Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

since QEMU_CFG_NB_CPUS not going away anytime soon
and serves the same purpose as just added "etc/boot-cpus" fw_cfg
drop support for "etc/boot-cpus" while this code is not
in use yet (i.e. QEMU with "etc/boot-cpus" hasn't been released)
and reuse QEMU_CFG_NB_CPUS instead of it.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>

No code changes; just code movement.

Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

In the event of a failure in the low-level tpm12_get_capability()
code, just return an error code.  The caller can shutdown the TPM if
needed - the only place where that is needed is during a failure in
tpm12_determine_timeouts().

Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

No code changes; just code movement.

Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

…able()

The find_fadt() and find_tcpa_by_rsdp() functions are very similar.
Create a new find_acpi_table() function and replace the two functions
with this new function.

Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

Instead call tpmhw_transmit() directly.

Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

Instead of passing an arbitrary buffer as a parameter to
tpm_build_and_send_cmd(), just support the simpler case of a parameter
that is only 0, 1, or 2 bytes in length.  This allows the callers to
pass the parameter directly and not worry about the big-endian
encoding.  Rename the function to tpm_simple_cmd().

Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

The parameters for extending the PCRs of a TPM 2 are written in
big endian format when sent to the TPM. However, the log needs
to be written in little endian format, so we cannot just copy
the structure into the log as-is. To support the little endian
format in the log, we extend the function writing the TPM 2
digest structure with a parameter that allows us to choose the
endianess of a few parameters. We then rewrite the digest structure
in little endian format for the log.

Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>

Some chipsets have memory mapped serial ports. The protocol is the same
as an standard uart, but with memory read/write instead of inb/outb.

Tested-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com>
Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

If the HBA supports 64-bit addressing, the registers may contain
non-zero values, for example after reboot as a leftover from the
OS driving the adapter.

Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Ladi Prosek <lprosek@redhat.com>

You only want this information for debugging. As it also slows down the
boot considerably, as, for example, for every character of the GRUB
menu, something is sent over the serial console.

Therefore, increase the debugging level to 9.

Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>

If one of the ps2 ports is enabled prior to the ps2 controller reset
then it is possible a device event (eg, key press or mouse move) could
be mistaken for the controller reset response code.  This would result
in a failure and the keyboard would be disabled during the boot.
Always disabling the keyboard and mouse prior to reset ensures that
the controller reset return code can be read properly.

Tested-by: Paul Menzel <paulepanter@users.sourceforge.net>
Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

This patch enables SeaBIOS to boot from NVMe. Finding namespaces and
basic I/O works. Testing has been done in qemu and so far it works with
Grub, syslinux, and the FreeBSD loader. You need a recent Qemu (>=
2.7.0), because older versions have buggy NVMe support.

The NVMe code is currently only enabled on Qemu due to lack of testing
on real hardware.

Signed-off-by: Julian Stecklina <jsteckli@amazon.de>

This allows BIOS to write data back to QEMU using the DMA interface and
provides a higher-level abstraction to write to a fw_cfg file

Signed-off-by: Ben Warren <ben@skyportsystems.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>

This is a little cleaner and matches how the command structures are
defined in QEMU.

Signed-off-by: Ben Warren <ben@skyportsystems.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>

This command is similar to ADD_POINTER, but instead of patching
memory, it writes the pointer back to QEMU over the DMA interface.

Signed-off-by: Ben Warren <ben@skyportsystems.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>

Due to memory contraints, when resuming from S3 the fw_cfg "files" API
isn't available.  This adds a simple API to get a file 'key', and to
write to the file using the key as a reference.

Signed-off-by: Ben Warren <ben@skyportsystems.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>

Any pointers to BIOS-allocated memory that were written back to QEMU
fw_cfg files are replayed when resuming from S3 sleep.

Signed-off-by: Ben Warren <ben@skyportsystems.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

Rather than using the Identify command with CNS 01b (GET_NS_LIST), which
was added in NVMe 1.1, we can just enumerate all of the possible
namespace IDs.

The relevant part of the NVMe spec reads:

  Namespaces shall be allocated in order (starting with 1) and packed
  sequentially.

Since the previously-used GET_NS_LIST only returns active namespaces, we
also need a check in nvme_probe_ns() to ensure that inactive namespaces
are not reported as boot devices.  This can be accomplished by checking
for non-zero block count - the spec indicates that Identify Namespace
for an inactive namespace ID will return all zeroes.

