hw/core/loader.c

   1 /*
   2  * QEMU Executable loader
   3  *
   4  * Copyright (c) 2006 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  *
  24  * Gunzip functionality in this file is derived from u-boot:
  25  *
  26  * (C) Copyright 2008 Semihalf
  27  *
  28  * (C) Copyright 2000-2005
  29  * Wolfgang Denk, DENX Software Engineering, wd@denx.de.
  30  *
  31  * This program is free software; you can redistribute it and/or
  32  * modify it under the terms of the GNU General Public License as
  33  * published by the Free Software Foundation; either version 2 of
  34  * the License, or (at your option) any later version.
  35  *
  36  * This program is distributed in the hope that it will be useful,
  37  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  38  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  39  * GNU General Public License for more details.
  40  *
  41  * You should have received a copy of the GNU General Public License along
  42  * with this program; if not, see <http://www.gnu.org/licenses/>.
  43  */
  44
  45 #include "hw/hw.h"
  46 #include "disas/disas.h"
  47 #include "monitor/monitor.h"
  48 #include "sysemu/sysemu.h"
  49 #include "uboot_image.h"
  50 #include "hw/loader.h"
  51 #include "hw/nvram/fw_cfg.h"
  52 #include "exec/memory.h"
  53 #include "exec/address-spaces.h"
  54 #include "hw/boards.h"
  55
  56 #include <zlib.h>
  57
  58 static int roms_loaded;
  59
  60 /* return the size or -1 if error */
  61 int get_image_size(const char *filename)
  62 {
  63     int fd, size;
  64     fd = open(filename, O_RDONLY | O_BINARY);
  65     if (fd < 0)
  66         return -1;
  67     size = lseek(fd, 0, SEEK_END);
  68     close(fd);
  69     return size;
  70 }
  71
  72 /* return the size or -1 if error */
  73 /* deprecated, because caller does not specify buffer size! */
  74 int load_image(const char *filename, uint8_t *addr)
  75 {
  76     int fd, size;
  77     fd = open(filename, O_RDONLY | O_BINARY);
  78     if (fd < 0)
  79         return -1;
  80     size = lseek(fd, 0, SEEK_END);
  81     if (size == -1) {
  82         fprintf(stderr, "file %-20s: get size error: %s\n",
  83                 filename, strerror(errno));
  84         close(fd);
  85         return -1;
  86     }
  87
  88     lseek(fd, 0, SEEK_SET);
  89     if (read(fd, addr, size) != size) {
  90         close(fd);
  91         return -1;
  92     }
  93     close(fd);
  94     return size;
  95 }
  96
  97 /* return the size or -1 if error */
  98 ssize_t load_image_size(const char *filename, void *addr, size_t size)
  99 {
 100     int fd;
 101     ssize_t actsize;
 102
 103     fd = open(filename, O_RDONLY | O_BINARY);
 104     if (fd < 0) {
 105         return -1;
 106     }
 107
 108     actsize = read(fd, addr, size);
 109     if (actsize < 0) {
 110         close(fd);
 111         return -1;
 112     }
 113     close(fd);
 114
 115     return actsize;
 116 }
 117
 118 /* read()-like version */
 119 ssize_t read_targphys(const char *name,
 120                       int fd, hwaddr dst_addr, size_t nbytes)
 121 {
 122     uint8_t *buf;
 123     ssize_t did;
 124
 125     buf = g_malloc(nbytes);
 126     did = read(fd, buf, nbytes);
 127     if (did > 0)
 128         rom_add_blob_fixed("read", buf, did, dst_addr);
 129     g_free(buf);
 130     return did;
 131 }
 132
 133 /* return the size or -1 if error */
 134 int load_image_targphys(const char *filename,
 135                         hwaddr addr, uint64_t max_sz)
 136 {
 137     int size;
 138
 139     size = get_image_size(filename);
 140     if (size > max_sz) {
 141         return -1;
 142     }
 143     if (size > 0) {
 144         rom_add_file_fixed(filename, addr, -1);
 145     }
 146     return size;
 147 }
 148
 149 void pstrcpy_targphys(const char *name, hwaddr dest, int buf_size,
 150                       const char *source)
 151 {
 152     const char *nulp;
 153     char *ptr;
 154
 155     if (buf_size <= 0) return;
 156     nulp = memchr(source, 0, buf_size);
