1/*
2 * QEMU Firmware configuration device emulation
3 *
4 * Copyright (c) 2008 Gleb Natapov
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
23 */
24
25#include "qemu/osdep.h"
26#include "qemu-common.h"
27#include "sysemu/sysemu.h"
28#include "sysemu/dma.h"
29#include "sysemu/reset.h"
30#include "hw/boards.h"
31#include "hw/nvram/fw_cfg.h"
32#include "hw/qdev-properties.h"
33#include "hw/sysbus.h"
34#include "migration/qemu-file-types.h"
35#include "migration/vmstate.h"
36#include "trace.h"
37#include "qemu/error-report.h"
38#include "qemu/option.h"
39#include "qemu/config-file.h"
40#include "qemu/cutils.h"
41#include "qapi/error.h"
42
43#define FW_CFG_FILE_SLOTS_DFLT 0x20
44
45/* FW_CFG_VERSION bits */
46#define FW_CFG_VERSION 0x01
47#define FW_CFG_VERSION_DMA 0x02
48
49/* FW_CFG_DMA_CONTROL bits */
50#define FW_CFG_DMA_CTL_ERROR 0x01
51#define FW_CFG_DMA_CTL_READ 0x02
52#define FW_CFG_DMA_CTL_SKIP 0x04
53#define FW_CFG_DMA_CTL_SELECT 0x08
54#define FW_CFG_DMA_CTL_WRITE 0x10
55
56#define FW_CFG_DMA_SIGNATURE 0x51454d5520434647ULL /* "QEMU CFG" */
57
58struct FWCfgEntry {
59 uint32_t len;
60 bool allow_write;
61 uint8_t *data;
62 void *callback_opaque;
63 FWCfgCallback select_cb;
64 FWCfgWriteCallback write_cb;
65};
66
67/**
68 * key_name:
69 *
70 * @key: The uint16 selector key.
71 *
72 * Returns: The stringified name if the selector refers to a well-known
73 * numerically defined item, or NULL on key lookup failure.
74 */
75static const char *key_name(uint16_t key)
76{
77 static const char *fw_cfg_wellknown_keys[FW_CFG_FILE_FIRST] = {
78 [FW_CFG_SIGNATURE] = "signature",
79 [FW_CFG_ID] = "id",
80 [FW_CFG_UUID] = "uuid",
81 [FW_CFG_RAM_SIZE] = "ram_size",
82 [FW_CFG_NOGRAPHIC] = "nographic",
83 [FW_CFG_NB_CPUS] = "nb_cpus",
84 [FW_CFG_MACHINE_ID] = "machine_id",
85 [FW_CFG_KERNEL_ADDR] = "kernel_addr",
86 [FW_CFG_KERNEL_SIZE] = "kernel_size",
87 [FW_CFG_KERNEL_CMDLINE] = "kernel_cmdline",
88 [FW_CFG_INITRD_ADDR] = "initrd_addr",
89 [FW_CFG_INITRD_SIZE] = "initdr_size",
90 [FW_CFG_BOOT_DEVICE] = "boot_device",
91 [FW_CFG_NUMA] = "numa",
92 [FW_CFG_BOOT_MENU] = "boot_menu",
93 [FW_CFG_MAX_CPUS] = "max_cpus",
94 [FW_CFG_KERNEL_ENTRY] = "kernel_entry",
95 [FW_CFG_KERNEL_DATA] = "kernel_data",
96 [FW_CFG_INITRD_DATA] = "initrd_data",
97 [FW_CFG_CMDLINE_ADDR] = "cmdline_addr",
98 [FW_CFG_CMDLINE_SIZE] = "cmdline_size",
99 [FW_CFG_CMDLINE_DATA] = "cmdline_data",
100 [FW_CFG_SETUP_ADDR] = "setup_addr",
101 [FW_CFG_SETUP_SIZE] = "setup_size",
102 [FW_CFG_SETUP_DATA] = "setup_data",
103 [FW_CFG_FILE_DIR] = "file_dir",
104 };
105
106 if (key & FW_CFG_ARCH_LOCAL) {
107 return fw_cfg_arch_key_name(key);
108 }
109 if (key < FW_CFG_FILE_FIRST) {
110 return fw_cfg_wellknown_keys[key];
111 }
112
113 return NULL;
114}
115
116static inline const char *trace_key_name(uint16_t key)
117{
118 const char *name = key_name(key);
119
120 return name ? name : "unknown";
121}
122
123#define JPG_FILE 0
124#define BMP_FILE 1
125
126static char *read_splashfile(char *filename, gsize *file_sizep,
127 int *file_typep)
128{
129 GError *err = NULL;
130 gchar *content;
131 int file_type;
132 unsigned int filehead;
133 int bmp_bpp;
134
135 if (!g_file_get_contents(filename, &content, file_sizep, &err)) {
136 error_report("failed to read splash file '%s': %s",
137 filename, err->message);
138 g_error_free(err);
139 return NULL;
140 }
141
142 /* check file size */
143 if (*file_sizep < 30) {
144 goto error;
145 }
146
147 /* check magic ID */
148 filehead = lduw_le_p(content);
149 if (filehead == 0xd8ff) {
150 file_type = JPG_FILE;
151 } else if (filehead == 0x4d42) {
152 file_type = BMP_FILE;
153 } else {
154 goto error;
155 }
156
157 /* check BMP bpp */
158 if (file_type == BMP_FILE) {
159 bmp_bpp = lduw_le_p(&content[28]);
160 if (bmp_bpp != 24) {
161 goto error;
162 }
163 }
164
165 /* return values */
166 *file_typep = file_type;
167
168 return content;
169
170error:
171 error_report("splash file '%s' format not recognized; must be JPEG "
172 "or 24 bit BMP", filename);
173 g_free(content);
174 return NULL;
175}
176
177static void fw_cfg_bootsplash(FWCfgState *s)
178{
179 const char *boot_splash_filename = NULL;
180 const char *boot_splash_time = NULL;
181 char *filename, *file_data;
182 gsize file_size;
183 int file_type;
184
185 /* get user configuration */
186 QemuOptsList *plist = qemu_find_opts("boot-opts");
