+STATIC UINT16 mQ35TsegMbytes;\r
+\r
+UINT32 mQemuUc32Base;\r
+\r
+VOID\r
+Q35TsegMbytesInitialization (\r
+ VOID\r
+ )\r
+{\r
+ UINT16 ExtendedTsegMbytes;\r
+ RETURN_STATUS PcdStatus;\r
+\r
+ if (mHostBridgeDevId != INTEL_Q35_MCH_DEVICE_ID) {\r
+ DEBUG ((\r
+ DEBUG_ERROR,\r
+ "%a: no TSEG (SMRAM) on host bridge DID=0x%04x; "\r
+ "only DID=0x%04x (Q35) is supported\n",\r
+ __FUNCTION__,\r
+ mHostBridgeDevId,\r
+ INTEL_Q35_MCH_DEVICE_ID\r
+ ));\r
+ ASSERT (FALSE);\r
+ CpuDeadLoop ();\r
+ }\r
+\r
+ //\r
+ // Check if QEMU offers an extended TSEG.\r
+ //\r
+ // This can be seen from writing MCH_EXT_TSEG_MB_QUERY to the MCH_EXT_TSEG_MB\r
+ // register, and reading back the register.\r
+ //\r
+ // On a QEMU machine type that does not offer an extended TSEG, the initial\r
+ // write overwrites whatever value a malicious guest OS may have placed in\r
+ // the (unimplemented) register, before entering S3 or rebooting.\r
+ // Subsequently, the read returns MCH_EXT_TSEG_MB_QUERY unchanged.\r
+ //\r
+ // On a QEMU machine type that offers an extended TSEG, the initial write\r
+ // triggers an update to the register. Subsequently, the value read back\r
+ // (which is guaranteed to differ from MCH_EXT_TSEG_MB_QUERY) tells us the\r
+ // number of megabytes.\r
+ //\r
+ PciWrite16 (DRAMC_REGISTER_Q35 (MCH_EXT_TSEG_MB), MCH_EXT_TSEG_MB_QUERY);\r
+ ExtendedTsegMbytes = PciRead16 (DRAMC_REGISTER_Q35 (MCH_EXT_TSEG_MB));\r
+ if (ExtendedTsegMbytes == MCH_EXT_TSEG_MB_QUERY) {\r
+ mQ35TsegMbytes = PcdGet16 (PcdQ35TsegMbytes);\r
+ return;\r
+ }\r
+\r
+ DEBUG ((\r
+ DEBUG_INFO,\r
+ "%a: QEMU offers an extended TSEG (%d MB)\n",\r
+ __FUNCTION__,\r
+ ExtendedTsegMbytes\r
+ ));\r
+ PcdStatus = PcdSet16S (PcdQ35TsegMbytes, ExtendedTsegMbytes);\r
+ ASSERT_RETURN_ERROR (PcdStatus);\r
+ mQ35TsegMbytes = ExtendedTsegMbytes;\r
+}\r
+\r
+\r
+VOID\r
+QemuUc32BaseInitialization (\r
+ VOID\r
+ )\r
+{\r
+ UINT32 LowerMemorySize;\r
+ UINT32 Uc32Size;\r
+\r
+ if (mXen) {\r
+ return;\r
+ }\r
+\r
+ if (mHostBridgeDevId == INTEL_Q35_MCH_DEVICE_ID) {\r
+ //\r
+ // On q35, the 32-bit area that we'll mark as UC, through variable MTRRs,\r
+ // starts at PcdPciExpressBaseAddress. The platform DSC is responsible for\r
+ // setting PcdPciExpressBaseAddress such that describing the\r
+ // [PcdPciExpressBaseAddress, 4GB) range require a very small number of\r
+ // variable MTRRs (preferably 1 or 2).\r
+ //\r
+ ASSERT (FixedPcdGet64 (PcdPciExpressBaseAddress) <= MAX_UINT32);\r
+ mQemuUc32Base = (UINT32)FixedPcdGet64 (PcdPciExpressBaseAddress);\r
+ return;\r
+ }\r
+\r
+ ASSERT (mHostBridgeDevId == INTEL_82441_DEVICE_ID);\r
+ //\r
+ // On i440fx, start with the [LowerMemorySize, 4GB) range. Make sure one\r
+ // variable MTRR suffices by truncating the size to a whole power of two,\r
+ // while keeping the end affixed to 4GB. This will round the base up.\r
+ //\r
+ LowerMemorySize = GetSystemMemorySizeBelow4gb ();\r
+ Uc32Size = GetPowerOfTwo32 ((UINT32)(SIZE_4GB - LowerMemorySize));\r
+ mQemuUc32Base = (UINT32)(SIZE_4GB - Uc32Size);\r
+ //\r
+ // Assuming that LowerMemorySize is at least 1 byte, Uc32Size is at most 2GB.\r
