const char *boot_splash_time = NULL;
180     char *filename, *file_data;
181     gsize file_size;
182     int file_type;
183 
184     /* get user configuration */
185     QemuOptsList *plist = qemu_find_opts("boot-opts");
186     QemuOpts *opts = QTAILQ_FIRST(&plist->head);
187     boot_splash_filename = qemu_opt_get(opts, "splash");
188     boot_splash_time = qemu_opt_get(opts, "splash-time");
189 
190     /* insert splash time if user configurated */
191     if (boot_splash_time) {
192         int64_t bst_val = qemu_opt_get_number(opts, "splash-time", -1);
193         uint16_t bst_le16;
194 
195         /* validate the input */
196         if (bst_val < 0 || bst_val > 0xffff) {
197             error_report("splash-time is invalid,"
198                          "it should be a value between 0 and 65535");
199             exit(1);
200         }
201         /* use little endian format */
202         bst_le16 = cpu_to_le16(bst_val);
203         fw_cfg_add_file(s, "etc/boot-menu-wait",
204                         g_memdup(&bst_le16, sizeof bst_le16), sizeof bst_le16);
205     }
206 
207     /* insert splash file if user configurated */
208     if (boot_splash_filename) {
209         filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, boot_splash_filename);
210         if (filename == NULL) {
211             error_report("failed to find file '%s'", boot_splash_filename);
212             return;
213         }
214 
215         /* loading file data */
216         file_data = read_splashfile(filename, &file_size, &file_type);
217         if (file_data == NULL) {
218             g_free(filename);
219             return;
220         }
221         g_free(boot_splash_filedata);
222         boot_splash_filedata = (uint8_t *)file_data;
223 
224         /* insert data */
225         if (file_type == JPG_FILE) {
226             fw_cfg_add_file(s, "bootsplash.jpg",
227                             boot_splash_filedata, file_size);
228         } else {
229             fw_cfg_add_file(s, "bootsplash.bmp",
230                             boot_splash_filedata, file_size);
231         }
232         g_free(filename);
233     }
234 }
235 
236 static void fw_cfg_reboot(FWCfgState *s)
237 {
238     const char *reboot_timeout = NULL;
239     int64_t rt_val = -1;
240     uint32_t rt_le32;
241 
242     /* get user configuration */
243     QemuOptsList *plist = qemu_find_opts("boot-opts");
244     QemuOpts *opts = QTAILQ_FIRST(&plist->head);
245     reboot_timeout = qemu_opt_get(opts, "reboot-timeout");
246 
247     if (reboot_timeout) {
248         rt_val = qemu_opt_get_number(opts, "reboot-timeout", -1);
249         /* validate the input */
250         if (rt_val < 0 || rt_val > 0xffff) {
251             error_report("reboot timeout is invalid,"
252                          "it should be a value between 0 and 65535");
253             exit(1);
254         }
255     }
256 
257     rt_le32 = cpu_to_le32(rt_val);
258     fw_cfg_add_file(s, "etc/boot-fail-wait", g_memdup(&rt_le32, 4), 4);
259 }
260 
261 static void fw_cfg_write(FWCfgState *s, uint8_t value)
262 {
263     /* nothing, write support removed in QEMU v2.4+ */
264 }
265 
266 static inline uint16_t fw_cfg_file_slots(const FWCfgState *s)
267 {
268     return s->file_slots;
269 }
270 
271 /* Note: this function returns an exclusive limit. */
272 static inline uint32_t fw_cfg_max_entry(const FWCfgState *s)
273 {
274     return FW_CFG_FILE_FIRST + fw_cfg_file_slots(s);
275 }
276 
277 static int fw_cfg_select(FWCfgState *s, uint16_t key)
278 {
279     int arch, ret;
280     FWCfgEntry *e;
281 
282     s->cur_offset = 0;
283     if ((key & FW_CFG_ENTRY_MASK) >= fw_cfg_max_entry(s)) {
284         s->cur_entry = FW_CFG_INVALID;
285         ret = 0;
286     } else {
287         s->cur_entry = key;
288         ret = 1;
289         /* entry successfully selected, now run callback if present */
290         arch = !!(key & FW_CFG_ARCH_LOCAL);
291         e = &s->entries[arch][key & FW_CFG_ENTRY_MASK];
292         if (e->select_cb) {
293             e->select_cb(e->callback_opaque);
294         }
295     }
296 
297     trace_fw_cfg_select(s, key, trace_key_name(key), ret);
298     return ret;
299 }
300 
301 static uint64_t fw_cfg_data_read(void *opaque, hwaddr addr, unsigned size)
302 {
303     FWCfgState *s = opaque;
304     int arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
305     FWCfgEntry *e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
306                     &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
307     uint64_t value = 0;
308 
309     assert(size > 0 && size <= sizeof(value));
310     if (s->cur_entry != FW_CFG_INVALID && e->data && s->cur_offset < e->len) {
311         /* The least significant 'size' bytes of the return value are
312          * expected to contain a string preserving portion of the item
313          * data, padded with zeros on the right in case we run out early.
314          * In technical terms, we're composing the host-endian representation
315          * of the big endian interpretation of the fw_cfg string.