187 QemuOpts *opts = QTAILQ_FIRST(&plist->head);
188 boot_splash_filename = qemu_opt_get(opts, "splash");
189 boot_splash_time = qemu_opt_get(opts, "splash-time");
190
191 /* insert splash time if user configurated */
192 if (boot_splash_time) {
193 int64_t bst_val = qemu_opt_get_number(opts, "splash-time", -1);
194 uint16_t bst_le16;
195
196 /* validate the input */
197 if (bst_val < 0 || bst_val > 0xffff) {
198 error_report("splash-time is invalid,"
199 "it should be a value between 0 and 65535");
200 exit(1);
201 }
202 /* use little endian format */
203 bst_le16 = cpu_to_le16(bst_val);
204 fw_cfg_add_file(s, "etc/boot-menu-wait",
205 g_memdup(&bst_le16, sizeof bst_le16), sizeof bst_le16);
206 }
207
208 /* insert splash file if user configurated */
209 if (boot_splash_filename) {
210 filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, boot_splash_filename);
211 if (filename == NULL) {
212 error_report("failed to find file '%s'", boot_splash_filename);
213 return;
214 }
215
216 /* loading file data */
217 file_data = read_splashfile(filename, &file_size, &file_type);
218 if (file_data == NULL) {
219 g_free(filename);
220 return;
221 }
222 g_free(boot_splash_filedata);
223 boot_splash_filedata = (uint8_t *)file_data;
224
225 /* insert data */
226 if (file_type == JPG_FILE) {
227 fw_cfg_add_file(s, "bootsplash.jpg",
228 boot_splash_filedata, file_size);
229 } else {
230 fw_cfg_add_file(s, "bootsplash.bmp",
231 boot_splash_filedata, file_size);
232 }
233 g_free(filename);
234 }
235}
236
237static void fw_cfg_reboot(FWCfgState *s)
238{
239 const char *reboot_timeout = NULL;
240 int64_t rt_val = -1;
241 uint32_t rt_le32;
242
243 /* get user configuration */
244 QemuOptsList *plist = qemu_find_opts("boot-opts");
245 QemuOpts *opts = QTAILQ_FIRST(&plist->head);
246 reboot_timeout = qemu_opt_get(opts, "reboot-timeout");
247
248 if (reboot_timeout) {
249 rt_val = qemu_opt_get_number(opts, "reboot-timeout", -1);
250 /* validate the input */
251 if (rt_val < 0 || rt_val > 0xffff) {
252 error_report("reboot timeout is invalid,"
253 "it should be a value between 0 and 65535");
254 exit(1);
255 }
256 }
257
258 rt_le32 = cpu_to_le32(rt_val);
259 fw_cfg_add_file(s, "etc/boot-fail-wait", g_memdup(&rt_le32, 4), 4);
260}
261
262static void fw_cfg_write(FWCfgState *s, uint8_t value)
263{
264 /* nothing, write support removed in QEMU v2.4+ */
265}
266
267static inline uint16_t fw_cfg_file_slots(const FWCfgState *s)
268{
269 return s->file_slots;
270}
271
272/* Note: this function returns an exclusive limit. */
273static inline uint32_t fw_cfg_max_entry(const FWCfgState *s)
274{
275 return FW_CFG_FILE_FIRST + fw_cfg_file_slots(s);
276}
277
278static int fw_cfg_select(FWCfgState *s, uint16_t key)
279{
280 int arch, ret;
281 FWCfgEntry *e;
282
283 s->cur_offset = 0;
284 if ((key & FW_CFG_ENTRY_MASK) >= fw_cfg_max_entry(s)) {
285 s->cur_entry = FW_CFG_INVALID;
286 ret = 0;
287 } else {
288 s->cur_entry = key;
289 ret = 1;
290 /* entry successfully selected, now run callback if present */
291 arch = !!(key & FW_CFG_ARCH_LOCAL);
292 e = &s->entries[arch][key & FW_CFG_ENTRY_MASK];
293 if (e->select_cb) {
294 e->select_cb(e->callback_opaque);
295 }
296 }
297
298 trace_fw_cfg_select(s, key, trace_key_name(key), ret);
299 return ret;
300}
301
302static uint64_t fw_cfg_data_read(void *opaque, hwaddr addr, unsigned size)
303{
304 FWCfgState *s = opaque;
305 int arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
306 FWCfgEntry *e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
307 &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
308 uint64_t value = 0;
309
310 assert(size > 0 && size <= sizeof(value));
311 if (s->cur_entry != FW_CFG_INVALID && e->data && s->cur_offset < e->len) {
312 /* The least significant 'size' bytes of the return value are
313 * expected to contain a string preserving portion of the item
314 * data, padded with zeros on the right in case we run out early.
315 * In technical terms, we're composing the host-endian representation
316 * of the big endian interpretation of the fw_cfg string.
317 */
318 do {
319 value = (value << 8) | e->data[s->cur_offset++];
320 } while (--size && s->cur_offset < e->len);
321 /* If size is still not zero, we *did* run out early, so continue
322 * left-shifting, to add the appropriate number of padding zeros
323 * on the right.