 157     if (nulp) {
 158         rom_add_blob_fixed(name, source, (nulp - source) + 1, dest);
 159     } else {
 160         rom_add_blob_fixed(name, source, buf_size, dest);
 161         ptr = rom_ptr(dest + buf_size - 1);
 162         *ptr = 0;
 163     }
 164 }
 165
 166 /* A.OUT loader */
 167
 168 struct exec
 169 {
 170   uint32_t a_info;   /* Use macros N_MAGIC, etc for access */
 171   uint32_t a_text;   /* length of text, in bytes */
 172   uint32_t a_data;   /* length of data, in bytes */
 173   uint32_t a_bss;    /* length of uninitialized data area, in bytes */
 174   uint32_t a_syms;   /* length of symbol table data in file, in bytes */
 175   uint32_t a_entry;  /* start address */
 176   uint32_t a_trsize; /* length of relocation info for text, in bytes */
 177   uint32_t a_drsize; /* length of relocation info for data, in bytes */
 178 };
 179
 180 static void bswap_ahdr(struct exec *e)
 181 {
 182     bswap32s(&e->a_info);
 183     bswap32s(&e->a_text);
 184     bswap32s(&e->a_data);
 185     bswap32s(&e->a_bss);
 186     bswap32s(&e->a_syms);
 187     bswap32s(&e->a_entry);
 188     bswap32s(&e->a_trsize);
 189     bswap32s(&e->a_drsize);
 190 }
 191
 192 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
 193 #define OMAGIC 0407
 194 #define NMAGIC 0410
 195 #define ZMAGIC 0413
 196 #define QMAGIC 0314
 197 #define _N_HDROFF(x) (1024 - sizeof (struct exec))
 198 #define N_TXTOFF(x)                                                     \
 199     (N_MAGIC(x) == ZMAGIC ? _N_HDROFF((x)) + sizeof (struct exec) :     \
 200      (N_MAGIC(x) == QMAGIC ? 0 : sizeof (struct exec)))
 201 #define N_TXTADDR(x, target_page_size) (N_MAGIC(x) == QMAGIC ? target_page_size : 0)
 202 #define _N_SEGMENT_ROUND(x, target_page_size) (((x) + target_page_size - 1) & ~(target_page_size - 1))
 203
 204 #define _N_TXTENDADDR(x, target_page_size) (N_TXTADDR(x, target_page_size)+(x).a_text)
 205
 206 #define N_DATADDR(x, target_page_size) \
 207     (N_MAGIC(x)==OMAGIC? (_N_TXTENDADDR(x, target_page_size)) \
 208      : (_N_SEGMENT_ROUND (_N_TXTENDADDR(x, target_page_size), target_page_size)))
 209
 210
 211 int load_aout(const char *filename, hwaddr addr, int max_sz,
 212               int bswap_needed, hwaddr target_page_size)
 213 {
 214     int fd;
 215     ssize_t size, ret;
 216     struct exec e;
 217     uint32_t magic;
 218
 219     fd = open(filename, O_RDONLY | O_BINARY);
 220     if (fd < 0)
 221         return -1;
 222
 223     size = read(fd, &e, sizeof(e));
 224     if (size < 0)
 225         goto fail;
 226
 227     if (bswap_needed) {
 228         bswap_ahdr(&e);
 229     }
 230
 231     magic = N_MAGIC(e);
 232     switch (magic) {
 233     case ZMAGIC:
 234     case QMAGIC:
 235     case OMAGIC:
 236         if (e.a_text + e.a_data > max_sz)
 237             goto fail;
 238         lseek(fd, N_TXTOFF(e), SEEK_SET);
 239         size = read_targphys(filename, fd, addr, e.a_text + e.a_data);
 240         if (size < 0)
 241             goto fail;
 242         break;
 243     case NMAGIC:
 244         if (N_DATADDR(e, target_page_size) + e.a_data > max_sz)
 245             goto fail;
 246         lseek(fd, N_TXTOFF(e), SEEK_SET);
 247         size = read_targphys(filename, fd, addr, e.a_text);
 248         if (size < 0)
 249             goto fail;
 250         ret = read_targphys(filename, fd, addr + N_DATADDR(e, target_page_size),
 251                             e.a_data);
 252         if (ret < 0)
 253             goto fail;
 254         size += ret;
 255         break;
 256     default:
 257         goto fail;
 258     }
 259     close(fd);
 260     return size;
 261  fail:
 262     close(fd);
 263     return -1;
 264 }
 265
 266 /* ELF loader */
 267
 268 static void *load_at(int fd, off_t offset, size_t size)
 269 {
 270     void *ptr;
 271     if (lseek(fd, offset, SEEK_SET) < 0)
 272         return NULL;
 273     ptr = g_malloc(size);
 274     if (read(fd, ptr, size) != size) {
 275         g_free(ptr);
 276         return NULL;