316          */
317         do {
318             value = (value << 8) | e->data[s->cur_offset++];
319         } while (--size && s->cur_offset < e->len);
320         /* If size is still not zero, we *did* run out early, so continue
321          * left-shifting, to add the appropriate number of padding zeros
322          * on the right.
323          */
324         value <<= 8 * size;
325     }
326 
327     trace_fw_cfg_read(s, value);
328     return value;
329 }
330 
331 static void fw_cfg_data_mem_write(void *opaque, hwaddr addr,
332                                   uint64_t value, unsigned size)
333 {
334     FWCfgState *s = opaque;
335     unsigned i = size;
336 
337     do {
338         fw_cfg_write(s, value >> (8 * --i));
339     } while (i);
340 }
341 
342 static void fw_cfg_dma_transfer(FWCfgState *s)
343 {
344     dma_addr_t len;
345     FWCfgDmaAccess dma;
346     int arch;
347     FWCfgEntry *e;
348     int read = 0, write = 0;
349     dma_addr_t dma_addr;
350 
351     /* Reset the address before the next access */
352     dma_addr = s->dma_addr;
353     s->dma_addr = 0;
354 
355     if (dma_memory_read(s->dma_as, dma_addr, &dma, sizeof(dma))) {
356         stl_be_dma(s->dma_as, dma_addr + offsetof(FWCfgDmaAccess, control),
357                    FW_CFG_DMA_CTL_ERROR);
358         return;
359     }
360 
361     dma.address = be64_to_cpu(dma.address);
362     dma.length = be32_to_cpu(dma.length);
363     dma.control = be32_to_cpu(dma.control);
364 
365     if (dma.control & FW_CFG_DMA_CTL_SELECT) {
366         fw_cfg_select(s, dma.control >> 16);
367     }
368 
369     arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
370     e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
371         &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
372 
373     if (dma.control & FW_CFG_DMA_CTL_READ) {
374         read = 1;
375         write = 0;
376     } else if (dma.control & FW_CFG_DMA_CTL_WRITE) {
377         read = 0;
378         write = 1;
379     } else if (dma.control & FW_CFG_DMA_CTL_SKIP) {
380         read = 0;
381         write = 0;
382     } else {
383         dma.length = 0;
384     }
385 
386     dma.control = 0;
387 
388     while (dma.length > 0 && !(dma.control & FW_CFG_DMA_CTL_ERROR)) {
389         if (s->cur_entry == FW_CFG_INVALID || !e->data ||
390                                 s->cur_offset >= e->len) {
391             len = dma.length;
392 
393             /* If the access is not a read access, it will be a skip access,
394              * tested before.
395              */
396             if (read) {
397                 if (dma_memory_set(s->dma_as, dma.address, 0, len)) {
398                     dma.control |= FW_CFG_DMA_CTL_ERROR;
399                 }
400             }
401             if (write) {
402                 dma.control |= FW_CFG_DMA_CTL_ERROR;
403             }
404         } else {
405             if (dma.length <= (e->len - s->cur_offset)) {
406                 len = dma.length;
407             } else {
408                 len = (e->len - s->cur_offset);
409             }
410 
411             /* If the access is not a read access, it will be a skip access,
412              * tested before.
413              */
414             if (read) {
415                 if (dma_memory_write(s->dma_as, dma.address,
416                                     &e->data[s->cur_offset], len)) {
417                     dma.control |= FW_CFG_DMA_CTL_ERROR;
418                 }
419             }
420             if (write) {
421                 if (!e->allow_write ||
422                     len != dma.length ||
423                     dma_memory_read(s->dma_as, dma.address,
424                                     &e->data[s->cur_offset], len)) {
425                     dma.control |= FW_CFG_DMA_CTL_ERROR;
426                 } else if (e->write_cb) {
427                     e->write_cb(e->callback_opaque, s->cur_offset, len);
428                 }
429             }
430 
431             s->cur_offset += len;
432         }
433 
434         dma.address += len;
435         dma.length  -= len;
436 
437     }
