slirp: check len against dhcp options array end
[qemu.git] / hw / nvram / spapr_nvram.c
blobbc355a434830cfebb8e998c2397f9bd9ce21c152
1 /*
2 * QEMU sPAPR NVRAM emulation
4 * Copyright (C) 2012 David Gibson, IBM Corporation.
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
25 #include "qemu/osdep.h"
26 #include "qapi/error.h"
27 #include "qemu-common.h"
28 #include "cpu.h"
29 #include <libfdt.h>
31 #include "sysemu/block-backend.h"
32 #include "sysemu/device_tree.h"
33 #include "hw/sysbus.h"
34 #include "hw/nvram/chrp_nvram.h"
35 #include "hw/ppc/spapr.h"
36 #include "hw/ppc/spapr_vio.h"
38 typedef struct sPAPRNVRAM {
39 VIOsPAPRDevice sdev;
40 uint32_t size;
41 uint8_t *buf;
42 BlockBackend *blk;
43 VMChangeStateEntry *vmstate;
44 } sPAPRNVRAM;
46 #define TYPE_VIO_SPAPR_NVRAM "spapr-nvram"
47 #define VIO_SPAPR_NVRAM(obj) \
48 OBJECT_CHECK(sPAPRNVRAM, (obj), TYPE_VIO_SPAPR_NVRAM)
50 #define MIN_NVRAM_SIZE 8192
51 #define DEFAULT_NVRAM_SIZE 65536
52 #define MAX_NVRAM_SIZE 1048576
54 static void rtas_nvram_fetch(PowerPCCPU *cpu, sPAPRMachineState *spapr,
55 uint32_t token, uint32_t nargs,
56 target_ulong args,
57 uint32_t nret, target_ulong rets)
59 sPAPRNVRAM *nvram = spapr->nvram;
60 hwaddr offset, buffer, len;
61 void *membuf;
63 if ((nargs != 3) || (nret != 2)) {
64 rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
65 return;
68 if (!nvram) {
69 rtas_st(rets, 0, RTAS_OUT_HW_ERROR);
70 rtas_st(rets, 1, 0);
71 return;
74 offset = rtas_ld(args, 0);
75 buffer = rtas_ld(args, 1);
76 len = rtas_ld(args, 2);
78 if (((offset + len) < offset)
79 || ((offset + len) > nvram->size)) {
80 rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
81 rtas_st(rets, 1, 0);
82 return;
85 assert(nvram->buf);
87 membuf = cpu_physical_memory_map(buffer, &len, 1);
88 memcpy(membuf, nvram->buf + offset, len);
89 cpu_physical_memory_unmap(membuf, len, 1, len);
91 rtas_st(rets, 0, RTAS_OUT_SUCCESS);
92 rtas_st(rets, 1, len);
95 static void rtas_nvram_store(PowerPCCPU *cpu, sPAPRMachineState *spapr,
96 uint32_t token, uint32_t nargs,
97 target_ulong args,
98 uint32_t nret, target_ulong rets)
100 sPAPRNVRAM *nvram = spapr->nvram;
101 hwaddr offset, buffer, len;
102 int alen;
103 void *membuf;
105 if ((nargs != 3) || (nret != 2)) {
106 rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
107 return;
110 if (!nvram) {
111 rtas_st(rets, 0, RTAS_OUT_HW_ERROR);
112 return;
115 offset = rtas_ld(args, 0);
116 buffer = rtas_ld(args, 1);
117 len = rtas_ld(args, 2);
119 if (((offset + len) < offset)
120 || ((offset + len) > nvram->size)) {
121 rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
122 return;
125 membuf = cpu_physical_memory_map(buffer, &len, 0);
127 alen = len;
128 if (nvram->blk) {
129 alen = blk_pwrite(nvram->blk, offset, membuf, len, 0);
132 assert(nvram->buf);
133 memcpy(nvram->buf + offset, membuf, len);
135 cpu_physical_memory_unmap(membuf, len, 0, len);
137 rtas_st(rets, 0, (alen < len) ? RTAS_OUT_HW_ERROR : RTAS_OUT_SUCCESS);
138 rtas_st(rets, 1, (alen < 0) ? 0 : alen);
141 static void spapr_nvram_realize(VIOsPAPRDevice *dev, Error **errp)
143 sPAPRNVRAM *nvram = VIO_SPAPR_NVRAM(dev);
144 int ret;
146 if (nvram->blk) {
147 int64_t len = blk_getlength(nvram->blk);
149 if (len < 0) {
150 error_setg_errno(errp, -len,
151 "could not get length of backing image");
152 return;
155 nvram->size = len;
