1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2021 Beckhoff Automation GmbH & Co. KG 5 * Author: Corvin Köhne <c.koehne@beckhoff.com> 6 */ 7 8 #include <sys/param.h> 9 #include <sys/endian.h> 10 #include <sys/queue.h> 11 #include <sys/stat.h> 12 13 #include <machine/vmm.h> 14 15 #include <err.h> 16 #include <errno.h> 17 #include <fcntl.h> 18 #include <stdio.h> 19 #include <stdlib.h> 20 #include <string.h> 21 #include <unistd.h> 22 23 #include "acpi_device.h" 24 #include "bhyverun.h" 25 #include "inout.h" 26 #include "pci_lpc.h" 27 #include "qemu_fwcfg.h" 28 29 #define QEMU_FWCFG_ACPI_DEVICE_NAME "FWCF" 30 #define QEMU_FWCFG_ACPI_HARDWARE_ID "QEMU0002" 31 32 #define QEMU_FWCFG_SELECTOR_PORT_NUMBER 0x510 33 #define QEMU_FWCFG_SELECTOR_PORT_SIZE 1 34 #define QEMU_FWCFG_SELECTOR_PORT_FLAGS IOPORT_F_INOUT 35 #define QEMU_FWCFG_DATA_PORT_NUMBER 0x511 36 #define QEMU_FWCFG_DATA_PORT_SIZE 1 37 #define QEMU_FWCFG_DATA_PORT_FLAGS \ 38 IOPORT_F_INOUT /* QEMU v2.4+ ignores writes */ 39 40 #define QEMU_FWCFG_ARCHITECTURE_MASK 0x0001 41 #define QEMU_FWCFG_INDEX_MASK 0x3FFF 42 43 #define QEMU_FWCFG_SELECT_READ 0 44 #define QEMU_FWCFG_SELECT_WRITE 1 45 46 #define QEMU_FWCFG_ARCHITECTURE_GENERIC 0 47 #define QEMU_FWCFG_ARCHITECTURE_SPECIFIC 1 48 49 #define QEMU_FWCFG_INDEX_SIGNATURE 0x00 50 #define QEMU_FWCFG_INDEX_ID 0x01 51 #define QEMU_FWCFG_INDEX_NB_CPUS 0x05 52 #define QEMU_FWCFG_INDEX_MAX_CPUS 0x0F 53 #define QEMU_FWCFG_INDEX_FILE_DIR 0x19 54 55 #define QEMU_FWCFG_FIRST_FILE_INDEX 0x20 56 57 #define QEMU_FWCFG_MIN_FILES 10 58 59 #pragma pack(1) 60 61 union qemu_fwcfg_selector { 62 struct { 63 uint16_t index : 14; 64 uint16_t writeable : 1; 65 uint16_t architecture : 1; 66 }; 67 uint16_t bits; 68 }; 69 70 struct qemu_fwcfg_signature { 71 uint8_t signature[4]; 72 }; 73 74 struct qemu_fwcfg_id { 75 uint32_t interface : 1; /* always set */ 76 uint32_t DMA : 1; 77 uint32_t reserved : 30; 78 }; 79 80 struct qemu_fwcfg_file { 81 uint32_t be_size; 82 uint16_t be_selector; 83 uint16_t reserved; 84 uint8_t name[QEMU_FWCFG_MAX_NAME]; 85 }; 86 87 struct qemu_fwcfg_directory { 88 uint32_t be_count; 89 struct qemu_fwcfg_file files[0]; 90 }; 91 92 #pragma pack() 93 94 struct qemu_fwcfg_softc { 95 struct acpi_device *acpi_dev; 96 97 uint32_t data_offset; 98 union qemu_fwcfg_selector selector; 99 struct qemu_fwcfg_item items[QEMU_FWCFG_MAX_ARCHS] 100 [QEMU_FWCFG_MAX_ENTRIES]; 101 struct qemu_fwcfg_directory *directory; 102 }; 103 104 static struct qemu_fwcfg_softc fwcfg_sc; 105 106 struct qemu_fwcfg_user_file { 107 STAILQ_ENTRY(qemu_fwcfg_user_file) chain; 108 uint8_t name[QEMU_FWCFG_MAX_NAME]; 109 uint32_t size; 110 void *data; 111 }; 112 static STAILQ_HEAD(qemu_fwcfg_user_file_list, 113 qemu_fwcfg_user_file) user_files = STAILQ_HEAD_INITIALIZER(user_files); 114 115 static int 116 qemu_fwcfg_selector_port_handler(struct vmctx *const ctx __unused, const int in, 117 const int port __unused, const int bytes, uint32_t *const eax, 118 void *const arg __unused) 119 { 120 if (bytes != sizeof(uint16_t)) { 121 warnx("%s: invalid size (%d) of IO port access", __func__, 122 bytes); 123 return (-1); 124 } 125 126 if (in) { 127 *eax = htole16(fwcfg_sc.selector.bits); 128 return (0); 129 } 130 131 fwcfg_sc.data_offset = 0; 132 fwcfg_sc.selector.bits = le16toh(*eax); 133 134 return (0); 135 } 136 137 static int 138 qemu_fwcfg_data_port_handler(struct vmctx *const ctx __unused, const int in, 139 const int port __unused, const int bytes, uint32_t *const eax, 140 void *const arg __unused) 141 { 142 if (bytes != sizeof(uint8_t)) { 143 warnx("%s: invalid size (%d) of IO port access", __func__, 144 bytes); 145 return (-1); 146 } 147 148 if (!in) { 149 warnx("%s: Writes to qemu fwcfg data port aren't allowed", 150 __func__); 151 return (-1); 152 } 153 154 /* get fwcfg item */ 155 struct qemu_fwcfg_item *const item = 156 &fwcfg_sc.items[fwcfg_sc.selector.architecture] 157 [fwcfg_sc.selector.index]; 158 if (item->data == NULL) { 159 warnx( 160 "%s: qemu fwcfg item doesn't exist (architecture %s index 0x%x)", 161 __func__, 162 fwcfg_sc.selector.architecture ? "specific" : "generic", 163 fwcfg_sc.selector.index); 164 *eax = 0x00; 165 return (0); 166 } else if (fwcfg_sc.data_offset >= item->size) { 167 warnx( 168 "%s: qemu fwcfg item read exceeds size (architecture %s index 0x%x size 0x%x offset 0x%x)", 169 __func__, 170 fwcfg_sc.selector.architecture ? "specific" : "generic", 171 fwcfg_sc.selector.index, item->size, fwcfg_sc.data_offset); 172 *eax = 0x00; 173 return (0); 174 } 175 176 /* return item data */ 177 *eax = item->data[fwcfg_sc.data_offset]; 178 fwcfg_sc.data_offset++; 179 180 return (0); 181 } 182 183 static int 184 qemu_fwcfg_add_item(const uint16_t architecture, const uint16_t index, 185 const uint32_t size, void *const data) 186 { 187 /* truncate architecture and index to their desired size */ 188 const uint16_t arch = architecture & QEMU_FWCFG_ARCHITECTURE_MASK; 189 const uint16_t idx = index & QEMU_FWCFG_INDEX_MASK; 190 191 /* get pointer to item specified by selector */ 192 struct qemu_fwcfg_item *const fwcfg_item = &fwcfg_sc.items[arch][idx]; 193 194 /* check if item is already used */ 195 if (fwcfg_item->data != NULL) { 196 warnx("%s: qemu fwcfg item exists (architecture %s index 0x%x)", 197 __func__, arch ? "specific" : "generic", idx); 198 return (EEXIST); 199 } 200 201 /* save data of the item */ 202 fwcfg_item->size = size; 203 fwcfg_item->data = data; 204 205 return (0); 206 } 207 208 static int 209 qemu_fwcfg_add_item_file_dir(void) 210 { 211 const size_t size = sizeof(struct qemu_fwcfg_directory) + 212 QEMU_FWCFG_MIN_FILES * sizeof(struct qemu_fwcfg_file); 213 struct qemu_fwcfg_directory *const fwcfg_directory = calloc(1, size); 214 if (fwcfg_directory == NULL) { 