438 
439     stl_be_dma(s->dma_as, dma_addr + offsetof(FWCfgDmaAccess, control),
440                 dma.control);
441 
442     trace_fw_cfg_read(s, 0);
443 }
444 
445 static uint64_t fw_cfg_dma_mem_read(void *opaque, hwaddr addr,
446                                     unsigned size)
447 {
448     /* Return a signature value (and handle various read sizes) */
449     return extract64(FW_CFG_DMA_SIGNATURE, (8 - addr - size) * 8, size * 8);
450 }
451 
452 static void fw_cfg_dma_mem_write(void *opaque, hwaddr addr,
453                                  uint64_t value, unsigned size)
454 {
455     FWCfgState *s = opaque;
456 
457     if (size == 4) {
458         if (addr == 0) {
459             /* FWCfgDmaAccess high address */
460             s->dma_addr = value << 32;
461         } else if (addr == 4) {
462             /* FWCfgDmaAccess low address */
463             s->dma_addr |= value;
464             fw_cfg_dma_transfer(s);
465         }
466     } else if (size == 8 && addr == 0) {
467         s->dma_addr = value;
468         fw_cfg_dma_transfer(s);
469     }
470 }
471 
472 static bool fw_cfg_dma_mem_valid(void *opaque, hwaddr addr,
473                                  unsigned size, bool is_write,
474                                  MemTxAttrs attrs)
475 {
476     return !is_write || ((size == 4 && (addr == 0 || addr == 4)) ||
477                          (size == 8 && addr == 0));
478 }
479 
480 static bool fw_cfg_data_mem_valid(void *opaque, hwaddr addr,
481                                   unsigned size, bool is_write,
482                                   MemTxAttrs attrs)
483 {
484     return addr == 0;
485 }
486 
487 static uint64_t fw_cfg_ctl_mem_read(void *opaque, hwaddr addr, unsigned size)
488 {
489     return 0;
490 }
491 
492 static void fw_cfg_ctl_mem_write(void *opaque, hwaddr addr,
493                                  uint64_t value, unsigned size)
494 {
495     fw_cfg_select(opaque, (uint16_t)value);
496 }
497 
498 static bool fw_cfg_ctl_mem_valid(void *opaque, hwaddr addr,
499                                  unsigned size, bool is_write,
500                                  MemTxAttrs attrs)
501 {
502     return is_write && size == 2;
503 }
504 
505 static void fw_cfg_comb_write(void *opaque, hwaddr addr,
506                               uint64_t value, unsigned size)
507 {
508     switch (size) {
509     case 1:
510         fw_cfg_write(opaque, (uint8_t)value);
511         break;
512     case 2:
513         fw_cfg_select(opaque, (uint16_t)value);
514         break;
515     }
516 }
517 
518 static bool fw_cfg_comb_valid(void *opaque, hwaddr addr,
519                               unsigned size, bool is_write,
520                               MemTxAttrs attrs)
521 {
522     return (size == 1) || (is_write && size == 2);
523 }
524 
525 static const MemoryRegionOps fw_cfg_ctl_mem_ops = {
526     .read = fw_cfg_ctl_mem_read,
527     .write = fw_cfg_ctl_mem_write,
528     .endianness = DEVICE_BIG_ENDIAN,
529     .valid.accepts = fw_cfg_ctl_mem_valid,
530 };
531 
532 static const MemoryRegionOps fw_cfg_data_mem_ops = {
533     .read = fw_cfg_data_read,
534     .write = fw_cfg_data_mem_write,
535     .endianness = DEVICE_BIG_ENDIAN,
536     .valid = {
537         .min_access_size = 1,
538         .max_access_size = 1,
539         .accepts = fw_cfg_data_mem_valid,
540     },
541 };
542 
543 static const MemoryRegionOps fw_cfg_comb_mem_ops = {
544     .read = fw_cfg_data_read,
545     .write = fw_cfg_comb_write,
546     .endianness = DEVICE_LITTLE_ENDIAN,
547     .valid.accepts = fw_cfg_comb_valid,
548 };
549 
550 static const MemoryRegionOps fw_cfg_dma_mem_ops = {
551     .read = fw_cfg_dma_mem_read,
552     .write = fw_cfg_dma_mem_write,
553     .endianness = DEVICE_BIG_ENDIAN,
554     .valid.accepts = fw_cfg_dma_mem_valid,
555     .valid.max_access_size = 8,
556     .impl.max_access_size = 8,
557 };
558 
559 static void fw_cfg_reset(DeviceState *d)
560 {
561     FWCfgState *s = FW_CFG(d);
562 
563     /* we never register a read callback for FW_CFG_SIGNATURE */
564     fw_cfg_select(s, FW_CFG_SIGNATURE);