324 */
325 value <<= 8 * size;
326 }
327
328 trace_fw_cfg_read(s, value);
329 return value;
330}
331
332static void fw_cfg_data_mem_write(void *opaque, hwaddr addr,
333 uint64_t value, unsigned size)
334{
335 FWCfgState *s = opaque;
336 unsigned i = size;
337
338 do {
339 fw_cfg_write(s, value >> (8 * --i));
340 } while (i);
341}
342
343static void fw_cfg_dma_transfer(FWCfgState *s)
344{
345 dma_addr_t len;
346 FWCfgDmaAccess dma;
347 int arch;
348 FWCfgEntry *e;
349 int read = 0, write = 0;
350 dma_addr_t dma_addr;
351
352 /* Reset the address before the next access */
353 dma_addr = s->dma_addr;
354 s->dma_addr = 0;
355
356 if (dma_memory_read(s->dma_as, dma_addr, &dma, sizeof(dma))) {
357 stl_be_dma(s->dma_as, dma_addr + offsetof(FWCfgDmaAccess, control),
358 FW_CFG_DMA_CTL_ERROR);
359 return;
360 }
361
362 dma.address = be64_to_cpu(dma.address);
363 dma.length = be32_to_cpu(dma.length);
364 dma.control = be32_to_cpu(dma.control);
365
366 if (dma.control & FW_CFG_DMA_CTL_SELECT) {
367 fw_cfg_select(s, dma.control >> 16);
368 }
369
370 arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
371 e = (s->cur_entry == FW_CFG_INVALID) ? NULL :
372 &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
373
374 if (dma.control & FW_CFG_DMA_CTL_READ) {
375 read = 1;
376 write = 0;
377 } else if (dma.control & FW_CFG_DMA_CTL_WRITE) {
378 read = 0;
379 write = 1;
380 } else if (dma.control & FW_CFG_DMA_CTL_SKIP) {
381 read = 0;
382 write = 0;
383 } else {
384 dma.length = 0;
385 }
386
387 dma.control = 0;
388
389 while (dma.length > 0 && !(dma.control & FW_CFG_DMA_CTL_ERROR)) {
390 if (s->cur_entry == FW_CFG_INVALID || !e->data ||
391 s->cur_offset >= e->len) {
392 len = dma.length;
393
394 /* If the access is not a read access, it will be a skip access,
395 * tested before.
396 */
397 if (read) {
398 if (dma_memory_set(s->dma_as, dma.address, 0, len)) {
399 dma.control |= FW_CFG_DMA_CTL_ERROR;
400 }
401 }
402 if (write) {
403 dma.control |= FW_CFG_DMA_CTL_ERROR;
404 }
405 } else {
406 if (dma.length <= (e->len - s->cur_offset)) {
407 len = dma.length;
408 } else {
409 len = (e->len - s->cur_offset);
410 }
411
412 /* If the access is not a read access, it will be a skip access,
413 * tested before.
414 */
415 if (read) {
416 if (dma_memory_write(s->dma_as, dma.address,
417 &e->data[s->cur_offset], len)) {
418 dma.control |= FW_CFG_DMA_CTL_ERROR;
419 }
420 }
421 if (write) {
422 if (!e->allow_write ||
423 len != dma.length ||
424 dma_memory_read(s->dma_as, dma.address,
425 &e->data[s->cur_offset], len)) {
426 dma.control |= FW_CFG_DMA_CTL_ERROR;
427 } else if (e->write_cb) {
428 e->write_cb(e->callback_opaque, s->cur_offset, len);
429 }
430 }
431
432 s->cur_offset += len;
433 }
434
435 dma.address += len;
436 dma.length -= len;
437
438 }
439
440 stl_be_dma(s->dma_as, dma_addr + offsetof(FWCfgDmaAccess, control),
441 dma.control);
442
443 trace_fw_cfg_read(s, 0);
444}
445
446static uint64_t fw_cfg_dma_mem_read(void *opaque, hwaddr addr,
447 unsigned size)
448{
449 /* Return a signature value (and handle various read sizes) */
450 return extract64(FW_CFG_DMA_SIGNATURE, (8 - addr - size) * 8, size * 8);
451}
452
453static void fw_cfg_dma_mem_write(void *opaque, hwaddr addr,
454 uint64_t value, unsigned size)
455{
456 FWCfgState *s = opaque;
457
458 if (size == 4) {
459 if (addr == 0) {
460 /* FWCfgDmaAccess high address */
461 s->dma_addr = value << 32;
462 } else if (addr == 4) {
463 /* FWCfgDmaAccess low address */
464 s->dma_addr |= value;
465 fw_cfg_dma_transfer(s);
466 }
467 } else if (size == 8 && addr == 0) {
468 s->dma_addr = value;
469 fw_cfg_dma_transfer(s);
470 }
471}
472
473static bool fw_cfg_dma_mem_valid(void *opaque, hwaddr addr,
474 unsigned size, bool is_write,
475 MemTxAttrs attrs)
476{
477 return !is_write || ((size == 4 && (addr == 0 || addr == 4)) ||
478 (size == 8 && addr == 0));
479}
480
481static bool fw_cfg_data_mem_valid(void *opaque, hwaddr addr,
482 unsigned size, bool is_write,
483 MemTxAttrs attrs)
484{
485 return addr == 0;
486}
487
488static uint64_t fw_cfg_ctl_mem_read(void *opaque, hwaddr addr, unsigned size)
489{
490 return 0;
491}
492
493static void fw_cfg_ctl_mem_write(void *opaque, hwaddr addr,
494 uint64_t value, unsigned size)
495{
496 fw_cfg_select(opaque, (uint16_t)value);
497}
498
499static bool fw_cfg_ctl_mem_valid(void *opaque, hwaddr addr,
500 unsigned size, bool is_write,
501 MemTxAttrs attrs)
502{
503 return is_write && size == 2;
504}
505
506static void fw_cfg_comb_write(void *opaque, hwaddr addr,
507 uint64_t value, unsigned size)
508{
509 switch (size) {
510 case 1:
511 fw_cfg_write(opaque, (uint8_t)value);
512 break;
513 case 2:
514 fw_cfg_select(opaque, (uint16_t)value);
515 break;
516 }
517}
518
519static bool fw_cfg_comb_valid(void *opaque, hwaddr addr,
520 unsigned size, bool is_write,
521 MemTxAttrs attrs)
522{
523 return (size == 1) || (is_write && size == 2);
524}
525
526static const MemoryRegionOps fw_cfg_ctl_mem_ops = {
527 .read = fw_cfg_ctl_mem_read,
528 .write = fw_cfg_ctl_mem_write,
529 .endianness = DEVICE_BIG_ENDIAN,
530 .valid.accepts = fw_cfg_ctl_mem_valid,
531};
532
533static const MemoryRegionOps fw_cfg_data_mem_ops = {
534 .read = fw_cfg_data_read,
535 .write = fw_cfg_data_mem_write,
536 .endianness = DEVICE_BIG_ENDIAN,
537 .valid = {
538 .min_access_size = 1,
539 .max_access_size = 1,
540 .accepts = fw_cfg_data_mem_valid,
541 },
542};
543
544static const MemoryRegionOps fw_cfg_comb_mem_ops = {
545 .read = fw_cfg_data_read,
546 .write = fw_cfg_comb_write,
547 .endianness = DEVICE_LITTLE_ENDIAN,
548 .valid.accepts = fw_cfg_comb_valid,
549};
550
551static const MemoryRegionOps fw_cfg_dma_mem_ops = {
552 .read = fw_cfg_dma_mem_read,
553 .write = fw_cfg_dma_mem_write,
554 .endianness = DEVICE_BIG_ENDIAN,
555 .valid.accepts = fw_cfg_dma_mem_valid,
556 .valid.max_access_size = 8,
557 .impl.max_access_size = 8,
558};
559
560static void fw_cfg_reset(DeviceState *d)
561{
562 FWCfgState *s = FW_CFG(d);
563
564 /* we never register a read callback for FW_CFG_SIGNATURE */
565 fw_cfg_select(s, FW_CFG_SIGNATURE);
566}
567
568/* Save restore 32 bit int as uint16_t
569 This is a Big hack, but it is how the old state did it.
570 Or we broke compatibility in the state, or we can't use struct tm
571 */
572
573static int get_uint32_as_uint16(QEMUFile *f, void *pv, size_t size,
574 const VMStateField *field)
575{
576 uint32_t *v = pv;
577 *v = qemu_get_be16(f);
578 return 0;
579}
580
581static int put_unused(QEMUFile *f, void *pv, size_t size,
582 const VMStateField *field, QJSON *vmdesc)
583{
584 fprintf(stderr, "uint32_as_uint16 is only used for backward compatibility.\n");
585 fprintf(stderr, "This functions shouldn't be called.\n");
586
587 return 0;
588}
589
590static const VMStateInfo vmstate_hack_uint32_as_uint16 = {
591 .name = "int32_as_uint16",
592 .get = get_uint32_as_uint16,
593 .put = put_unused,
594};
595
596#define VMSTATE_UINT16_HACK(_f, _s, _t) \
597 VMSTATE_SINGLE_TEST(_f, _s, _t, 0, vmstate_hack_uint32_as_uint16, uint32_t)
598
599
600static bool is_version_1(void *opaque, int version_id)
601{
602 return version_id == 1;
603}
604
605bool fw_cfg_dma_enabled(void *opaque)
606{
607 FWCfgState *s = opaque;
608
609 return s->dma_enabled;
610}
611
612static const VMStateDescription vmstate_fw_cfg_dma = {
613 .name = "fw_cfg/dma",
614 .needed = fw_cfg_dma_enabled,
615 .fields = (VMStateField[]) {
616 VMSTATE_UINT64(dma_addr, FWCfgState),
617 VMSTATE_END_OF_LIST()
618 },
619};
620
621static const VMStateDescription vmstate_fw_cfg = {
622 .name = "fw_cfg",
623 .version_id = 2,
624 .minimum_version_id = 1,
625 .fields = (VMStateField[]) {
626 VMSTATE_UINT16(cur_entry, FWCfgState),
627 VMSTATE_UINT16_HACK(cur_offset, FWCfgState, is_version_1),
628 VMSTATE_UINT32_V(cur_offset, FWCfgState, 2),
629 VMSTATE_END_OF_LIST()
630 },
631 .subsections = (const VMStateDescription*[]) {
632 &vmstate_fw_cfg_dma,
633 NULL,
634 }
635};
636
637static void fw_cfg_add_bytes_callback(FWCfgState *s, uint16_t key,
638 FWCfgCallback select_cb,
639 FWCfgWriteCallback write_cb,
640 void *callback_opaque,
641 void *data, size_t len,
642 bool read_only)
643{
644 int arch = !!(key & FW_CFG_ARCH_LOCAL);
645
646 key &= FW_CFG_ENTRY_MASK;
647
648 assert(key < fw_cfg_max_entry(s) && len < UINT32_MAX);
649 assert(s->entries[arch][key].data == NULL); /* avoid key conflict */
650
651 s->entries[arch][key].data = data;
652 s->entries[arch][key].len = (uint32_t)len;
653 s->entries[arch][key].select_cb = select_cb;
654 s->entries[arch][key].write_cb = write_cb;
655 s->entries[arch][key].callback_opaque = callback_opaque;
656 s->entries[arch][key].allow_write = !read_only;
657}
658
659static void *fw_cfg_modify_bytes_read(FWCfgState *s, uint16_t key,
660 void *data, size_t len)
661{
662 void *ptr;
663 int arch = !!(key & FW_CFG_ARCH_LOCAL);
664
665 key &= FW_CFG_ENTRY_MASK;
666
667 assert(key < fw_cfg_max_entry(s) && len < UINT32_MAX);
668
669 /* return the old data to the function caller, avoid memory leak */
670 ptr = s->entries[arch][key].data;
671 s->entries[arch][key].data = data;
672 s->entries[arch][key].len = len;
673 s->entries[arch][key].callback_opaque = NULL;
674 s->entries[arch][key].allow_write = false;
675
676 return ptr;
677}
678
679void fw_cfg_add_bytes(FWCfgState *s, uint16_t key, void *data, size_t len)
680{
681 trace_fw_cfg_add_bytes(key, trace_key_name(key), len);