 277     }
 278     return ptr;
 279 }
 280
 281 #ifdef ELF_CLASS
 282 #undef ELF_CLASS
 283 #endif
 284
 285 #define ELF_CLASS   ELFCLASS32
 286 #include "elf.h"
 287
 288 #define SZ              32
 289 #define elf_word        uint32_t
 290 #define elf_sword        int32_t
 291 #define bswapSZs        bswap32s
 292 #include "hw/elf_ops.h"
 293
 294 #undef elfhdr
 295 #undef elf_phdr
 296 #undef elf_shdr
 297 #undef elf_sym
 298 #undef elf_rela
 299 #undef elf_note
 300 #undef elf_word
 301 #undef elf_sword
 302 #undef bswapSZs
 303 #undef SZ
 304 #define elfhdr          elf64_hdr
 305 #define elf_phdr        elf64_phdr
 306 #define elf_note        elf64_note
 307 #define elf_shdr        elf64_shdr
 308 #define elf_sym         elf64_sym
 309 #define elf_rela        elf64_rela
 310 #define elf_word        uint64_t
 311 #define elf_sword        int64_t
 312 #define bswapSZs        bswap64s
 313 #define SZ              64
 314 #include "hw/elf_ops.h"
 315
 316 const char *load_elf_strerror(int error)
 317 {
 318     switch (error) {
 319     case 0:
 320         return "No error";
 321     case ELF_LOAD_FAILED:
 322         return "Failed to load ELF";
 323     case ELF_LOAD_NOT_ELF:
 324         return "The image is not ELF";
 325     case ELF_LOAD_WRONG_ARCH:
 326         return "The image is from incompatible architecture";
 327     case ELF_LOAD_WRONG_ENDIAN:
 328         return "The image has incorrect endianness";
 329     default:
 330         return "Unknown error";
 331     }
 332 }
 333
 334 /* return < 0 if error, otherwise the number of bytes loaded in memory */
 335 int load_elf(const char *filename, uint64_t (*translate_fn)(void *, uint64_t),
 336              void *translate_opaque, uint64_t *pentry, uint64_t *lowaddr,
 337              uint64_t *highaddr, int big_endian, int elf_machine, int clear_lsb)
 338 {
 339     int fd, data_order, target_data_order, must_swab, ret = ELF_LOAD_FAILED;
 340     uint8_t e_ident[EI_NIDENT];
 341
 342     fd = open(filename, O_RDONLY | O_BINARY);
 343     if (fd < 0) {
 344         perror(filename);
 345         return -1;
 346     }
 347     if (read(fd, e_ident, sizeof(e_ident)) != sizeof(e_ident))
 348         goto fail;
 349     if (e_ident[0] != ELFMAG0 ||
 350         e_ident[1] != ELFMAG1 ||
 351         e_ident[2] != ELFMAG2 ||
 352         e_ident[3] != ELFMAG3) {
 353         ret = ELF_LOAD_NOT_ELF;
 354         goto fail;
 355     }
 356 #ifdef HOST_WORDS_BIGENDIAN
 357     data_order = ELFDATA2MSB;
 358 #else
 359     data_order = ELFDATA2LSB;
 360 #endif
 361     must_swab = data_order != e_ident[EI_DATA];
 362     if (big_endian) {
 363         target_data_order = ELFDATA2MSB;
 364     } else {
 365         target_data_order = ELFDATA2LSB;
 366     }
 367
 368     if (target_data_order != e_ident[EI_DATA]) {
 369         ret = ELF_LOAD_WRONG_ENDIAN;
 370         goto fail;
 371     }
 372
 373     lseek(fd, 0, SEEK_SET);
 374     if (e_ident[EI_CLASS] == ELFCLASS64) {
 375         ret = load_elf64(filename, fd, translate_fn, translate_opaque, must_swab,
 376                          pentry, lowaddr, highaddr, elf_machine, clear_lsb);
 377     } else {
 378         ret = load_elf32(filename, fd, translate_fn, translate_opaque, must_swab,
 379                          pentry, lowaddr, highaddr, elf_machine, clear_lsb);
 380     }
 381
 382  fail:
 383     close(fd);
 384     return ret;
 385 }
 386
 387 static void bswap_uboot_header(uboot_image_header_t *hdr)
 388 {
 389 #ifndef HOST_WORDS_BIGENDIAN
 390     bswap32s(&hdr->ih_magic);
 391     bswap32s(&hdr->ih_hcrc);
 392     bswap32s(&hdr->ih_time);
 393     bswap32s(&hdr->ih_size);
 394     bswap32s(&hdr->ih_load);
 395     bswap32s(&hdr->ih_ep);
 396     bswap32s(&hdr->ih_dcrc);
 397 #endif
 398 }
 399
 400
 401 #define ZALLOC_ALIGNMENT        16
 402
 403 static void *zalloc(void *x, unsigned items, unsigned size)
 404 {
 405     void *p;
 406
 407     size *= items;
 408     size = (size + ZALLOC_ALIGNMENT - 1) & ~(ZALLOC_ALIGNMENT - 1);
 409