This should have no impact on the QEMU NVMe device model, since it
always reports exactly one namespace (NSID 1).

Signed-off-by: Daniel Verkamp <daniel@drv.nu>

500 ms is not sufficient for the admin commands used during
initialization on some real hardware.

Signed-off-by: Daniel Verkamp <daniel@drv.nu>

It looks like the intent was to exit the loop if a command failed, but
the current code would actually continue looping in that case.

Signed-off-by: Daniel Verkamp <daniel@drv.nu>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

The status code field is 8 bits wide starting at bit 1; the previous
code would truncate the top bit.

Signed-off-by: Daniel Verkamp <daniel@drv.nu>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Daniel Verkamp <daniel@drv.nu>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

On QEMU it's necessary to manually reset the BIOS memory region
between 0xc0000-0x100000 on a reboot.  After this manual memory reset
is completed, it's not valid to use the generic reset mechanisms.
Rename qemu_prep_reset() to qemu_reboot() and change the function to
immediately reboot after the code memcpy.

This fixes a bug that could cause code corruption on reboots - calling
the udelay() function (as invoked by i8042_reboot and/or pci_reboot)
was not valid after the BIOS was memcpy'd.

Reported-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
Tested-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

It was found qemu_get_present_cpus_count may return impossible
number of cpus because of not checking if fw_cfg exists before
using it. That may lead to undefined behavior of emulator,
in particular Bochs that freezes.

Signed-off-by: Petr Berky <petr.berky@email.cz>

coreboot's CBMEM console format changed with
https://review.coreboot.org/#/c/18301. This patch adapts the SeaBIOS
implementation to support the new format. (SeaBIOS versions with this
patch will continue to work fine with older version of coreboot. SeaBIOS
versions without this patch may fail to log messages to the CBMEM
console if run with newer versions of coreboot, but should not
experience any more serious issues than that.)

Signed-off-by: Julius Werner <jwerner@chromium.org>

Increase the boot menu description size so that menu items up to 80
characters display without truncation.

Reported-by: Rene Shuster <rene.shuster@bcsemail.org>
Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

Luns that report to INQUIRY with a type other than CD-ROM are considered
disks.  This isn't necessarily the case; working with such luns as disks
may lead to unpredictable results.

So bail out if the lun is neither CD-ROM nor disk.

Signed-off-by: Roman Kagan <rkagan@virtuozzo.com>

Add two generic functions to discover active LUNs on a SCSI target.

The functions take a temporary drive descriptor on the target, and a
callback to create a new drive descriptor with a new LUN using the
temporary one as a template.

One of the functions performs REPORT LUNS on the temporary drive to
obtain the list of candidate luns; the other sequentially iterates the
lun numbers up to the given maximum, and is meant as a fallback.  Both
functions return the number of successfully created drive descriptors,
or a negative number if an error occured.

This will allow to lift the limitation of most of the SCSI drivers that
support booting off the LUN #0 only.

Signed-off-by: Roman Kagan <rkagan@virtuozzo.com>

Signed-off-by: Roman Kagan <rkagan@virtuozzo.com>

Signed-off-by: Roman Kagan <rkagan@virtuozzo.com>

Signed-off-by: Roman Kagan <rkagan@virtuozzo.com>

The comment in pvscsi_scan_target (presumably c&p-ed from another
driver) reads that REPORTS LUNS should better be used to enumerate the
luns on the target.

However, according to the Linux driver, the device supports no more than
a single lun per target.

So adjust the comment to tell exactly that.

Signed-off-by: Roman Kagan <rkagan@virtuozzo.com>

Enumerate active luns with REPORT LUNS and, if that fails[*], fall back
to sequentially enumerating them up to (arbitrarily chosen) #8.

Note that this patch also makes mpt_scsi_cmd accept luns other than 0;
I've no idea what was the original motivation not to, and what can break
due to this change (nothing broke in my basic tests with QEMU).

[*] in current QEMU, REPORT LUNS does fail in mptsas1068 because the
returned data is smaller than the allocation length which is (wrongly)
considered an underflow.

Signed-off-by: Roman Kagan <rkagan@virtuozzo.com>

When the device reports a serious problem via SIST[01] registers, it
needs to be reset, otherwise the following requests will most likely
fail, too.