215 return (ENOMEM); 216 } 217 218 fwcfg_sc.directory = fwcfg_directory; 219 220 return (qemu_fwcfg_add_item(QEMU_FWCFG_ARCHITECTURE_GENERIC, 221 QEMU_FWCFG_INDEX_FILE_DIR, sizeof(struct qemu_fwcfg_directory), 222 (uint8_t *)fwcfg_sc.directory)); 223 } 224 225 static int 226 qemu_fwcfg_add_item_id(void) 227 { 228 struct qemu_fwcfg_id *const fwcfg_id = calloc(1, 229 sizeof(struct qemu_fwcfg_id)); 230 if (fwcfg_id == NULL) { 231 return (ENOMEM); 232 } 233 234 fwcfg_id->interface = 1; 235 fwcfg_id->DMA = 0; 236 237 uint32_t *const le_fwcfg_id_ptr = (uint32_t *)fwcfg_id; 238 *le_fwcfg_id_ptr = htole32(*le_fwcfg_id_ptr); 239 240 return (qemu_fwcfg_add_item(QEMU_FWCFG_ARCHITECTURE_GENERIC, 241 QEMU_FWCFG_INDEX_ID, sizeof(struct qemu_fwcfg_id), 242 (uint8_t *)fwcfg_id)); 243 } 244 245 static int 246 qemu_fwcfg_add_item_max_cpus(void) 247 { 248 uint16_t *fwcfg_max_cpus = calloc(1, sizeof(uint16_t)); 249 if (fwcfg_max_cpus == NULL) { 250 return (ENOMEM); 251 } 252 253 /* 254 * We don't support cpu hotplug yet. For that reason, use guest_ncpus instead 255 * of maxcpus. 256 */ 257 *fwcfg_max_cpus = htole16(guest_ncpus); 258 259 return (qemu_fwcfg_add_item(QEMU_FWCFG_ARCHITECTURE_GENERIC, 260 QEMU_FWCFG_INDEX_MAX_CPUS, sizeof(uint16_t), fwcfg_max_cpus)); 261 } 262 263 static int 264 qemu_fwcfg_add_item_nb_cpus(void) 265 { 266 uint16_t *fwcfg_max_cpus = calloc(1, sizeof(uint16_t)); 267 if (fwcfg_max_cpus == NULL) { 268 return (ENOMEM); 269 } 270 271 *fwcfg_max_cpus = htole16(guest_ncpus); 272 273 return (qemu_fwcfg_add_item(QEMU_FWCFG_ARCHITECTURE_GENERIC, 274 QEMU_FWCFG_INDEX_NB_CPUS, sizeof(uint16_t), fwcfg_max_cpus)); 275 } 276 277 static int 278 qemu_fwcfg_add_item_signature(void) 279 { 280 struct qemu_fwcfg_signature *const fwcfg_signature = calloc(1, 281 sizeof(struct qemu_fwcfg_signature)); 282 if (fwcfg_signature == NULL) { 283 return (ENOMEM); 284 } 285 286 fwcfg_signature->signature[0] = 'Q'; 287 fwcfg_signature->signature[1] = 'E'; 288 fwcfg_signature->signature[2] = 'M'; 289 fwcfg_signature->signature[3] = 'U'; 290 291 return (qemu_fwcfg_add_item(QEMU_FWCFG_ARCHITECTURE_GENERIC, 292 QEMU_FWCFG_INDEX_SIGNATURE, sizeof(struct qemu_fwcfg_signature), 293 (uint8_t *)fwcfg_signature)); 294 } 295 296 static int 297 qemu_fwcfg_register_port(const char *const name, const int port, const int size, 298 const int flags, const inout_func_t handler) 299 { 300 struct inout_port iop; 301 302 bzero(&iop, sizeof(iop)); 303 iop.name = name; 304 iop.port = port; 305 iop.size = size; 306 iop.flags = flags; 307 iop.handler = handler; 308 309 return (register_inout(&iop)); 310 } 311 312 int 313 qemu_fwcfg_add_file(const char *name, const uint32_t size, void *const data) 314 { 315 if (strlen(name) >= QEMU_FWCFG_MAX_NAME) 316 return (EINVAL); 317 318 /* 319 * QEMU specifies count as big endian. 