682 fw_cfg_add_bytes_callback(s, key, NULL, NULL, NULL, data, len, true);
683}
684
685void fw_cfg_add_string(FWCfgState *s, uint16_t key, const char *value)
686{
687 size_t sz = strlen(value) + 1;
688
689 trace_fw_cfg_add_string(key, trace_key_name(key), value);
690 fw_cfg_add_bytes(s, key, g_memdup(value, sz), sz);
691}
692
693void fw_cfg_add_i16(FWCfgState *s, uint16_t key, uint16_t value)
694{
695 uint16_t *copy;
696
697 copy = g_malloc(sizeof(value));
698 *copy = cpu_to_le16(value);
699 trace_fw_cfg_add_i16(key, trace_key_name(key), value);
700 fw_cfg_add_bytes(s, key, copy, sizeof(value));
701}
702
703void fw_cfg_modify_i16(FWCfgState *s, uint16_t key, uint16_t value)
704{
705 uint16_t *copy, *old;
706
707 copy = g_malloc(sizeof(value));
708 *copy = cpu_to_le16(value);
709 old = fw_cfg_modify_bytes_read(s, key, copy, sizeof(value));
710 g_free(old);
711}
712
713void fw_cfg_add_i32(FWCfgState *s, uint16_t key, uint32_t value)
714{
715 uint32_t *copy;
716
717 copy = g_malloc(sizeof(value));
718 *copy = cpu_to_le32(value);
719 trace_fw_cfg_add_i32(key, trace_key_name(key), value);
720 fw_cfg_add_bytes(s, key, copy, sizeof(value));
721}
722
723void fw_cfg_add_i64(FWCfgState *s, uint16_t key, uint64_t value)
724{
725 uint64_t *copy;
726
727 copy = g_malloc(sizeof(value));
728 *copy = cpu_to_le64(value);
729 trace_fw_cfg_add_i64(key, trace_key_name(key), value);
730 fw_cfg_add_bytes(s, key, copy, sizeof(value));
731}
732
733void fw_cfg_set_order_override(FWCfgState *s, int order)
734{
735 assert(s->fw_cfg_order_override == 0);
736 s->fw_cfg_order_override = order;
737}
738
739void fw_cfg_reset_order_override(FWCfgState *s)
740{
741 assert(s->fw_cfg_order_override != 0);
742 s->fw_cfg_order_override = 0;
743}
744
745/*
746 * This is the legacy order list. For legacy systems, files are in
747 * the fw_cfg in the order defined below, by the "order" value. Note
748 * that some entries (VGA ROMs, NIC option ROMS, etc.) go into a
749 * specific area, but there may be more than one and they occur in the
750 * order that the user specifies them on the command line. Those are
751 * handled in a special manner, using the order override above.
752 *
753 * For non-legacy, the files are sorted by filename to avoid this kind
754 * of complexity in the future.
755 *
756 * This is only for x86, other arches don't implement versioning so
757 * they won't set legacy mode.
758 */
759static struct {
760 const char *name;
761 int order;
762} fw_cfg_order[] = {
763 { "etc/boot-menu-wait", 10 },
764 { "bootsplash.jpg", 11 },
765 { "bootsplash.bmp", 12 },
766 { "etc/boot-fail-wait", 15 },
767 { "etc/smbios/smbios-tables", 20 },
768 { "etc/smbios/smbios-anchor", 30 },
769 { "etc/e820", 40 },
770 { "etc/reserved-memory-end", 50 },
771 { "genroms/kvmvapic.bin", 55 },
772 { "genroms/linuxboot.bin", 60 },
773 { }, /* VGA ROMs from pc_vga_init come here, 70. */
774 { }, /* NIC option ROMs from pc_nic_init come here, 80. */
775 { "etc/system-states", 90 },
776 { }, /* User ROMs come here, 100. */
777 { }, /* Device FW comes here, 110. */
778 { "etc/extra-pci-roots", 120 },
779 { "etc/acpi/tables", 130 },
780 { "etc/table-loader", 140 },
781 { "etc/tpm/log", 150 },
782 { "etc/acpi/rsdp", 160 },
783 { "bootorder", 170 },
784
785#define FW_CFG_ORDER_OVERRIDE_LAST 200
786};
787
788static int get_fw_cfg_order(FWCfgState *s, const char *name)
789{
790 int i;
791
792 if (s->fw_cfg_order_override > 0) {
793 return s->fw_cfg_order_override;
794 }
795
796 for (i = 0; i < ARRAY_SIZE(fw_cfg_order); i++) {
797 if (fw_cfg_order[i].name == NULL) {
798 continue;
799 }
800
801 if (strcmp(name, fw_cfg_order[i].name) == 0) {
802 return fw_cfg_order[i].order;
803 }
804 }
805
806 /* Stick unknown stuff at the end. */
807 warn_report("Unknown firmware file in legacy mode: %s", name);
808 return FW_CFG_ORDER_OVERRIDE_LAST;
809}
810
811void fw_cfg_add_file_callback(FWCfgState *s, const char *filename,
812 FWCfgCallback select_cb,
813 FWCfgWriteCallback write_cb,
814 void *callback_opaque,
815 void *data, size_t len, bool read_only)
816{
817 int i, index, count;
818 size_t dsize;
819 MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
820 int order = 0;
821
822 if (!s->files) {
823 dsize = sizeof(uint32_t) + sizeof(FWCfgFile) * fw_cfg_file_slots(s);
824 s->files = g_malloc0(dsize);
825 fw_cfg_add_bytes(s, FW_CFG_FILE_DIR, s->files, dsize);
826 }
827
828 count = be32_to_cpu(s->files->count);
829 assert(count < fw_cfg_file_slots(s));
830
831 /* Find the insertion point. */
832 if (mc->legacy_fw_cfg_order) {
833 /*
834 * Sort by order. For files with the same order, we keep them
835 * in the sequence in which they were added.
