cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

cg3.c (10996B)

      1/*
      2 * QEMU CG3 Frame buffer
      3 *
      4 * Copyright (c) 2012 Bob Breuer
      5 * Copyright (c) 2013 Mark Cave-Ayland
      6 *
      7 * Permission is hereby granted, free of charge, to any person obtaining a copy
      8 * of this software and associated documentation files (the "Software"), to deal
      9 * in the Software without restriction, including without limitation the rights
     10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     11 * copies of the Software, and to permit persons to whom the Software is
     12 * furnished to do so, subject to the following conditions:
     13 *
     14 * The above copyright notice and this permission notice shall be included in
     15 * all copies or substantial portions of the Software.
     16 *
     17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     23 * THE SOFTWARE.
     24 */
     25
     26#include "qemu/osdep.h"
     27#include "qemu-common.h"
     28#include "qemu/datadir.h"
     29#include "qapi/error.h"
     30#include "qemu/error-report.h"
     31#include "ui/console.h"
     32#include "hw/sysbus.h"
     33#include "migration/vmstate.h"
     34#include "hw/irq.h"
     35#include "hw/loader.h"
     36#include "hw/qdev-properties.h"
     37#include "qemu/log.h"
     38#include "qemu/module.h"
     39#include "trace.h"
     40#include "qom/object.h"
     41
     42/* Change to 1 to enable debugging */
     43#define DEBUG_CG3 0
     44
     45#define CG3_ROM_FILE  "QEMU,cgthree.bin"
     46#define FCODE_MAX_ROM_SIZE 0x10000
     47
     48#define CG3_REG_SIZE            0x20
     49
     50#define CG3_REG_BT458_ADDR      0x0
     51#define CG3_REG_BT458_COLMAP    0x4
     52#define CG3_REG_FBC_CTRL        0x10
     53#define CG3_REG_FBC_STATUS      0x11
     54#define CG3_REG_FBC_CURSTART    0x12
     55#define CG3_REG_FBC_CUREND      0x13
     56#define CG3_REG_FBC_VCTRL       0x14
     57
     58/* Control register flags */
     59#define CG3_CR_ENABLE_INTS      0x80
     60
     61/* Status register flags */
     62#define CG3_SR_PENDING_INT      0x80
     63#define CG3_SR_1152_900_76_B    0x60
     64#define CG3_SR_ID_COLOR         0x01
     65
     66#define CG3_VRAM_SIZE 0x100000
     67#define CG3_VRAM_OFFSET 0x800000
     68
     69#define TYPE_CG3 "cgthree"
     70OBJECT_DECLARE_SIMPLE_TYPE(CG3State, CG3)
     71
     72struct CG3State {
     73    SysBusDevice parent_obj;
     74
     75    QemuConsole *con;
     76    qemu_irq irq;
     77    hwaddr prom_addr;
     78    MemoryRegion vram_mem;
     79    MemoryRegion rom;
     80    MemoryRegion reg;
     81    uint32_t vram_size;
     82    int full_update;
     83    uint8_t regs[16];
     84    uint8_t r[256], g[256], b[256];
     85    uint16_t width, height, depth;
     86    uint8_t dac_index, dac_state;
     87};
     88
     89static void cg3_update_display(void *opaque)
     90{
     91    CG3State *s = opaque;
     92    DisplaySurface *surface = qemu_console_surface(s->con);
     93    const uint8_t *pix;
     94    uint32_t *data;
     95    uint32_t dval;
     96    int x, y, y_start;
     97    unsigned int width, height;
     98    ram_addr_t page;
     99    DirtyBitmapSnapshot *snap = NULL;
    100
    101    if (surface_bits_per_pixel(surface) != 32) {
    102        return;
    103    }
    104    width = s->width;
    105    height = s->height;
    106
    107    y_start = -1;
    108    pix = memory_region_get_ram_ptr(&s->vram_mem);
    109    data = (uint32_t *)surface_data(surface);
    110
    111    if (!s->full_update) {
    112        snap = memory_region_snapshot_and_clear_dirty(&s->vram_mem, 0x0,
    113                                              memory_region_size(&s->vram_mem),
    114                                              DIRTY_MEMORY_VGA);
    115    }
    116
    117    for (y = 0; y < height; y++) {
    118        int update;
    119
    120        page = (ram_addr_t)y * width;
    121
    122        if (s->full_update) {
    123            update = 1;
    124        } else {
    125            update = memory_region_snapshot_get_dirty(&s->vram_mem, snap, page,
    126                                                      width);
    127        }
    128
    129        if (update) {
    130            if (y_start < 0) {
    131                y_start = y;
    132            }
    133
    134            for (x = 0; x < width; x++) {
    135                dval = *pix++;
    136                dval = (s->r[dval] << 16) | (s->g[dval] << 8) | s->b[dval];