320 * Convert it to host endian to work with it. 321 */ 322 const uint32_t count = be32toh(fwcfg_sc.directory->be_count) + 1; 323 324 /* add file to items list */ 325 const uint32_t index = QEMU_FWCFG_FIRST_FILE_INDEX + count - 1; 326 const int error = qemu_fwcfg_add_item(QEMU_FWCFG_ARCHITECTURE_GENERIC, 327 index, size, data); 328 if (error != 0) { 329 return (error); 330 } 331 332 /* 333 * files should be sorted alphabetical, get index for new file 334 */ 335 uint32_t file_index; 336 for (file_index = 0; file_index < count - 1; ++file_index) { 337 if (strcmp(name, fwcfg_sc.directory->files[file_index].name) < 338 0) 339 break; 340 } 341 342 if (count > QEMU_FWCFG_MIN_FILES) { 343 /* alloc new file directory */ 344 const uint64_t new_size = sizeof(struct qemu_fwcfg_directory) + 345 count * sizeof(struct qemu_fwcfg_file); 346 struct qemu_fwcfg_directory *const new_directory = calloc(1, 347 new_size); 348 if (new_directory == NULL) { 349 warnx( 350 "%s: Unable to allocate a new qemu fwcfg files directory (count %d)", 351 __func__, count); 352 return (ENOMEM); 353 } 354 355 /* copy files below file_index to new directory */ 356 memcpy(new_directory->files, fwcfg_sc.directory->files, 357 file_index * sizeof(struct qemu_fwcfg_file)); 358 359 /* copy files above file_index to directory */ 360 memcpy(&new_directory->files[file_index + 1], 361 &fwcfg_sc.directory->files[file_index], 362 (count - file_index) * sizeof(struct qemu_fwcfg_file)); 363 364 /* free old directory */ 365 free(fwcfg_sc.directory); 366 367 /* set directory pointer to new directory */ 368 fwcfg_sc.directory = new_directory; 369 370 /* adjust directory pointer */ 371 fwcfg_sc.items[0][QEMU_FWCFG_INDEX_FILE_DIR].data = 372 (uint8_t *)fwcfg_sc.directory; 373 } else { 374 /* shift files behind file_index */ 375 for (uint32_t i = QEMU_FWCFG_MIN_FILES - 1; i > file_index; 376 --i) { 377 memcpy(&fwcfg_sc.directory->files[i], 378 &fwcfg_sc.directory->files[i - 1], 379 sizeof(struct qemu_fwcfg_file)); 380 } 381 } 382 383 /* 384 * QEMU specifies count, size and index as big endian. 385 * Save these values in big endian to simplify guest reads of these 386 * values. 387 */ 388 fwcfg_sc.directory->be_count = htobe32(count); 389 fwcfg_sc.directory->files[file_index].be_size = htobe32(size); 390 fwcfg_sc.directory->files[file_index].be_selector = htobe16(index); 391 strcpy(fwcfg_sc.directory->files[file_index].name, name); 392 393 /* set new size for the fwcfg_file_directory */ 394 fwcfg_sc.items[0][QEMU_FWCFG_INDEX_FILE_DIR].size = 395 sizeof(struct qemu_fwcfg_directory) + 396 count * sizeof(struct qemu_fwcfg_file); 397 398 return (0); 399 } 400 401 static int 402 qemu_fwcfg_add_user_files(void) 403 { 404 const struct qemu_fwcfg_user_file *fwcfg_file; 405 int error; 406 407 STAILQ_FOREACH(fwcfg_file, &user_files, chain) { 408 error = qemu_fwcfg_add_file(fwcfg_file->name, fwcfg_file->size, 409 fwcfg_file->data); 410 if (error) 411 return (error); 412 } 413 414 return (0); 415 } 416 417 static const struct acpi_device_emul qemu_fwcfg_acpi_device_emul = { 418 .name = QEMU_FWCFG_ACPI_DEVICE_NAME, 419 .hid = QEMU_FWCFG_ACPI_HARDWARE_ID, 420 }; 421 422 int 423 qemu_fwcfg_init(struct vmctx *const ctx) 424 { 425 int error; 426 427 /* 428 * Bhyve supports fwctl (bhyve) and fwcfg (qemu) as firmware interfaces. 