Index: qemu/hw/fw_cfg.c
===================================================================
--- qemu.orig/hw/fw_cfg.c	2008-09-07 18:29:23.000000000 +0000
+++ qemu/hw/fw_cfg.c	2008-09-07 18:37:40.000000000 +0000
@@ -40,7 +40,9 @@
 
 typedef struct _FWCfgEntry {
     uint16_t len;
-    const uint8_t *data;
+    uint8_t *data;
+    void *callback_opaque;
+    FWCfgCallback callback;
 } FWCfgEntry;
 
 typedef struct _FWCfgState {
@@ -49,12 +51,28 @@
     uint16_t cur_offset;
 } FWCfgState;
 
+static void fw_cfg_write(FWCfgState *s, uint8_t value)
+{
+    int arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
+    FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
+
+    FW_CFG_DPRINTF("write %d\n", value);
+
+    if (s->cur_entry & FW_CFG_WRITE_CHANNEL && s->cur_offset < e->len) {
+        e->data[s->cur_offset++] = value;
+        if (s->cur_offset == e->len) {
+            e->callback(e->callback_opaque, e->data);
+            s->cur_offset = 0;
+        }
+    }
+}
+
 static int fw_cfg_select(FWCfgState *s, uint16_t key)
 {
     int ret;
 
     s->cur_offset = 0;
-    if ((key & ~FW_CFG_ARCH_LOCAL) >= FW_CFG_MAX_ENTRY) {
+    if ((key & FW_CFG_ENTRY_MASK) >= FW_CFG_MAX_ENTRY) {
         s->cur_entry = FW_CFG_INVALID;
         ret = 0;
     } else {
@@ -70,7 +88,7 @@
 static uint8_t fw_cfg_read(FWCfgState *s)
 {
     int arch = !!(s->cur_entry & FW_CFG_ARCH_LOCAL);
-    FWCfgEntry *e = &s->entries[arch][s->cur_entry & ~FW_CFG_ARCH_LOCAL];
+    FWCfgEntry *e = &s->entries[arch][s->cur_entry & FW_CFG_ENTRY_MASK];
     uint8_t ret;
 
     if (s->cur_entry == FW_CFG_INVALID || !e->data || s->cur_offset >= e->len)
@@ -88,6 +106,11 @@
     return fw_cfg_read(opaque);
 }
 
+static void fw_cfg_io_writeb(void *opaque, uint32_t addr, uint32_t value)
+{
+    return fw_cfg_write(opaque, (uint8_t)value);
+}
+
 static void fw_cfg_io_writew(void *opaque, uint32_t addr, uint32_t value)
 {
     fw_cfg_select(opaque, (uint16_t)value);
@@ -98,6 +121,12 @@
     return fw_cfg_read(opaque);
 }
 
+static void fw_cfg_mem_writeb(void *opaque, target_phys_addr_t addr,
+                              uint32_t value)
+{
+    return fw_cfg_write(opaque, (uint8_t)value);
+}
+
 static void fw_cfg_mem_writew(void *opaque, target_phys_addr_t addr,
                               uint32_t value)
 {
@@ -111,7 +140,7 @@
 };
 
 static CPUWriteMemoryFunc *fw_cfg_mem_write[3] = {
-    NULL,
+    fw_cfg_mem_writeb,
     fw_cfg_mem_writew,
     NULL,
 };
@@ -144,12 +173,12 @@
     return 0;
 }
 
-int fw_cfg_add_bytes(void *opaque, uint16_t key, const uint8_t *data, uint16_t len)
+int fw_cfg_add_bytes(void *opaque, uint16_t key, uint8_t *data, uint16_t len)
 {
     FWCfgState *s = opaque;
     int arch = !!(key & FW_CFG_ARCH_LOCAL);
 
-    key &= (~FW_CFG_ARCH_LOCAL);
+    key &= FW_CFG_ENTRY_MASK;
 
     if (key >= FW_CFG_MAX_ENTRY)
         return 0;
@@ -193,6 +222,26 @@
     return fw_cfg_add_bytes(opaque, key, (uint8_t *)copy, sizeof(value));
 }
 
+int fw_cfg_add_callback(void *opaque, uint16_t key, FWCfgCallback callback,
+                        void *callback_opaque, uint8_t *data, size_t len)
+{
+    FWCfgState *s = opaque;
+    int arch = !!(key & FW_CFG_ARCH_LOCAL);
+
+    key &= FW_CFG_ENTRY_MASK;
+
+    if (key >= FW_CFG_MAX_ENTRY || !(key & FW_CFG_WRITE_CHANNEL)
+        || len > 65535)
+        return 0;
+
+    s->entries[arch][key].data = data;
+    s->entries[arch][key].len = len;
+    s->entries[arch][key].callback_opaque = callback_opaque;
+    s->entries[arch][key].callback = callback;
+
+    return 1;
+}
+
 void *fw_cfg_init(uint32_t port, target_phys_addr_t addr)
 {
     FWCfgState *s;
@@ -205,6 +254,7 @@
 
     if (port) {
         register_ioport_read(port, 1, 1, fw_cfg_io_readb, s);
+        register_ioport_write(port, 1, 1, fw_cfg_io_writeb, s);
         register_ioport_write(port, 2, 2, fw_cfg_io_writew, s);
     }
     if (addr) {
Index: qemu/hw/fw_cfg.h
===================================================================
--- qemu.orig/hw/fw_cfg.h	2008-09-07 18:29:23.000000000 +0000
+++ qemu/hw/fw_cfg.h	2008-09-07 18:37:13.000000000 +0000
@@ -10,16 +10,21 @@
 #define FW_CFG_MACHINE_ID       0x06
 #define FW_CFG_MAX_ENTRY        0x10
 
+#define FW_CFG_WRITE_CHANNEL    0x4000
 #define FW_CFG_ARCH_LOCAL       0x8000
+#define FW_CFG_ENTRY_MASK       ~(FW_CFG_WRITE_CHANNEL | FW_CFG_ARCH_LOCAL)
 
 #define FW_CFG_INVALID          0xffff
 
 #ifndef NO_QEMU_PROTOS
-int fw_cfg_add_bytes(void *opaque, uint16_t key, const uint8_t *data,
-                     uint16_t len);
+typedef void (*FWCfgCallback)(void *opaque, uint8_t *data);
+
+int fw_cfg_add_bytes(void *opaque, uint16_t key, uint8_t *data, uint16_t len);
 int fw_cfg_add_i16(void *opaque, uint16_t key, uint16_t value);
 int fw_cfg_add_i32(void *opaque, uint16_t key, uint32_t value);
 int fw_cfg_add_i64(void *opaque, uint16_t key, uint64_t value);
+int fw_cfg_add_callback(void *opaque, uint16_t key, FWCfgCallback callback,
+                        void *callback_opaque, uint8_t *data, size_t len);
 void *fw_cfg_init(uint32_t port, target_phys_addr_t addr);
 #endif /* NO_QEMU_PROTOS */
 