565 }
566 
567 /* Save restore 32 bit int as uint16_t
568    This is a Big hack, but it is how the old state did it.
569    Or we broke compatibility in the state, or we can't use struct tm
570  */
571 
572 static int get_uint32_as_uint16(QEMUFile *f, void *pv, size_t size,
573                                 const VMStateField *field)
574 {
575     uint32_t *v = pv;
576     *v = qemu_get_be16(f);
577     return 0;
578 }
579 
580 static int put_unused(QEMUFile *f, void *pv, size_t size,
581                       const VMStateField *field, QJSON *vmdesc)
582 {
583     fprintf(stderr, "uint32_as_uint16 is only used for backward compatibility.\n");
584     fprintf(stderr, "This functions shouldn't be called.\n");
585 
586     return 0;
587 }
588 
589 static const VMStateInfo vmstate_hack_uint32_as_uint16 = {
590     .name = "int32_as_uint16",
591     .get  = get_uint32_as_uint16,
592     .put  = put_unused,
593 };
594 
595 #define VMSTATE_UINT16_HACK(_f, _s, _t)                                    \
596     VMSTATE_SINGLE_TEST(_f, _s, _t, 0, vmstate_hack_uint32_as_uint16, uint32_t)
597 
598 
599 static bool is_version_1(void *opaque, int version_id)
600 {
601     return version_id == 1;
602 }
603 
604 bool fw_cfg_dma_enabled(void *opaque)
605 {
606     FWCfgState *s = opaque;
607 
608     return s->dma_enabled;
609 }
610 
611 static const VMStateDescription vmstate_fw_cfg_dma = {
612     .name = "fw_cfg/dma",
613     .needed = fw_cfg_dma_enabled,
614     .fields = (VMStateField[]) {
615         VMSTATE_UINT64(dma_addr, FWCfgState),
616         VMSTATE_END_OF_LIST()
617     },
618 };
619 
620 static const VMStateDescription vmstate_fw_cfg = {
621     .name = "fw_cfg",
622     .version_id = 2,
623     .minimum_version_id = 1,
624     .fields = (VMStateField[]) {
625         VMSTATE_UINT16(cur_entry, FWCfgState),
626         VMSTATE_UINT16_HACK(cur_offset, FWCfgState, is_version_1),
627         VMSTATE_UINT32_V(cur_offset, FWCfgState, 2),
628         VMSTATE_END_OF_LIST()
629     },
630     .subsections = (const VMStateDescription*[]) {
631         &vmstate_fw_cfg_dma,
632         NULL,
633     }
634 };
635 
636 static void fw_cfg_add_bytes_callback(FWCfgState *s, uint16_t key,
637                                       FWCfgCallback select_cb,
638                                       FWCfgWriteCallback write_cb,
639                                       void *callback_opaque,
640                                       void *data, size_t len,
641                                       bool read_only)
642 {
643     int arch = !!(key & FW_CFG_ARCH_LOCAL);
644 
645     key &= FW_CFG_ENTRY_MASK;
646 
647     assert(key < fw_cfg_max_entry(s) && len < UINT32_MAX);
648     assert(s->entries[arch][key].data == NULL); /* avoid key conflict */
649 
650     s->entries[arch][key].data = data;
651     s->entries[arch][key].len = (uint32_t)len;
652     s->entries[arch][key].select_cb = select_cb;
653     s->entries[arch][key].write_cb = write_cb;
654     s->entries[arch][key].callback_opaque = callback_opaque;
655     s->entries[arch][key].allow_write = !read_only;
656 }
657 
658 static void *fw_cfg_modify_bytes_read(FWCfgState *s, uint16_t key,
659                                               void *data, size_t len)
660 {
661     void *ptr;
662     int arch = !!(key & FW_CFG_ARCH_LOCAL);
663 
664     key &= FW_CFG_ENTRY_MASK;
665 
666     assert(key < fw_cfg_max_entry(s) && len < UINT32_MAX);
667 
668     /* return the old data to the function caller, avoid memory leak */
669     ptr = s->entries[arch][key].data;
670     s->entries[arch][key].data = data;
671     s->entries[arch][key].len = len;
672     s->entries[arch][key].callback_opaque = NULL;
673     s->entries[arch][key].allow_write = false;
674 
675     return ptr;
676 }
677 
678 void fw_cfg_add_bytes(FWCfgState *s, uint16_t key, void *data, size_t len)
679 {
680     trace_fw_cfg_add_bytes(key, trace_key_name(key), len);
681     fw_cfg_add_bytes_callback(s, key, NULL, NULL, NULL, data, len, true);
682 }
683 
684 void fw_cfg_add_string(FWCfgState *s, uint16_t key, const char *value)
685 {
686     size_t sz = strlen(value) + 1;
687 
688     trace_fw_cfg_add_string(key, trace_key_name(key), value);
689     fw_cfg_add_bytes(s, key, g_memdup(value, sz), sz);
690 }
691 
692 void fw_cfg_add_i16(FWCfgState *s, uint16_t key, uint16_t value)
693 {
694     uint16_t *copy;
695 
696     copy = g_malloc(sizeof(value));
697     *copy = cpu_to_le16(value);
698     trace_fw_cfg_add_i16(key, trace_key_name(key), value);
699     fw_cfg_add_bytes(s, key, copy, sizeof(value));
700 }
701 
702 void fw_cfg_modify_i16(FWCfgState *s, uint16_t key, uint16_t value)
703 {
704     uint16_t *copy, *old;
705 
706     copy = g_malloc(sizeof(value));
707     *copy = cpu_to_le16(value);
708     old = fw_cfg_modify_bytes_read(s, key, copy, sizeof(value));
709     g_free(old);
710 }
711 
712 void fw_cfg_add_i32(FWCfgState *s, uint16_t key, uint32_t value)
713 {
714     uint32_t *copy;
715 
716     copy = g_malloc(sizeof(value));
717     *copy = cpu_to_le32(value);
718     trace_fw_cfg_add_i32(key, trace_key_name(key), value);
719     fw_cfg_add_bytes(s, key, copy, sizeof(value));
720 }
721 
722 void fw_cfg_add_i64(FWCfgState *s, uint16_t key, uint64_t value)
723 {
724     uint64_t *copy;
725 
726     copy = g_malloc(sizeof(value));
727     *copy = cpu_to_le64(value);
728     trace_fw_cfg_add_i64(key, trace_key_name(key), value);
729     fw_cfg_add_bytes(s, key, copy, sizeof(value));
730 }
731 
732 void fw_cfg_set_order_override(FWCfgState *s, int order)
733 {
734     assert(s->fw_cfg_order_override == 0);
735     s->fw_cfg_order_override = order;
736 }
737 
738 void fw_cfg_reset_order_override(FWCfgState *s)
739 {
740     assert(s->fw_cfg_order_override != 0);
741     s->fw_cfg_order_override = 0;
742 }
743 
744 /*
745  * This is the legacy order list.  For legacy systems, files are in
746  * the fw_cfg in the order defined below, by the "order" value.  Note
747  * that some entries (VGA ROMs, NIC option ROMS, etc.) go into a
748  * specific area, but there may be more than one and they occur in the
749  * order that the user specifies them on the command line.  Those are
750  * handled in a special manner, using the order override above.