 410     p = g_malloc(size);
 411
 412     return (p);
 413 }
 414
 415 static void zfree(void *x, void *addr)
 416 {
 417     g_free(addr);
 418 }
 419
 420
 421 #define HEAD_CRC        2
 422 #define EXTRA_FIELD     4
 423 #define ORIG_NAME       8
 424 #define COMMENT         0x10
 425 #define RESERVED        0xe0
 426
 427 #define DEFLATED        8
 428
 429 /* This is the usual maximum in uboot, so if a uImage overflows this, it would
 430  * overflow on real hardware too. */
 431 #define UBOOT_MAX_GUNZIP_BYTES (64 << 20)
 432
 433 static ssize_t gunzip(void *dst, size_t dstlen, uint8_t *src,
 434                       size_t srclen)
 435 {
 436     z_stream s;
 437     ssize_t dstbytes;
 438     int r, i, flags;
 439
 440     /* skip header */
 441     i = 10;
 442     flags = src[3];
 443     if (src[2] != DEFLATED || (flags & RESERVED) != 0) {
 444         puts ("Error: Bad gzipped data\n");
 445         return -1;
 446     }
 447     if ((flags & EXTRA_FIELD) != 0)
 448         i = 12 + src[10] + (src[11] << 8);
 449     if ((flags & ORIG_NAME) != 0)
 450         while (src[i++] != 0)
 451             ;
 452     if ((flags & COMMENT) != 0)
 453         while (src[i++] != 0)
 454             ;
 455     if ((flags & HEAD_CRC) != 0)
 456         i += 2;
 457     if (i >= srclen) {
 458         puts ("Error: gunzip out of data in header\n");
 459         return -1;
 460     }
 461
 462     s.zalloc = zalloc;
 463     s.zfree = zfree;
 464
 465     r = inflateInit2(&s, -MAX_WBITS);
 466     if (r != Z_OK) {
 467         printf ("Error: inflateInit2() returned %d\n", r);
 468         return (-1);
 469     }
 470     s.next_in = src + i;
 471     s.avail_in = srclen - i;
 472     s.next_out = dst;
 473     s.avail_out = dstlen;
 474     r = inflate(&s, Z_FINISH);
 475     if (r != Z_OK && r != Z_STREAM_END) {
 476         printf ("Error: inflate() returned %d\n", r);
 477         return -1;
 478     }
 479     dstbytes = s.next_out - (unsigned char *) dst;
 480     inflateEnd(&s);
 481
 482     return dstbytes;
 483 }
 484
 485 /* Load a U-Boot image.  */
 486 static int load_uboot_image(const char *filename, hwaddr *ep, hwaddr *loadaddr,
 487                             int *is_linux, uint8_t image_type,
 488                             uint64_t (*translate_fn)(void *, uint64_t),
 489                             void *translate_opaque)
 490 {
 491     int fd;
 492     int size;
 493     hwaddr address;
 494     uboot_image_header_t h;
 495     uboot_image_header_t *hdr = &h;
 496     uint8_t *data = NULL;
 497     int ret = -1;
 498     int do_uncompress = 0;
 499
 500     fd = open(filename, O_RDONLY | O_BINARY);
 501     if (fd < 0)
 502         return -1;
 503
 504     size = read(fd, hdr, sizeof(uboot_image_header_t));
 505     if (size < 0)
 506         goto out;
 507
 508     bswap_uboot_header(hdr);
 509
 510     if (hdr->ih_magic != IH_MAGIC)
 511         goto out;
 512
 513     if (hdr->ih_type != image_type) {
 514         fprintf(stderr, "Wrong image type %d, expected %d\n", hdr->ih_type,
 515                 image_type);
 516         goto out;
 517     }
 518
 519     /* TODO: Implement other image types.  */
 520     switch (hdr->ih_type) {
 521     case IH_TYPE_KERNEL:
 522         address = hdr->ih_load;
 523         if (translate_fn) {
 524             address = translate_fn(translate_opaque, address);
 525         }
 526         if (loadaddr) {
 527             *loadaddr = hdr->ih_load;
 528         }
 529
 530         switch (hdr->ih_comp) {
 531         case IH_COMP_NONE:
 532             break;
 533         case IH_COMP_GZIP:
 534             do_uncompress = 1;
 535             break;
 536         default:
 537             fprintf(stderr,
 538                     "Unable to load u-boot images with compression type %d\n",
 539                     hdr->ih_comp);
 540             goto out;
 541         }
 542
 543         if (ep) {
 544             *ep = hdr->ih_ep;
 545         }
 546
 547         /* TODO: Check CPU type.  */