429 * Both are using the same ports. So, it's not possible to provide both 430 * interfaces at the same time to the guest. Therefore, only create acpi 431 * tables and register io ports for fwcfg, if it's used. 432 */ 433 if (strcmp(lpc_fwcfg(), "qemu") == 0) { 434 error = acpi_device_create(&fwcfg_sc.acpi_dev, &fwcfg_sc, ctx, 435 &qemu_fwcfg_acpi_device_emul); 436 if (error) { 437 warnx("%s: failed to create ACPI device for QEMU FwCfg", 438 __func__); 439 goto done; 440 } 441 442 error = acpi_device_add_res_fixed_ioport(fwcfg_sc.acpi_dev, 443 QEMU_FWCFG_SELECTOR_PORT_NUMBER, 2); 444 if (error) { 445 warnx("%s: failed to add fixed IO port for QEMU FwCfg", 446 __func__); 447 goto done; 448 } 449 450 /* add handlers for fwcfg ports */ 451 if ((error = qemu_fwcfg_register_port("qemu_fwcfg_selector", 452 QEMU_FWCFG_SELECTOR_PORT_NUMBER, 453 QEMU_FWCFG_SELECTOR_PORT_SIZE, 454 QEMU_FWCFG_SELECTOR_PORT_FLAGS, 455 qemu_fwcfg_selector_port_handler)) != 0) { 456 warnx( 457 "%s: Unable to register qemu fwcfg selector port 0x%x", 458 __func__, QEMU_FWCFG_SELECTOR_PORT_NUMBER); 459 goto done; 460 } 461 if ((error = qemu_fwcfg_register_port("qemu_fwcfg_data", 462 QEMU_FWCFG_DATA_PORT_NUMBER, QEMU_FWCFG_DATA_PORT_SIZE, 463 QEMU_FWCFG_DATA_PORT_FLAGS, 464 qemu_fwcfg_data_port_handler)) != 0) { 465 warnx( 466 "%s: Unable to register qemu fwcfg data port 0x%x", 467 __func__, QEMU_FWCFG_DATA_PORT_NUMBER); 468 goto done; 469 } 470 } 471 472 /* add common fwcfg items */ 473 if ((error = qemu_fwcfg_add_item_signature()) != 0) { 474 warnx("%s: Unable to add signature item", __func__); 475 goto done; 476 } 477 if ((error = qemu_fwcfg_add_item_id()) != 0) { 478 warnx("%s: Unable to add id item", __func__); 479 goto done; 480 } 481 if ((error = qemu_fwcfg_add_item_nb_cpus()) != 0) { 482 warnx("%s: Unable to add nb_cpus item", __func__); 483 goto done; 484 } 485 if ((error = qemu_fwcfg_add_item_max_cpus()) != 0) { 486 warnx("%s: Unable to add max_cpus item", __func__); 487 goto done; 488 } 489 if ((error = qemu_fwcfg_add_item_file_dir()) != 0) { 490 warnx("%s: Unable to add file_dir item", __func__); 491 } 492 493 /* add user defined fwcfg files */ 494 if ((error = qemu_fwcfg_add_user_files()) != 0) { 495 warnx("%s: Unable to add user files", __func__); 496 goto done; 497 } 498 499 done: 500 if (error) { 501 acpi_device_destroy(fwcfg_sc.acpi_dev); 502 } 503 504 return (error); 505 } 506 507 static void 508 qemu_fwcfg_usage(const char *opt) 509 { 510 warnx("Invalid fw_cfg option \"%s\"", opt); 511 warnx("-f [name=]<name>,(string|file)=<value>"); 512 } 513 514 /* 515 * Parses the cmdline argument for user defined fw_cfg items. The cmdline 516 * argument has the format: 517 * "-f [name=]<name>,(string|file)=<value>" 518 * 519 * E.g.: "-f opt/com.page/example,string=Hello" 520 */ 521 int 522 qemu_fwcfg_parse_cmdline_arg(const char *opt) 523 { 524 struct qemu_fwcfg_user_file *fwcfg_file; 525 struct stat sb; 526 const char *opt_ptr, *opt_end; 527 int fd; 528 529 fwcfg_file = malloc(sizeof(*fwcfg_file)); 530 if (fwcfg_file == NULL) { 531 warnx("Unable to allocate fw_cfg_user_file"); 532 return (ENOMEM); 533 } 534 535 /* get pointer to <name> */ 536 opt_ptr = opt; 537 /* If [name=] is specified, skip it */ 538 if (strncmp(opt_ptr, "name=", sizeof("name=") - 1) == 0) { 539 opt_ptr += sizeof("name=") - 1; 540 } 541 542 /* get the end of <name> */ 543 opt_end = strchr(opt_ptr, ','); 544 if (opt_end == NULL) { 545 qemu_fwcfg_usage(opt); 546 return (EINVAL); 547 } 548 549 /* check if <name> is too long */ 550 if (opt_end - opt_ptr >= QEMU_FWCFG_MAX_NAME) { 551 warnx("fw_cfg name too long: \"%s\"", opt); 552 return (EINVAL); 553 } 554 555 /* save <name> */ 556 strncpy(fwcfg_file->name, opt_ptr, opt_end - opt_ptr); 557 fwcfg_file->name[opt_end - opt_ptr] = '\0'; 558 559 /* set opt_ptr and opt_end to <value> */ 560 opt_ptr = opt_end + 1; 561 opt_end = opt_ptr + strlen(opt_ptr); 562 563 if (strncmp(opt_ptr, "string=", sizeof("string=") - 1) == 0) { 564 opt_ptr += sizeof("string=") - 1; 565 fwcfg_file->data = strdup(opt_ptr); 566 if (fwcfg_file->data == NULL) { 567 warnx("Can't duplicate fw_cfg_user_file string \"%s\"", 568 opt_ptr); 569 return (ENOMEM); 570 } 571 fwcfg_file->size = strlen(opt_ptr) + 1; 572 } else if (strncmp(opt_ptr, "file=", sizeof("file=") - 1) == 0) { 573 opt_ptr += sizeof("file=") - 1; 574 575 fd = open(opt_ptr, O_RDONLY); 576 if (fd < 0) { 577 warn("Can't open fw_cfg_user_file file \"%s\"", 578 opt_ptr); 579 return (EINVAL); 580 } 581 582 if (fstat(fd, &sb) < 0) { 583 warn("Unable to get size of file \"%s\"", opt_ptr); 584 close(fd); 585 return (-1); 586 } 587 588 fwcfg_file->data = malloc(sb.st_size); 589 if (fwcfg_file->data == NULL) { 590 warnx( 591 "Can't allocate fw_cfg_user_file file \"%s\" (size: 0x%16lx)", 592 opt_ptr, sb.st_size); 593 close(fd); 594 return (ENOMEM); 595 } 596 fwcfg_file->size = read(fd, fwcfg_file->data, sb.st_size); 597 if ((ssize_t)fwcfg_file->size < 0) { 598 warn("Unable to read file \"%s\"", opt_ptr); 599 free(fwcfg_file->data); 600 close(fd); 601 return (-1); 602 } else if (fwcfg_file->size < sb.st_size) { 603 warnx("Only read %u bytes of file \"%s\"", 604 fwcfg_file->size, opt_ptr); 605 } 606 607 close(fd); 608 } else { 609 qemu_fwcfg_usage(opt); 610 return (EINVAL); 611 } 612 613 STAILQ_INSERT_TAIL(&user_files, fwcfg_file, chain); 614 615 return (0); 616 } 617