751  *
752  * For non-legacy, the files are sorted by filename to avoid this kind
753  * of complexity in the future.
754  *
755  * This is only for x86, other arches don't implement versioning so
756  * they won't set legacy mode.
757  */
758 static struct {
759     const char *name;
760     int order;
761 } fw_cfg_order[] = {
762     { "etc/boot-menu-wait", 10 },
763     { "bootsplash.jpg", 11 },
764     { "bootsplash.bmp", 12 },
765     { "etc/boot-fail-wait", 15 },
766     { "etc/smbios/smbios-tables", 20 },
767     { "etc/smbios/smbios-anchor", 30 },
768     { "etc/e820", 40 },
769     { "etc/reserved-memory-end", 50 },
770     { "genroms/kvmvapic.bin", 55 },
771     { "genroms/linuxboot.bin", 60 },
772     { }, /* VGA ROMs from pc_vga_init come here, 70. */
773     { }, /* NIC option ROMs from pc_nic_init come here, 80. */
774     { "etc/system-states", 90 },
775     { }, /* User ROMs come here, 100. */
776     { }, /* Device FW comes here, 110. */
777     { "etc/extra-pci-roots", 120 },
778     { "etc/acpi/tables", 130 },
779     { "etc/table-loader", 140 },
780     { "etc/tpm/log", 150 },
781     { "etc/acpi/rsdp", 160 },
782     { "bootorder", 170 },
783 
784 #define FW_CFG_ORDER_OVERRIDE_LAST 200
785 };
786 
787 static int get_fw_cfg_order(FWCfgState *s, const char *name)
788 {
789     int i;
790 
791     if (s->fw_cfg_order_override > 0) {
792         return s->fw_cfg_order_override;
793     }
794 
795     for (i = 0; i < ARRAY_SIZE(fw_cfg_order); i++) {
796         if (fw_cfg_order[i].name == NULL) {
797             continue;
798         }
799 
800         if (strcmp(name, fw_cfg_order[i].name) == 0) {
801             return fw_cfg_order[i].order;
802         }
803     }
804 
805     /* Stick unknown stuff at the end. */
806     warn_report("Unknown firmware file in legacy mode: %s", name);
807     return FW_CFG_ORDER_OVERRIDE_LAST;
808 }
809 
810 void fw_cfg_add_file_callback(FWCfgState *s,  const char *filename,
811                               FWCfgCallback select_cb,
812                               FWCfgWriteCallback write_cb,
813                               void *callback_opaque,
814                               void *data, size_t len, bool read_only)
815 {
816     int i, index, count;
817     size_t dsize;
818     MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
819     int order = 0;
820 
821     if (!s->files) {
822         dsize = sizeof(uint32_t) + sizeof(FWCfgFile) * fw_cfg_file_slots(s);
823         s->files = g_malloc0(dsize);
824         fw_cfg_add_bytes(s, FW_CFG_FILE_DIR, s->files, dsize);
825     }
826 
827     count = be32_to_cpu(s->files->count);
828     assert(count < fw_cfg_file_slots(s));
829 
830     /* Find the insertion point. */
831     if (mc->legacy_fw_cfg_order) {
832         /*
833          * Sort by order. For files with the same order, we keep them
834          * in the sequence in which they were added.
835          */
836         order = get_fw_cfg_order(s, filename);
837         for (index = count;
838              index > 0 && order < s->entry_order[index - 1];
839              index--);
840     } else {
841         /* Sort by file name. */
842         for (index = count;
843              index > 0 && strcmp(filename, s->files->f[index - 1].name) < 0;
844              index--);
845     }
846 
847     /*
848      * Move all the entries from the index point and after down one
849      * to create a slot for the new entry.  Because calculations are
850      * being done with the index, make it so that "i" is the current
851      * index and "i - 1" is the one being copied from, thus the
852      * unusual start and end in the for statement.