 548         if (is_linux) {
 549             if (hdr->ih_os == IH_OS_LINUX) {
 550                 *is_linux = 1;
 551             } else {
 552                 *is_linux = 0;
 553             }
 554         }
 555
 556         break;
 557     case IH_TYPE_RAMDISK:
 558         address = *loadaddr;
 559         break;
 560     default:
 561         fprintf(stderr, "Unsupported u-boot image type %d\n", hdr->ih_type);
 562         goto out;
 563     }
 564
 565     data = g_malloc(hdr->ih_size);
 566
 567     if (read(fd, data, hdr->ih_size) != hdr->ih_size) {
 568         fprintf(stderr, "Error reading file\n");
 569         goto out;
 570     }
 571
 572     if (do_uncompress) {
 573         uint8_t *compressed_data;
 574         size_t max_bytes;
 575         ssize_t bytes;
 576
 577         compressed_data = data;
 578         max_bytes = UBOOT_MAX_GUNZIP_BYTES;
 579         data = g_malloc(max_bytes);
 580
 581         bytes = gunzip(data, max_bytes, compressed_data, hdr->ih_size);
 582         g_free(compressed_data);
 583         if (bytes < 0) {
 584             fprintf(stderr, "Unable to decompress gzipped image!\n");
 585             goto out;
 586         }
 587         hdr->ih_size = bytes;
 588     }
 589
 590     rom_add_blob_fixed(filename, data, hdr->ih_size, address);
 591
 592     ret = hdr->ih_size;
 593
 594 out:
 595     g_free(data);
 596     close(fd);
 597     return ret;
 598 }
 599
 600 int load_uimage(const char *filename, hwaddr *ep, hwaddr *loadaddr,
 601                 int *is_linux,
 602                 uint64_t (*translate_fn)(void *, uint64_t),
 603                 void *translate_opaque)
 604 {
 605     return load_uboot_image(filename, ep, loadaddr, is_linux, IH_TYPE_KERNEL,
 606                             translate_fn, translate_opaque);
 607 }
 608
 609 /* Load a ramdisk.  */
 610 int load_ramdisk(const char *filename, hwaddr addr, uint64_t max_sz)
 611 {
 612     return load_uboot_image(filename, NULL, &addr, NULL, IH_TYPE_RAMDISK,
 613                             NULL, NULL);
 614 }
 615
 616 /* Load a gzip-compressed kernel to a dynamically allocated buffer. */
 617 int load_image_gzipped_buffer(const char *filename, uint64_t max_sz,
 618                               uint8_t **buffer)
 619 {
 620     uint8_t *compressed_data = NULL;
 621     uint8_t *data = NULL;
 622     gsize len;
 623     ssize_t bytes;
 624     int ret = -1;
 625
 626     if (!g_file_get_contents(filename, (char **) &compressed_data, &len,
 627                              NULL)) {
 628         goto out;
 629     }
 630
 631     /* Is it a gzip-compressed file? */
 632     if (len < 2 ||
 633         compressed_data[0] != 0x1f ||
 634         compressed_data[1] != 0x8b) {
 635         goto out;
 636     }
 637
 638     if (max_sz > LOAD_IMAGE_MAX_GUNZIP_BYTES) {
 639         max_sz = LOAD_IMAGE_MAX_GUNZIP_BYTES;
 640     }
 641
 642     data = g_malloc(max_sz);
 643     bytes = gunzip(data, max_sz, compressed_data, len);
 644     if (bytes < 0) {
 645         fprintf(stderr, "%s: unable to decompress gzipped kernel file\n",
 646                 filename);
 647         goto out;
 648     }
 649
 650     /* trim to actual size and return to caller */
 651     *buffer = g_realloc(data, bytes);
 652     ret = bytes;
 653     /* ownership has been transferred to caller */
 654     data = NULL;
 655
 656  out:
 657     g_free(compressed_data);
 658     g_free(data);
 659     return ret;
 660 }
 661
 662 /* Load a gzip-compressed kernel. */
 663 int load_image_gzipped(const char *filename, hwaddr addr, uint64_t max_sz)
 664 {
 665     int bytes;
 666     uint8_t *data;
 667
 668     bytes = load_image_gzipped_buffer(filename, max_sz, &data);
 669     if (bytes != -1) {
 670         rom_add_blob_fixed(filename, data, bytes, addr);
 671         g_free(data);
 672     }
 673     return bytes;
 674 }
 675
 676 /*
 677  * Functions for reboot-persistent memory regions.
 678  *  - used for vga bios and option roms.
 679  *  - also linux kernel (-kernel / -initrd).