836 */
837 order = get_fw_cfg_order(s, filename);
838 for (index = count;
839 index > 0 && order < s->entry_order[index - 1];
840 index--);
841 } else {
842 /* Sort by file name. */
843 for (index = count;
844 index > 0 && strcmp(filename, s->files->f[index - 1].name) < 0;
845 index--);
846 }
847
848 /*
849 * Move all the entries from the index point and after down one
850 * to create a slot for the new entry. Because calculations are
851 * being done with the index, make it so that "i" is the current
852 * index and "i - 1" is the one being copied from, thus the
853 * unusual start and end in the for statement.
854 */
855 for (i = count; i > index; i--) {
856 s->files->f[i] = s->files->f[i - 1];
857 s->files->f[i].select = cpu_to_be16(FW_CFG_FILE_FIRST + i);
858 s->entries[0][FW_CFG_FILE_FIRST + i] =
859 s->entries[0][FW_CFG_FILE_FIRST + i - 1];
860 s->entry_order[i] = s->entry_order[i - 1];
861 }
862
863 memset(&s->files->f[index], 0, sizeof(FWCfgFile));
864 memset(&s->entries[0][FW_CFG_FILE_FIRST + index], 0, sizeof(FWCfgEntry));
865
866 pstrcpy(s->files->f[index].name, sizeof(s->files->f[index].name), filename);
867 for (i = 0; i <= count; i++) {
868 if (i != index &&
869 strcmp(s->files->f[index].name, s->files->f[i].name) == 0) {
870 error_report("duplicate fw_cfg file name: %s",
871 s->files->f[index].name);
872 exit(1);
873 }
874 }
875
876 fw_cfg_add_bytes_callback(s, FW_CFG_FILE_FIRST + index,
877 select_cb, write_cb,
878 callback_opaque, data, len,
879 read_only);
880
881 s->files->f[index].size = cpu_to_be32(len);
882 s->files->f[index].select = cpu_to_be16(FW_CFG_FILE_FIRST + index);
883 s->entry_order[index] = order;
884 trace_fw_cfg_add_file(s, index, s->files->f[index].name, len);
885
886 s->files->count = cpu_to_be32(count+1);
887}
888
889void fw_cfg_add_file(FWCfgState *s, const char *filename,
890 void *data, size_t len)
891{
892 fw_cfg_add_file_callback(s, filename, NULL, NULL, NULL, data, len, true);
893}
894
895void *fw_cfg_modify_file(FWCfgState *s, const char *filename,
896 void *data, size_t len)
897{
898 int i, index;
899 void *ptr = NULL;
900
901 assert(s->files);
902
903 index = be32_to_cpu(s->files->count);
904
905 for (i = 0; i < index; i++) {
906 if (strcmp(filename, s->files->f[i].name) == 0) {
907 ptr = fw_cfg_modify_bytes_read(s, FW_CFG_FILE_FIRST + i,
908 data, len);
909 s->files->f[i].size = cpu_to_be32(len);
910 return ptr;
911 }
912 }
913
914 assert(index < fw_cfg_file_slots(s));
915
916 /* add new one */
917 fw_cfg_add_file_callback(s, filename, NULL, NULL, NULL, data, len, true);
918 return NULL;
919}
920
921static void fw_cfg_machine_reset(void *opaque)
922{
923 void *ptr;
924 size_t len;
925 FWCfgState *s = opaque;
926 char *bootindex = get_boot_devices_list(&len);
927
928 ptr = fw_cfg_modify_file(s, "bootorder", (uint8_t *)bootindex, len);
929 g_free(ptr);
930}
931
932static void fw_cfg_machine_ready(struct Notifier *n, void *data)
933{
934 FWCfgState *s = container_of(n, FWCfgState, machine_ready);
935 qemu_register_reset(fw_cfg_machine_reset, s);
936}
937
938
939
940static void fw_cfg_common_realize(DeviceState *dev, Error **errp)
941{
942 FWCfgState *s = FW_CFG(dev);
943 MachineState *machine = MACHINE(qdev_get_machine());
944 uint32_t version = FW_CFG_VERSION;
945
946 if (!fw_cfg_find()) {
947 error_setg(errp, "at most one %s device is permitted", TYPE_FW_CFG);
948 return;
949 }
950
951 fw_cfg_add_bytes(s, FW_CFG_SIGNATURE, (char *)"QEMU", 4);
952 fw_cfg_add_bytes(s, FW_CFG_UUID, &qemu_uuid, 16);
953 fw_cfg_add_i16(s, FW_CFG_NOGRAPHIC, (uint16_t)!machine->enable_graphics);
954 fw_cfg_add_i16(s, FW_CFG_BOOT_MENU, (uint16_t)boot_menu);
955 fw_cfg_bootsplash(s);
956 fw_cfg_reboot(s);
957
958 if (s->dma_enabled) {
959 version |= FW_CFG_VERSION_DMA;
960 }
961
962 fw_cfg_add_i32(s, FW_CFG_ID, version);