853      */
854     for (i = count; i > index; i--) {
855         s->files->f[i] = s->files->f[i - 1];
856         s->files->f[i].select = cpu_to_be16(FW_CFG_FILE_FIRST + i);
857         s->entries[0][FW_CFG_FILE_FIRST + i] =
858             s->entries[0][FW_CFG_FILE_FIRST + i - 1];
859         s->entry_order[i] = s->entry_order[i - 1];
860     }
861 
862     memset(&s->files->f[index], 0, sizeof(FWCfgFile));
863     memset(&s->entries[0][FW_CFG_FILE_FIRST + index], 0, sizeof(FWCfgEntry));
864 
865     pstrcpy(s->files->f[index].name, sizeof(s->files->f[index].name), filename);
866     for (i = 0; i <= count; i++) {
867         if (i != index &&
868             strcmp(s->files->f[index].name, s->files->f[i].name) == 0) {
869             error_report("duplicate fw_cfg file name: %s",
870                          s->files->f[index].name);
871             exit(1);
872         }
873     }
874 
875     fw_cfg_add_bytes_callback(s, FW_CFG_FILE_FIRST + index,
876                               select_cb, write_cb,
877                               callback_opaque, data, len,
878                               read_only);
879 
880     s->files->f[index].size   = cpu_to_be32(len);
881     s->files->f[index].select = cpu_to_be16(FW_CFG_FILE_FIRST + index);
882     s->entry_order[index] = order;
883     trace_fw_cfg_add_file(s, index, s->files->f[index].name, len);
884 
885     s->files->count = cpu_to_be32(count+1);
886 }
887 
888 void fw_cfg_add_file(FWCfgState *s,  const char *filename,
889                      void *data, size_t len)
890 {
891     fw_cfg_add_file_callback(s, filename, NULL, NULL, NULL, data, len, true);
892 }
893 
894 void *fw_cfg_modify_file(FWCfgState *s, const char *filename,
895                         void *data, size_t len)
896 {
897     int i, index;
898     void *ptr = NULL;
899 
900     assert(s->files);
901 
902     index = be32_to_cpu(s->files->count);
903 
904     for (i = 0; i < index; i++) {
905         if (strcmp(filename, s->files->f[i].name) == 0) {
906             ptr = fw_cfg_modify_bytes_read(s, FW_CFG_FILE_FIRST + i,
907                                            data, len);
908             s->files->f[i].size   = cpu_to_be32(len);
909             return ptr;
910         }
911     }
912 
913     assert(index < fw_cfg_file_slots(s));
914 
915     /* add new one */
916     fw_cfg_add_file_callback(s, filename, NULL, NULL, NULL, data, len, true);
917     return NULL;
918 }
919 
920 static void fw_cfg_machine_reset(void *opaque)
921 {
922     void *ptr;
923     size_t len;
924     FWCfgState *s = opaque;
925     char *bootindex = get_boot_devices_list(&len);
926 
927     ptr = fw_cfg_modify_file(s, "bootorder", (uint8_t *)bootindex, len);
928     g_free(ptr);
929 }
930 
931 static void fw_cfg_machine_ready(struct Notifier *n, void *data)
932 {
933     FWCfgState *s = container_of(n, FWCfgState, machine_ready);
934     qemu_register_reset(fw_cfg_machine_reset, s);
935 }
936 
937 
938 
939 static void fw_cfg_common_realize(DeviceState *dev, Error **errp)
940 {
941     FWCfgState *s = FW_CFG(dev);
942     MachineState *machine = MACHINE(qdev_get_machine());
943     uint32_t version = FW_CFG_VERSION;
944 
945     if (!fw_cfg_find()) {
946         error_setg(errp, "at most one %s device is permitted", TYPE_FW_CFG);
947         return;
948     }
949 
950     fw_cfg_add_bytes(s, FW_CFG_SIGNATURE, (char *)"QEMU", 4);
951     fw_cfg_add_bytes(s, FW_CFG_UUID, &qemu_uuid, 16);
952     fw_cfg_add_i16(s, FW_CFG_NOGRAPHIC, (uint16_t)!machine->enable_graphics);
953     fw_cfg_add_i16(s, FW_CFG_BOOT_MENU, (uint16_t)boot_menu);
954     fw_cfg_bootsplash(s);
955     fw_cfg_reboot(s);
956 
957     if (s->dma_enabled) {
958         version |= FW_CFG_VERSION_DMA;
959     }
960 
961     fw_cfg_add_i32(s, FW_CFG_ID, version);
962 
963     s->machine_ready.notify = fw_cfg_machine_ready;
964     qemu_add_machine_init_done_notifier(&s->machine_ready);
965 }
966 
967 FWCfgState *fw_cfg_init_io_dma(uint32_t iobase, uint32_t dma_iobase,
968                                 AddressSpace *dma_as)
969 {
970     DeviceState *dev;
971     SysBusDevice *sbd;
972     FWCfgIoState *ios;
973     FWCfgState *s;
974     bool dma_requested = dma_iobase && dma_as;
975 