157 ret = blk_set_perm(nvram->blk,
158 BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE,
159 BLK_PERM_ALL, errp);
160 if (ret < 0) {
161 return;
163 } else {
164 nvram->size = DEFAULT_NVRAM_SIZE;
167 nvram->buf = g_malloc0(nvram->size);
169 if ((nvram->size < MIN_NVRAM_SIZE) || (nvram->size > MAX_NVRAM_SIZE)) {
170 error_setg(errp, "spapr-nvram must be between %d and %d bytes in size",
171 MIN_NVRAM_SIZE, MAX_NVRAM_SIZE);
172 return;
175 if (nvram->blk) {
176 int alen = blk_pread(nvram->blk, 0, nvram->buf, nvram->size);
178 if (alen != nvram->size) {
179 error_setg(errp, "can't read spapr-nvram contents");
180 return;
182 } else if (nb_prom_envs > 0) {
183 /* Create a system partition to pass the -prom-env variables */
184 chrp_nvram_create_system_partition(nvram->buf, MIN_NVRAM_SIZE / 4);
185 chrp_nvram_create_free_partition(&nvram->buf[MIN_NVRAM_SIZE / 4],
186 nvram->size - MIN_NVRAM_SIZE / 4);
189 spapr_rtas_register(RTAS_NVRAM_FETCH, "nvram-fetch", rtas_nvram_fetch);
190 spapr_rtas_register(RTAS_NVRAM_STORE, "nvram-store", rtas_nvram_store);
193 static int spapr_nvram_devnode(VIOsPAPRDevice *dev, void *fdt, int node_off)
195 sPAPRNVRAM *nvram = VIO_SPAPR_NVRAM(dev);
197 return fdt_setprop_cell(fdt, node_off, "#bytes", nvram->size);
200 static int spapr_nvram_pre_load(void *opaque)
202 sPAPRNVRAM *nvram = VIO_SPAPR_NVRAM(opaque);
204 g_free(nvram->buf);
205 nvram->buf = NULL;
206 nvram->size = 0;
208 return 0;
211 static void postload_update_cb(void *opaque, int running, RunState state)
213 sPAPRNVRAM *nvram = opaque;
215 /* This is called after bdrv_invalidate_cache_all. */
217 qemu_del_vm_change_state_handler(nvram->vmstate);
218 nvram->vmstate = NULL;
220 blk_pwrite(nvram->blk, 0, nvram->buf, nvram->size, 0);
223 static int spapr_nvram_post_load(void *opaque, int version_id)
225 sPAPRNVRAM *nvram = VIO_SPAPR_NVRAM(opaque);
227 if (nvram->blk) {
228 nvram->vmstate = qemu_add_vm_change_state_handler(postload_update_cb,
229 nvram);
232 return 0;
235 static const VMStateDescription vmstate_spapr_nvram = {
236 .name = "spapr_nvram",
237 .version_id = 1,
238 .minimum_version_id = 1,
239 .pre_load = spapr_nvram_pre_load,
240 .post_load = spapr_nvram_post_load,
241 .fields = (VMStateField[]) {
242 VMSTATE_UINT32(size, sPAPRNVRAM),
243 VMSTATE_VBUFFER_ALLOC_UINT32(buf, sPAPRNVRAM, 1, NULL, size),
244 VMSTATE_END_OF_LIST()
248 static Property spapr_nvram_properties[] = {
249 DEFINE_SPAPR_PROPERTIES(sPAPRNVRAM, sdev),
250 DEFINE_PROP_DRIVE("drive", sPAPRNVRAM, blk),
251 DEFINE_PROP_END_OF_LIST(),
254 static void spapr_nvram_class_init(ObjectClass *klass, void *data)
256 DeviceClass *dc = DEVICE_CLASS(klass);
257 VIOsPAPRDeviceClass *k = VIO_SPAPR_DEVICE_CLASS(klass);
259 k->realize = spapr_nvram_realize;
260 k->devnode = spapr_nvram_devnode;
261 k->dt_name = "nvram";
262 k->dt_type = "nvram";
263 k->dt_compatible = "qemu,spapr-nvram";
264 set_bit(DEVICE_CATEGORY_MISC, dc->categories);
265 dc->props = spapr_nvram_properties;
266 dc->vmsd = &vmstate_spapr_nvram;
269 static const TypeInfo spapr_nvram_type_info = {
270 .name = TYPE_VIO_SPAPR_NVRAM,
271 .parent = TYPE_VIO_SPAPR_DEVICE,
272 .instance_size = sizeof(sPAPRNVRAM),
273 .class_init = spapr_nvram_class_init,
276 static void spapr_nvram_register_types(void)
278 type_register_static(&spapr_nvram_type_info);
281 type_init(spapr_nvram_register_types)