963
964 s->machine_ready.notify = fw_cfg_machine_ready;
965 qemu_add_machine_init_done_notifier(&s->machine_ready);
966}
967
968FWCfgState *fw_cfg_init_io_dma(uint32_t iobase, uint32_t dma_iobase,
969 AddressSpace *dma_as)
970{
971 DeviceState *dev;
972 SysBusDevice *sbd;
973 FWCfgIoState *ios;
974 FWCfgState *s;
975 bool dma_requested = dma_iobase && dma_as;
976
977 dev = qdev_create(NULL, TYPE_FW_CFG_IO);
978 if (!dma_requested) {
979 qdev_prop_set_bit(dev, "dma_enabled", false);
980 }
981
982 object_property_add_child(OBJECT(qdev_get_machine()), TYPE_FW_CFG,
983 OBJECT(dev), NULL);
984 qdev_init_nofail(dev);
985
986 sbd = SYS_BUS_DEVICE(dev);
987 ios = FW_CFG_IO(dev);
988 sysbus_add_io(sbd, iobase, &ios->comb_iomem);
989
990 s = FW_CFG(dev);
991
992 if (s->dma_enabled) {
993 /* 64 bits for the address field */
994 s->dma_as = dma_as;
995 s->dma_addr = 0;
996 sysbus_add_io(sbd, dma_iobase, &s->dma_iomem);
997 }
998
999 return s;
1000}
1001
1002FWCfgState *fw_cfg_init_io(uint32_t iobase)
1003{
1004 return fw_cfg_init_io_dma(iobase, 0, NULL);
1005}
1006
1007FWCfgState *fw_cfg_init_mem_wide(hwaddr ctl_addr,
1008 hwaddr data_addr, uint32_t data_width,
1009 hwaddr dma_addr, AddressSpace *dma_as)
1010{
1011 DeviceState *dev;
1012 SysBusDevice *sbd;
1013 FWCfgState *s;
1014 bool dma_requested = dma_addr && dma_as;
1015
1016 dev = qdev_create(NULL, TYPE_FW_CFG_MEM);
1017 qdev_prop_set_uint32(dev, "data_width", data_width);
1018 if (!dma_requested) {
1019 qdev_prop_set_bit(dev, "dma_enabled", false);
1020 }
1021
1022 object_property_add_child(OBJECT(qdev_get_machine()), TYPE_FW_CFG,
1023 OBJECT(dev), NULL);
1024 qdev_init_nofail(dev);
1025
1026 sbd = SYS_BUS_DEVICE(dev);
1027 sysbus_mmio_map(sbd, 0, ctl_addr);
1028 sysbus_mmio_map(sbd, 1, data_addr);
1029
1030 s = FW_CFG(dev);
1031
1032 if (s->dma_enabled) {
1033 s->dma_as = dma_as;
1034 s->dma_addr = 0;
1035 sysbus_mmio_map(sbd, 2, dma_addr);
1036 }
1037
1038 return s;
1039}
1040
1041FWCfgState *fw_cfg_init_mem(hwaddr ctl_addr, hwaddr data_addr)
1042{
1043 return fw_cfg_init_mem_wide(ctl_addr, data_addr,
1044 fw_cfg_data_mem_ops.valid.max_access_size,
1045 0, NULL);
1046}
1047
1048
1049FWCfgState *fw_cfg_find(void)
1050{
1051 /* Returns NULL unless there is exactly one fw_cfg device */
1052 return FW_CFG(object_resolve_path_type("", TYPE_FW_CFG, NULL));
1053}
1054
1055
1056static void fw_cfg_class_init(ObjectClass *klass, void *data)
1057{
1058 DeviceClass *dc = DEVICE_CLASS(klass);
1059
1060 dc->reset = fw_cfg_reset;
1061 dc->vmsd = &vmstate_fw_cfg;
1062}
1063
1064static const TypeInfo fw_cfg_info = {
1065 .name = TYPE_FW_CFG,
1066 .parent = TYPE_SYS_BUS_DEVICE,
1067 .abstract = true,
1068 .instance_size = sizeof(FWCfgState),
1069 .class_init = fw_cfg_class_init,
1070};
1071
1072static void fw_cfg_file_slots_allocate(FWCfgState *s, Error **errp)
1073{
1074 uint16_t file_slots_max;
1075
1076 if (fw_cfg_file_slots(s) < FW_CFG_FILE_SLOTS_MIN) {
1077 error_setg(errp, "\"file_slots\" must be at least 0x%x",
1078 FW_CFG_FILE_SLOTS_MIN);
1079 return;
1080 }
1081
1082 /* (UINT16_MAX & FW_CFG_ENTRY_MASK) is the highest inclusive selector value
1083 * that we permit. The actual (exclusive) value coming from the
1084 * configuration is (FW_CFG_FILE_FIRST + fw_cfg_file_slots(s)). */
1085 file_slots_max = (UINT16_MAX & FW_CFG_ENTRY_MASK) - FW_CFG_FILE_FIRST + 1;
1086 if (fw_cfg_file_slots(s) > file_slots_max) {
1087 error_setg(errp, "\"file_slots\" must not exceed 0x%" PRIx16,
1088 file_slots_max);
1089 return;
1090 }
1091
1092 s->entries[0] = g_new0(FWCfgEntry, fw_cfg_max_entry(s));
1093 s->entries[1] = g_new0(FWCfgEntry, fw_cfg_max_entry(s));
1094 s->entry_order = g_new0(int, fw_cfg_max_entry(s));
1095}
1096
1097static Property fw_cfg_io_properties[] = {