976     dev = qdev_create(NULL, TYPE_FW_CFG_IO);
977     if (!dma_requested) {
978         qdev_prop_set_bit(dev, "dma_enabled", false);
979     }
980 
981     object_property_add_child(OBJECT(qdev_get_machine()), TYPE_FW_CFG,
982                               OBJECT(dev), NULL);
983     qdev_init_nofail(dev);
984 
985     sbd = SYS_BUS_DEVICE(dev);
986     ios = FW_CFG_IO(dev);
987     sysbus_add_io(sbd, iobase, &ios->comb_iomem);
988 
989     s = FW_CFG(dev);
990 
991     if (s->dma_enabled) {
992         /* 64 bits for the address field */
993         s->dma_as = dma_as;
994         s->dma_addr = 0;
995         sysbus_add_io(sbd, dma_iobase, &s->dma_iomem);
996     }
997 
998     return s;
999 }
1000 
1001 FWCfgState *fw_cfg_init_io(uint32_t iobase)
1002 {
1003     return fw_cfg_init_io_dma(iobase, 0, NULL);
1004 }
1005 
1006 FWCfgState *fw_cfg_init_mem_wide(hwaddr ctl_addr,
1007                                  hwaddr data_addr, uint32_t data_width,
1008                                  hwaddr dma_addr, AddressSpace *dma_as)
1009 {
1010     DeviceState *dev;
1011     SysBusDevice *sbd;
1012     FWCfgState *s;
1013     bool dma_requested = dma_addr && dma_as;
1014 
1015     dev = qdev_create(NULL, TYPE_FW_CFG_MEM);
1016     qdev_prop_set_uint32(dev, "data_width", data_width);
1017     if (!dma_requested) {
1018         qdev_prop_set_bit(dev, "dma_enabled", false);
1019     }
1020 
1021     object_property_add_child(OBJECT(qdev_get_machine()), TYPE_FW_CFG,
1022                               OBJECT(dev), NULL);
1023     qdev_init_nofail(dev);
1024 
1025     sbd = SYS_BUS_DEVICE(dev);
1026     sysbus_mmio_map(sbd, 0, ctl_addr);
1027     sysbus_mmio_map(sbd, 1, data_addr);
1028 
1029     s = FW_CFG(dev);
1030 
1031     if (s->dma_enabled) {
1032         s->dma_as = dma_as;
1033         s->dma_addr = 0;
1034         sysbus_mmio_map(sbd, 2, dma_addr);
1035     }
1036 
1037     return s;
1038 }
1039 
1040 FWCfgState *fw_cfg_init_mem(hwaddr ctl_addr, hwaddr data_addr)
1041 {
1042     return fw_cfg_init_mem_wide(ctl_addr, data_addr,
1043                                 fw_cfg_data_mem_ops.valid.max_access_size,
1044                                 0, NULL);
1045 }
1046 
1047 
1048 FWCfgState *fw_cfg_find(void)
1049 {
1050     /* Returns NULL unless there is exactly one fw_cfg device */
1051     return FW_CFG(object_resolve_path_type("", TYPE_FW_CFG, NULL));
1052 }
1053 
1054 
1055 static void fw_cfg_class_init(ObjectClass *klass, void *data)
1056 {
1057     DeviceClass *dc = DEVICE_CLASS(klass);
1058 
1059     dc->reset = fw_cfg_reset;
1060     dc->vmsd = &vmstate_fw_cfg;
1061 }
1062 
1063 static const TypeInfo fw_cfg_info = {
1064     .name          = TYPE_FW_CFG,
1065     .parent        = TYPE_SYS_BUS_DEVICE,
1066     .abstract      = true,
1067     .instance_size = sizeof(FWCfgState),
1068     .class_init    = fw_cfg_class_init,
1069 };
1070 
1071 static void fw_cfg_file_slots_allocate(FWCfgState *s, Error **errp)
1072 {
1073     uint16_t file_slots_max;
1074 
1075     if (fw_cfg_file_slots(s) < FW_CFG_FILE_SLOTS_MIN) {
1076         error_setg(errp, "\"file_slots\" must be at least 0x%x",
1077                    FW_CFG_FILE_SLOTS_MIN);
1078         return;
1079     }
1080 
1081     /* (UINT16_MAX & FW_CFG_ENTRY_MASK) is the highest inclusive selector value
1082      * that we permit. The actual (exclusive) value coming from the
1083      * configuration is (FW_CFG_FILE_FIRST + fw_cfg_file_slots(s)). */
1084     file_slots_max = (UINT16_MAX & FW_CFG_ENTRY_MASK) - FW_CFG_FILE_FIRST + 1;
1085     if (fw_cfg_file_slots(s) > file_slots_max) {
1086         error_setg(errp, "\"file_slots\" must not exceed 0x%" PRIx16,
1087                    file_slots_max);
1088         return;
1089     }
1090 
1091     s->entries[0] = g_new0(FWCfgEntry, fw_cfg_max_entry(s));
1092     s->entries[1] = g_new0(FWCfgEntry, fw_cfg_max_entry(s));
1093     s->entry_order = g_new0(int, fw_cfg_max_entry(s));
1094 }
1095 
1096 static Property fw_cfg_io_properties[] = {
1097     DEFINE_PROP_BOOL("dma_enabled", FWCfgIoState, parent_obj.dma_enabled,
1098                      true),
1099     DEFINE_PROP_UINT16("x-file-slots", FWCfgIoState, parent_obj.file_slots,
1100                        FW_CFG_FILE_SLOTS_DFLT),