 680  */
 681
 682 typedef struct Rom Rom;
 683
 684 struct Rom {
 685     char *name;
 686     char *path;
 687
 688     /* datasize is the amount of memory allocated in "data". If datasize is less
 689      * than romsize, it means that the area from datasize to romsize is filled
 690      * with zeros.
 691      */
 692     size_t romsize;
 693     size_t datasize;
 694
 695     uint8_t *data;
 696     MemoryRegion *mr;
 697     int isrom;
 698     char *fw_dir;
 699     char *fw_file;
 700
 701     hwaddr addr;
 702     QTAILQ_ENTRY(Rom) next;
 703 };
 704
 705 static FWCfgState *fw_cfg;
 706 static QTAILQ_HEAD(, Rom) roms = QTAILQ_HEAD_INITIALIZER(roms);
 707
 708 static void rom_insert(Rom *rom)
 709 {
 710     Rom *item;
 711
 712     if (roms_loaded) {
 713         hw_error ("ROM images must be loaded at startup\n");
 714     }
 715
 716     /* list is ordered by load address */
 717     QTAILQ_FOREACH(item, &roms, next) {
 718         if (rom->addr >= item->addr)
 719             continue;
 720         QTAILQ_INSERT_BEFORE(item, rom, next);
 721         return;
 722     }
 723     QTAILQ_INSERT_TAIL(&roms, rom, next);
 724 }
 725
 726 static void fw_cfg_resized(const char *id, uint64_t length, void *host)
 727 {
 728     if (fw_cfg) {
 729         fw_cfg_modify_file(fw_cfg, id + strlen("/rom@"), host, length);
 730     }
 731 }
 732
 733 static void *rom_set_mr(Rom *rom, Object *owner, const char *name)
 734 {
 735     void *data;
 736
 737     rom->mr = g_malloc(sizeof(*rom->mr));
 738     memory_region_init_resizeable_ram(rom->mr, owner, name,
 739                                       rom->datasize, rom->romsize,
 740                                       fw_cfg_resized,
 741                                       &error_fatal);
 742     memory_region_set_readonly(rom->mr, true);
 743     vmstate_register_ram_global(rom->mr);
 744
 745     data = memory_region_get_ram_ptr(rom->mr);
 746     memcpy(data, rom->data, rom->datasize);
 747
 748     return data;
 749 }
 750
 751 int rom_add_file(const char *file, const char *fw_dir,
 752                  hwaddr addr, int32_t bootindex,
 753                  bool option_rom)
 754 {
 755     MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 756     Rom *rom;
 757     int rc, fd = -1;
 758     char devpath[100];
 759
 760     rom = g_malloc0(sizeof(*rom));
 761     rom->name = g_strdup(file);
 762     rom->path = qemu_find_file(QEMU_FILE_TYPE_BIOS, rom->name);
 763     if (rom->path == NULL) {
 764         rom->path = g_strdup(file);
 765     }
 766
 767     fd = open(rom->path, O_RDONLY | O_BINARY);
 768     if (fd == -1) {
 769         fprintf(stderr, "Could not open option rom '%s': %s\n",
 770                 rom->path, strerror(errno));
 771         goto err;
 772     }
 773
 774     if (fw_dir) {
 775         rom->fw_dir  = g_strdup(fw_dir);
 776         rom->fw_file = g_strdup(file);
 777     }
 778     rom->addr     = addr;
 779     rom->romsize  = lseek(fd, 0, SEEK_END);
 780     if (rom->romsize == -1) {
 781         fprintf(stderr, "rom: file %-20s: get size error: %s\n",
 782                 rom->name, strerror(errno));
 783         goto err;
 784     }
 785
 786     rom->datasize = rom->romsize;
 787     rom->data     = g_malloc0(rom->datasize);
 788     lseek(fd, 0, SEEK_SET);
 789     rc = read(fd, rom->data, rom->datasize);
 790     if (rc != rom->datasize) {
 791         fprintf(stderr, "rom: file %-20s: read error: rc=%d (expected %zd)\n",
 792                 rom->name, rc, rom->datasize);
 793         goto err;
 794     }
 795     close(fd);
 796     rom_insert(rom);
 797     if (rom->fw_file && fw_cfg) {
 798         const char *basename;
 799         char fw_file_name[FW_CFG_MAX_FILE_PATH];
 800         void *data;
 801
 802         basename = strrchr(rom->fw_file, '/');
 803         if (basename) {
 804             basename++;
 805         } else {
 806             basename = rom->fw_file;
 807         }
 808         snprintf(fw_file_name, sizeof(fw_file_name), "%s/%s", rom->fw_dir,
 809                  basename);
 810         snprintf(devpath, sizeof(devpath), "/rom@%s", fw_file_name);
 811