1098 DEFINE_PROP_BOOL("dma_enabled", FWCfgIoState, parent_obj.dma_enabled,
1099 true),
1100 DEFINE_PROP_UINT16("x-file-slots", FWCfgIoState, parent_obj.file_slots,
1101 FW_CFG_FILE_SLOTS_DFLT),
1102 DEFINE_PROP_END_OF_LIST(),
1103};
1104
1105static void fw_cfg_io_realize(DeviceState *dev, Error **errp)
1106{
1107 FWCfgIoState *s = FW_CFG_IO(dev);
1108 Error *local_err = NULL;
1109
1110 fw_cfg_file_slots_allocate(FW_CFG(s), &local_err);
1111 if (local_err) {
1112 error_propagate(errp, local_err);
1113 return;
1114 }
1115
1116 /* when using port i/o, the 8-bit data register ALWAYS overlaps
1117 * with half of the 16-bit control register. Hence, the total size
1118 * of the i/o region used is FW_CFG_CTL_SIZE */
1119 memory_region_init_io(&s->comb_iomem, OBJECT(s), &fw_cfg_comb_mem_ops,
1120 FW_CFG(s), "fwcfg", FW_CFG_CTL_SIZE);
1121
1122 if (FW_CFG(s)->dma_enabled) {
1123 memory_region_init_io(&FW_CFG(s)->dma_iomem, OBJECT(s),
1124 &fw_cfg_dma_mem_ops, FW_CFG(s), "fwcfg.dma",
1125 sizeof(dma_addr_t));
1126 }
1127
1128 fw_cfg_common_realize(dev, errp);
1129}
1130
1131static void fw_cfg_io_class_init(ObjectClass *klass, void *data)
1132{
1133 DeviceClass *dc = DEVICE_CLASS(klass);
1134
1135 dc->realize = fw_cfg_io_realize;
1136 dc->props = fw_cfg_io_properties;
1137}
1138
1139static const TypeInfo fw_cfg_io_info = {
1140 .name = TYPE_FW_CFG_IO,
1141 .parent = TYPE_FW_CFG,
1142 .instance_size = sizeof(FWCfgIoState),
1143 .class_init = fw_cfg_io_class_init,
1144};
1145
1146
1147static Property fw_cfg_mem_properties[] = {
1148 DEFINE_PROP_UINT32("data_width", FWCfgMemState, data_width, -1),
1149 DEFINE_PROP_BOOL("dma_enabled", FWCfgMemState, parent_obj.dma_enabled,
1150 true),
1151 DEFINE_PROP_UINT16("x-file-slots", FWCfgMemState, parent_obj.file_slots,
1152 FW_CFG_FILE_SLOTS_DFLT),
1153 DEFINE_PROP_END_OF_LIST(),
1154};
1155
1156static void fw_cfg_mem_realize(DeviceState *dev, Error **errp)
1157{
1158 FWCfgMemState *s = FW_CFG_MEM(dev);
1159 SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1160 const MemoryRegionOps *data_ops = &fw_cfg_data_mem_ops;
1161 Error *local_err = NULL;
1162
1163 fw_cfg_file_slots_allocate(FW_CFG(s), &local_err);
1164 if (local_err) {
1165 error_propagate(errp, local_err);
1166 return;
1167 }
1168
1169 memory_region_init_io(&s->ctl_iomem, OBJECT(s), &fw_cfg_ctl_mem_ops,
1170 FW_CFG(s), "fwcfg.ctl", FW_CFG_CTL_SIZE);
1171 sysbus_init_mmio(sbd, &s->ctl_iomem);
1172
1173 if (s->data_width > data_ops->valid.max_access_size) {
1174 s->wide_data_ops = *data_ops;
1175
1176 s->wide_data_ops.valid.max_access_size = s->data_width;
1177 s->wide_data_ops.impl.max_access_size = s->data_width;
1178 data_ops = &s->wide_data_ops;
1179 }
1180 memory_region_init_io(&s->data_iomem, OBJECT(s), data_ops, FW_CFG(s),
1181 "fwcfg.data", data_ops->valid.max_access_size);
1182 sysbus_init_mmio(sbd, &s->data_iomem);
1183
1184 if (FW_CFG(s)->dma_enabled) {
1185 memory_region_init_io(&FW_CFG(s)->dma_iomem, OBJECT(s),
1186 &fw_cfg_dma_mem_ops, FW_CFG(s), "fwcfg.dma",
1187 sizeof(dma_addr_t));
1188 sysbus_init_mmio(sbd, &FW_CFG(s)->dma_iomem);
1189 }
1190
1191 fw_cfg_common_realize(dev, errp);
1192}
1193
1194static void fw_cfg_mem_class_init(ObjectClass *klass, void *data)
1195{
1196 DeviceClass *dc = DEVICE_CLASS(klass);
1197
1198 dc->realize = fw_cfg_mem_realize;
1199 dc->props = fw_cfg_mem_properties;
1200}
1201
1202static const TypeInfo fw_cfg_mem_info = {
1203 .name = TYPE_FW_CFG_MEM,
1204 .parent = TYPE_FW_CFG,
1205 .instance_size = sizeof(FWCfgMemState),
1206 .class_init = fw_cfg_mem_class_init,
1207};
1208
1209
1210static void fw_cfg_register_types(void)
1211{
1212 type_register_static(&fw_cfg_info);
1213 type_register_static(&fw_cfg_io_info);
1214 type_register_static(&fw_cfg_mem_info);
1215}
1216
1217type_init(fw_cfg_register_types)
1218