In particular, REPORT LUNS which fails (wrongly) with underflow in QEMU
makes all the following requests fail, too, rendering the device
unusable.

Signed-off-by: Roman Kagan <rkagan@virtuozzo.com>

Enumerate active luns with REPORT LUNS and, if that fails[*], fall back
to sequentially enumerating them up to (arbitrarily chosen) #8 [**].

[*] in current QEMU, REPORT LUNS does fail in lsi53c895a because the
returned data is smaller than the allocation length which is (wrongly)
considered an underflow

[**] in current QEMU, luns above 0 are not supported in lsi53c895a, so
this patch is here only for completeness.

Signed-off-by: Roman Kagan <rkagan@virtuozzo.com>

Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

A couple of users have reported success with the NVMe driver on real
hardware, so allow it to be enabled outside of QEMU.

Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

QEMU does not store the A20 setting in the SMM cpu environment area
(and it does not look like real CPUs do either).  So, manually backup
and restore A20 on a mode switch.

Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

Initialize the Call16Data at startup - otherwise some early yield()
calls may check for interrupts without using the preferred A20
setting.

Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

The A20 setting is almost always enabled - only issue an outb() if the
A20 is actually changing.  This reduces the number of outb() calls.

Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

Don't write to the cmos index port on a mode switch if NMI is already
disabled.  This reduces the number of outb() calls.

Signed-off-by: Kevin O'Connor <kevin@koconnor.net>

A number of emulated SCSI devices in QEMU incorrectly return an error
to REPORT_LUNS command when the size of the data returned is smaller
than the allocation length passed in.

To work it around, start with the smallest allocation length possible:
for 1 entry.  This is a slight pessimization because it would require
another REPORT_LUNS iteration if the target has more than a single LUN,
but this appears to have negligible impact on boot times, and makes
REPORT_LUNS enumeration work for more QEMU devices (lsi53c895a,
mptsas1068).

Reported-by: Maciej Józefczyk <maciej.jozefczyk@corp.ovh.com>
Signed-off-by: Roman Kagan <rkagan@virtuozzo.com>

This reverts commit 1127784.

It was originally introduced to deal with the case when REPORT_LUNS
caused an error in QEMU implementation of lsi53c895a and left it in a
"confused" state making further interaction impossible.

However the remedy was worse than the disease: the reset was
controller-wide causing all luns to reset, losing all in-flight requests;
upon that all luns lit up unit_attention condition, so that any
non-informational request would fail with check_condition status.  As a
result, the lun enumeration succeeded and I saw the respective entries
in the boot menu during my testing, but the read from those luns ended
with an error and booting failed, which I didn't bother to test.

So this reverts to the original error handling behavior.  The problem
with the failing REPORT_LUNS is addressed in the preceding patch, by
making it unlikely to fail.

Reported-by: Maciej Józefczyk <maciej.jozefczyk@corp.ovh.com>
Signed-off-by: Roman Kagan <rkagan@virtuozzo.com>

Accumulate the pixel format's bits instead relying on coreboot's
bits_per_pixel, which says nothing about the active pixel format.

Allows VBE to correctly advertise XRGB8 and BGRX8 framebuffer formats,
commonly used by coreboot.

Fixes at least Windows Bootloader and gfxboot.

Signed-off-by: Patrick Rudolph <siro@das-labor.org>

Query the driver for the real scanline pitch in bytes.

As cbvga doesn't change the pitch on mode change, always
return the same pitch, that might exceed width times Bytes-per-pixel.

Report the default stdvga pitch for all other drivers.

Signed-off-by: Patrick Rudolph <siro@das-labor.org>

As coreboot framebuffer is immutable always use CBmodeinfo.

Signed-off-by: Patrick Rudolph <siro@das-labor.org>

Advertise compatible VESA modes, that are smaller or equal to
coreboot's active framebuffer. Only modes that have the same Bpp
are advertise and can be selected.

Allows the Windows 7 bootloader NTLDR to show up in VESA mode.
Allows to show the Windows 7 boot logo.
Allows Windows to boot in safe mode and in normal boot using
VgaSave driver with resolution up to 1600x1200.

This fixes most likely other bootloader and operating systems as well,
in case the are relying on VESA framebuffer support.

Signed-off-by: Patrick Rudolph <siro@das-labor.org>