 812         if ((!option_rom || mc->option_rom_has_mr) && mc->rom_file_has_mr) {
 813             data = rom_set_mr(rom, OBJECT(fw_cfg), devpath);
 814         } else {
 815             data = rom->data;
 816         }
 817
 818         fw_cfg_add_file(fw_cfg, fw_file_name, data, rom->romsize);
 819     } else {
 820         snprintf(devpath, sizeof(devpath), "/rom@" TARGET_FMT_plx, addr);
 821     }
 822
 823     add_boot_device_path(bootindex, NULL, devpath);
 824     return 0;
 825
 826 err:
 827     if (fd != -1)
 828         close(fd);
 829     g_free(rom->data);
 830     g_free(rom->path);
 831     g_free(rom->name);
 832     g_free(rom);
 833     return -1;
 834 }
 835
 836 MemoryRegion *rom_add_blob(const char *name, const void *blob, size_t len,
 837                    size_t max_len, hwaddr addr, const char *fw_file_name,
 838                    FWCfgReadCallback fw_callback, void *callback_opaque)
 839 {
 840     MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
 841     Rom *rom;
 842     MemoryRegion *mr = NULL;
 843
 844     rom           = g_malloc0(sizeof(*rom));
 845     rom->name     = g_strdup(name);
 846     rom->addr     = addr;
 847     rom->romsize  = max_len ? max_len : len;
 848     rom->datasize = len;
 849     rom->data     = g_malloc0(rom->datasize);
 850     memcpy(rom->data, blob, len);
 851     rom_insert(rom);
 852     if (fw_file_name && fw_cfg) {
 853         char devpath[100];
 854         void *data;
 855
 856         snprintf(devpath, sizeof(devpath), "/rom@%s", fw_file_name);
 857
 858         if (mc->rom_file_has_mr) {
 859             data = rom_set_mr(rom, OBJECT(fw_cfg), devpath);
 860             mr = rom->mr;
 861         } else {
 862             data = rom->data;
 863         }
 864
 865         fw_cfg_add_file_callback(fw_cfg, fw_file_name,
 866                                  fw_callback, callback_opaque,
 867                                  data, rom->datasize);
 868     }
 869     return mr;
 870 }
 871
 872 /* This function is specific for elf program because we don't need to allocate
 873  * all the rom. We just allocate the first part and the rest is just zeros. This
 874  * is why romsize and datasize are different. Also, this function seize the
 875  * memory ownership of "data", so we don't have to allocate and copy the buffer.
 876  */
 877 int rom_add_elf_program(const char *name, void *data, size_t datasize,
 878                         size_t romsize, hwaddr addr)
 879 {
 880     Rom *rom;
 881
 882     rom           = g_malloc0(sizeof(*rom));
 883     rom->name     = g_strdup(name);
 884     rom->addr     = addr;
 885     rom->datasize = datasize;
 886     rom->romsize  = romsize;
 887     rom->data     = data;
 888     rom_insert(rom);
 889     return 0;
 890 }
 891
 892 int rom_add_vga(const char *file)
 893 {
 894     return rom_add_file(file, "vgaroms", 0, -1, true);
 895 }
 896
 897 int rom_add_option(const char *file, int32_t bootindex)
 898 {
 899     return rom_add_file(file, "genroms", 0, bootindex, true);
 900 }
 901
 902 static void rom_reset(void *unused)
 903 {
 904     Rom *rom;
 905
 906     QTAILQ_FOREACH(rom, &roms, next) {
 907         if (rom->fw_file) {
 908             continue;
 909         }
 910         if (rom->data == NULL) {
 911             continue;
 912         }
 913         if (rom->mr) {
 914             void *host = memory_region_get_ram_ptr(rom->mr);
 915             memcpy(host, rom->data, rom->datasize);
 916         } else {
 917             cpu_physical_memory_write_rom(&address_space_memory,
 918                                           rom->addr, rom->data, rom->datasize);
 919         }
 920         if (rom->isrom) {
 921             /* rom needs to be written only once */
 922             g_free(rom->data);
 923             rom->data = NULL;
 924         }
 925         /*
 926          * The rom loader is really on the same level as firmware in the guest
 927          * shadowing a ROM into RAM. Such a shadowing mechanism needs to ensure
 928          * that the instruction cache for that new region is clear, so that the
 929          * CPU definitely fetches its instructions from the just written data.