1101     DEFINE_PROP_END_OF_LIST(),
1102 };
1103 
1104 static void fw_cfg_io_realize(DeviceState *dev, Error **errp)
1105 {
1106     FWCfgIoState *s = FW_CFG_IO(dev);
1107     Error *local_err = NULL;
1108 
1109     fw_cfg_file_slots_allocate(FW_CFG(s), &local_err);
1110     if (local_err) {
1111         error_propagate(errp, local_err);
1112         return;
1113     }
1114 
1115     /* when using port i/o, the 8-bit data register ALWAYS overlaps
1116      * with half of the 16-bit control register. Hence, the total size
1117      * of the i/o region used is FW_CFG_CTL_SIZE */
1118     memory_region_init_io(&s->comb_iomem, OBJECT(s), &fw_cfg_comb_mem_ops,
1119                           FW_CFG(s), "fwcfg", FW_CFG_CTL_SIZE);
1120 
1121     if (FW_CFG(s)->dma_enabled) {
1122         memory_region_init_io(&FW_CFG(s)->dma_iomem, OBJECT(s),
1123                               &fw_cfg_dma_mem_ops, FW_CFG(s), "fwcfg.dma",
1124                               sizeof(dma_addr_t));
1125     }
1126 
1127     fw_cfg_common_realize(dev, errp);
1128 }
1129 
1130 static void fw_cfg_io_class_init(ObjectClass *klass, void *data)
1131 {
1132     DeviceClass *dc = DEVICE_CLASS(klass);
1133 
1134     dc->realize = fw_cfg_io_realize;
1135     dc->props = fw_cfg_io_properties;
1136 }
1137 
1138 static const TypeInfo fw_cfg_io_info = {
1139     .name          = TYPE_FW_CFG_IO,
1140     .parent        = TYPE_FW_CFG,
1141     .instance_size = sizeof(FWCfgIoState),
1142     .class_init    = fw_cfg_io_class_init,
1143 };
1144 
1145 
1146 static Property fw_cfg_mem_properties[] = {
1147     DEFINE_PROP_UINT32("data_width", FWCfgMemState, data_width, -1),
1148     DEFINE_PROP_BOOL("dma_enabled", FWCfgMemState, parent_obj.dma_enabled,
1149                      true),
1150     DEFINE_PROP_UINT16("x-file-slots", FWCfgMemState, parent_obj.file_slots,
1151                        FW_CFG_FILE_SLOTS_DFLT),
1152     DEFINE_PROP_END_OF_LIST(),
1153 };
1154 
1155 static void fw_cfg_mem_realize(DeviceState *dev, Error **errp)
1156 {
1157     FWCfgMemState *s = FW_CFG_MEM(dev);
1158     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1159     const MemoryRegionOps *data_ops = &fw_cfg_data_mem_ops;
1160     Error *local_err = NULL;
1161 
1162     fw_cfg_file_slots_allocate(FW_CFG(s), &local_err);
1163     if (local_err) {
1164         error_propagate(errp, local_err);
1165         return;
1166     }
1167 
1168     memory_region_init_io(&s->ctl_iomem, OBJECT(s), &fw_cfg_ctl_mem_ops,
1169                           FW_CFG(s), "fwcfg.ctl", FW_CFG_CTL_SIZE);
1170     sysbus_init_mmio(sbd, &s->ctl_iomem);
1171 
1172     if (s->data_width > data_ops->valid.max_access_size) {
1173         s->wide_data_ops = *data_ops;
1174 
1175         s->wide_data_ops.valid.max_access_size = s->data_width;
1176         s->wide_data_ops.impl.max_access_size  = s->data_width;
1177         data_ops = &s->wide_data_ops;
1178     }
1179     memory_region_init_io(&s->data_iomem, OBJECT(s), data_ops, FW_CFG(s),
1180                           "fwcfg.data", data_ops->valid.max_access_size);
1181     sysbus_init_mmio(sbd, &s->data_iomem);
1182 
1183     if (FW_CFG(s)->dma_enabled) {
1184         memory_region_init_io(&FW_CFG(s)->dma_iomem, OBJECT(s),
1185                               &fw_cfg_dma_mem_ops, FW_CFG(s), "fwcfg.dma",
1186                               sizeof(dma_addr_t));
1187         sysbus_init_mmio(sbd, &FW_CFG(s)->dma_iomem);
1188     }
1189 
1190     fw_cfg_common_realize(dev, errp);
1191 }
1192 
1193 static void fw_cfg_mem_class_init(ObjectClass *klass, void *data)
1194 {
1195     DeviceClass *dc = DEVICE_CLASS(klass);
1196 
1197     dc->realize = fw_cfg_mem_realize;
1198     dc->props = fw_cfg_mem_properties;
1199 }
1200 
1201 static const TypeInfo fw_cfg_mem_info = {
1202     .name          = TYPE_FW_CFG_MEM,
1203     .parent        = TYPE_FW_CFG,
1204     .instance_size = sizeof(FWCfgMemState),
1205     .class_init    = fw_cfg_mem_class_init,
1206 };
1207 
1208 
1209 static void fw_cfg_register_types(void)
1210 {
1211     type_register_static(&fw_cfg_info);
1212     type_register_static(&fw_cfg_io_info);
1213     type_register_static(&fw_cfg_mem_info);
1214 }
1215 
1216 type_init(fw_cfg_register_types)
1217