+ // Therefore mQemuUc32Base is at least 2GB.\r
+ //\r
+ ASSERT (mQemuUc32Base >= BASE_2GB);\r
+\r
+ if (mQemuUc32Base != LowerMemorySize) {\r
+ DEBUG ((DEBUG_VERBOSE, "%a: rounded UC32 base from 0x%x up to 0x%x, for "\r
+ "an UC32 size of 0x%x\n", __FUNCTION__, LowerMemorySize, mQemuUc32Base,\r
+ Uc32Size));\r
+ }\r
+}\r
+\r
+\r
+/**\r
+ Iterate over the RAM entries in QEMU's fw_cfg E820 RAM map that start outside\r
+ of the 32-bit address range.\r
+\r
+ Find the highest exclusive >=4GB RAM address, or produce memory resource\r
+ descriptor HOBs for RAM entries that start at or above 4GB.\r
+\r
+ @param[out] MaxAddress If MaxAddress is NULL, then ScanOrAdd64BitE820Ram()\r
+ produces memory resource descriptor HOBs for RAM\r
+ entries that start at or above 4GB.\r
+\r
+ Otherwise, MaxAddress holds the highest exclusive\r
+ >=4GB RAM address on output. If QEMU's fw_cfg E820\r
+ RAM map contains no RAM entry that starts outside of\r
+ the 32-bit address range, then MaxAddress is exactly\r
+ 4GB on output.\r
+\r
+ @retval EFI_SUCCESS The fw_cfg E820 RAM map was found and processed.\r
+\r
+ @retval EFI_PROTOCOL_ERROR The RAM map was found, but its size wasn't a\r
+ whole multiple of sizeof(EFI_E820_ENTRY64). No\r
+ RAM entry was processed.\r
+\r
+ @return Error codes from QemuFwCfgFindFile(). No RAM\r
+ entry was processed.\r
+**/\r
+STATIC\r
+EFI_STATUS\r
+ScanOrAdd64BitE820Ram (\r
+ OUT UINT64 *MaxAddress OPTIONAL\r
+ )\r
+{\r
+ EFI_STATUS Status;\r
+ FIRMWARE_CONFIG_ITEM FwCfgItem;\r
+ UINTN FwCfgSize;\r
+ EFI_E820_ENTRY64 E820Entry;\r
+ UINTN Processed;\r
+\r
+ Status = QemuFwCfgFindFile ("etc/e820", &FwCfgItem, &FwCfgSize);\r
+ if (EFI_ERROR (Status)) {\r
+ return Status;\r
+ }\r
+ if (FwCfgSize % sizeof E820Entry != 0) {\r
+ return EFI_PROTOCOL_ERROR;\r
+ }\r
+\r
+ if (MaxAddress != NULL) {\r
+ *MaxAddress = BASE_4GB;\r
+ }\r
+\r
+ QemuFwCfgSelectItem (FwCfgItem);\r
+ for (Processed = 0; Processed < FwCfgSize; Processed += sizeof E820Entry) {\r
+ QemuFwCfgReadBytes (sizeof E820Entry, &E820Entry);\r
+ DEBUG ((\r
+ DEBUG_VERBOSE,\r
+ "%a: Base=0x%Lx Length=0x%Lx Type=%u\n",\r
+ __FUNCTION__,\r
+ E820Entry.BaseAddr,\r
+ E820Entry.Length,\r
+ E820Entry.Type\r
+ ));\r
+ if (E820Entry.Type == EfiAcpiAddressRangeMemory &&\r
+ E820Entry.BaseAddr >= BASE_4GB) {\r
+ if (MaxAddress == NULL) {\r
+ UINT64 Base;\r
+ UINT64 End;\r
+\r
+ //\r
+ // Round up the start address, and round down the end address.\r
+ //\r
+ Base = ALIGN_VALUE (E820Entry.BaseAddr, (UINT64)EFI_PAGE_SIZE);\r
+ End = (E820Entry.BaseAddr + E820Entry.Length) &\r
+ ~(UINT64)EFI_PAGE_MASK;\r
+ if (Base < End) {\r
+ AddMemoryRangeHob (Base, End);\r
+ DEBUG ((\r
+ DEBUG_VERBOSE,\r
+ "%a: AddMemoryRangeHob [0x%Lx, 0x%Lx)\n",\r
+ __FUNCTION__,\r
+ Base,\r
+ End\r
+ ));\r
+ }\r
+ } else {\r
+ UINT64 Candidate;\r
+\r
+ Candidate = E820Entry.BaseAddr + E820Entry.Length;\r
+ if (Candidate > *MaxAddress) {\r
+ *MaxAddress = Candidate;\r
+ DEBUG ((\r
+ DEBUG_VERBOSE,\r
+ "%a: MaxAddress=0x%Lx\n",\r
+ __FUNCTION__,\r
+ *MaxAddress\r
+ ));\r
+ }\r
+ }\r
+ }\r
+ }\r
+ return EFI_SUCCESS;\r
+}\r
+\r
+\r