 930          */
 931         cpu_flush_icache_range(rom->addr, rom->datasize);
 932     }
 933 }
 934
 935 int rom_check_and_register_reset(void)
 936 {
 937     hwaddr addr = 0;
 938     MemoryRegionSection section;
 939     Rom *rom;
 940
 941     QTAILQ_FOREACH(rom, &roms, next) {
 942         if (rom->fw_file) {
 943             continue;
 944         }
 945         if (addr > rom->addr) {
 946             fprintf(stderr, "rom: requested regions overlap "
 947                     "(rom %s. free=0x" TARGET_FMT_plx
 948                     ", addr=0x" TARGET_FMT_plx ")\n",
 949                     rom->name, addr, rom->addr);
 950             return -1;
 951         }
 952         addr  = rom->addr;
 953         addr += rom->romsize;
 954         section = memory_region_find(get_system_memory(), rom->addr, 1);
 955         rom->isrom = int128_nz(section.size) && memory_region_is_rom(section.mr);
 956         memory_region_unref(section.mr);
 957     }
 958     qemu_register_reset(rom_reset, NULL);
 959     roms_loaded = 1;
 960     return 0;
 961 }
 962
 963 void rom_set_fw(FWCfgState *f)
 964 {
 965     fw_cfg = f;
 966 }
 967
 968 static Rom *find_rom(hwaddr addr)
 969 {
 970     Rom *rom;
 971
 972     QTAILQ_FOREACH(rom, &roms, next) {
 973         if (rom->fw_file) {
 974             continue;
 975         }
 976         if (rom->mr) {
 977             continue;
 978         }
 979         if (rom->addr > addr) {
 980             continue;
 981         }
 982         if (rom->addr + rom->romsize < addr) {
 983             continue;
 984         }
 985         return rom;
 986     }
 987     return NULL;
 988 }
 989
 990 /*
 991  * Copies memory from registered ROMs to dest. Any memory that is contained in
 992  * a ROM between addr and addr + size is copied. Note that this can involve
 993  * multiple ROMs, which need not start at addr and need not end at addr + size.
 994  */
 995 int rom_copy(uint8_t *dest, hwaddr addr, size_t size)
 996 {
 997     hwaddr end = addr + size;
 998     uint8_t *s, *d = dest;
 999     size_t l = 0;
1000     Rom *rom;
1001
1002     QTAILQ_FOREACH(rom, &roms, next) {
1003         if (rom->fw_file) {
1004             continue;
1005         }
1006         if (rom->mr) {
1007             continue;
1008         }
1009         if (rom->addr + rom->romsize < addr) {
1010             continue;
1011         }
1012         if (rom->addr > end) {
1013             break;
1014         }
1015
1016         d = dest + (rom->addr - addr);
1017         s = rom->data;
1018         l = rom->datasize;
1019
1020         if ((d + l) > (dest + size)) {
1021             l = dest - d;
1022         }
1023
1024         if (l > 0) {
1025             memcpy(d, s, l);
1026         }
1027
1028         if (rom->romsize > rom->datasize) {
1029             /* If datasize is less than romsize, it means that we didn't
1030              * allocate all the ROM because the trailing data are only zeros.
1031              */
1032
1033             d += l;
1034             l = rom->romsize - rom->datasize;
1035
1036             if ((d + l) > (dest + size)) {
1037                 /* Rom size doesn't fit in the destination area. Adjust to avoid
1038                  * overflow.
1039                  */
1040                 l = dest - d;
1041             }
1042
1043             if (l > 0) {
1044                 memset(d, 0x0, l);
1045             }
1046         }
1047     }
1048
1049     return (d + l) - dest;
1050 }
1051
1052 void *rom_ptr(hwaddr addr)
1053 {
1054     Rom *rom;
1055
1056     rom = find_rom(addr);
1057     if (!rom || !rom->data)
1058         return NULL;
1059     return rom->data + (addr - rom->addr);
1060 }
1061
1062 void hmp_info_roms(Monitor *mon, const QDict *qdict)
1063 {
1064     Rom *rom;
1065
1066     QTAILQ_FOREACH(rom, &roms, next) {
1067         if (rom->mr) {
1068             monitor_printf(mon, "%s"
1069                            " size=0x%06zx name=\"%s\"\n",
1070                            memory_region_name(rom->mr),
1071                            rom->romsize,
1072                            rom->name);
1073         } else if (!rom->fw_file) {
1074             monitor_printf(mon, "addr=" TARGET_FMT_plx
1075                            " size=0x%06zx mem=%s name=\"%s\"\n",
1076                            rom->addr, rom->romsize,
1077                            rom->isrom ? "rom" : "ram",
1078                            rom->name);
1079         } else {
1080             monitor_printf(mon, "fw=%s/%s"
1081                            " size=0x%06zx name=\"%s\"\n",
1082                            rom->fw_dir,
1083                            rom->fw_file,
1084                            rom->romsize,
1085                            rom->name);
1086         }
1087     }
1088 }