    137                *data++ = dval;
    138            }
    139        } else {
    140            if (y_start >= 0) {
    141                dpy_gfx_update(s->con, 0, y_start, width, y - y_start);
    142                y_start = -1;
    143            }
    144            pix += width;
    145            data += width;
    146        }
    147    }
    148    s->full_update = 0;
    149    if (y_start >= 0) {
    150        dpy_gfx_update(s->con, 0, y_start, width, y - y_start);
    151    }
    152    /* vsync interrupt? */
    153    if (s->regs[0] & CG3_CR_ENABLE_INTS) {
    154        s->regs[1] |= CG3_SR_PENDING_INT;
    155        qemu_irq_raise(s->irq);
    156    }
    157    g_free(snap);
    158}
    159
    160static void cg3_invalidate_display(void *opaque)
    161{
    162    CG3State *s = opaque;
    163
    164    memory_region_set_dirty(&s->vram_mem, 0, CG3_VRAM_SIZE);
    165}
    166
    167static uint64_t cg3_reg_read(void *opaque, hwaddr addr, unsigned size)
    168{
    169    CG3State *s = opaque;
    170    int val;
    171
    172    switch (addr) {
    173    case CG3_REG_BT458_ADDR:
    174    case CG3_REG_BT458_COLMAP:
    175        val = 0;
    176        break;
    177    case CG3_REG_FBC_CTRL:
    178        val = s->regs[0];
    179        break;
    180    case CG3_REG_FBC_STATUS:
    181        /* monitor ID 6, board type = 1 (color) */
    182        val = s->regs[1] | CG3_SR_1152_900_76_B | CG3_SR_ID_COLOR;
    183        break;
    184    case CG3_REG_FBC_CURSTART ... CG3_REG_SIZE - 1:
    185        val = s->regs[addr - 0x10];
    186        break;
    187    default:
    188        qemu_log_mask(LOG_UNIMP,
    189                  "cg3: Unimplemented register read "
    190                  "reg 0x%" HWADDR_PRIx " size 0x%x\n",
    191                  addr, size);
    192        val = 0;
    193        break;
    194    }
    195    trace_cg3_read(addr, val, size);
    196
    197    return val;
    198}
    199
    200static void cg3_reg_write(void *opaque, hwaddr addr, uint64_t val,
    201                          unsigned size)
    202{
    203    CG3State *s = opaque;
    204    uint8_t regval;
    205    int i;
    206
    207    trace_cg3_write(addr, val, size);
    208    switch (addr) {
    209    case CG3_REG_BT458_ADDR:
    210        s->dac_index = val;
    211        s->dac_state = 0;
    212        break;
    213    case CG3_REG_BT458_COLMAP:
    214        /* This register can be written to as either a long word or a byte */
    215        if (size == 1) {
    216            val <<= 24;
    217        }
    218
    219        for (i = 0; i < size; i++) {
    220            regval = val >> 24;
    221
    222            switch (s->dac_state) {
    223            case 0:
    224                s->r[s->dac_index] = regval;
    225                s->dac_state++;
    226                break;
    227            case 1:
    228                s->g[s->dac_index] = regval;
    229                s->dac_state++;
    230                break;
    231            case 2:
    232                s->b[s->dac_index] = regval;
    233                /* Index autoincrement */
    234                s->dac_index = (s->dac_index + 1) & 0xff;
    235                /* fall through */
    236            default:
    237                s->dac_state = 0;
    238                break;
    239            }
    240            val <<= 8;
    241        }
    242        s->full_update = 1;
    243        break;
    244    case CG3_REG_FBC_CTRL:
    245        s->regs[0] = val;
    246        break;
    247    case CG3_REG_FBC_STATUS:
    248        if (s->regs[1] & CG3_SR_PENDING_INT) {
    249            /* clear interrupt */
    250            s->regs[1] &= ~CG3_SR_PENDING_INT;
    251            qemu_irq_lower(s->irq);
    252        }
    253        break;
    254    case CG3_REG_FBC_CURSTART ... CG3_REG_SIZE - 1:
    255        s->regs[addr - 0x10] = val;
    256        break;
    257    default:
    258        qemu_log_mask(LOG_UNIMP,
    259                  "cg3: Unimplemented register write "
    260                  "reg 0x%" HWADDR_PRIx " size 0x%x value 0x%" PRIx64 "\n",
    261                  addr, size, val);
    262        break;
    263    }
    264}
    265
    266static const MemoryRegionOps cg3_reg_ops = {
    267    .read = cg3_reg_read,
    268    .write = cg3_reg_write,
    269    .endianness = DEVICE_NATIVE_ENDIAN,
    270    .valid = {
    271        .min_access_size = 1,
    272        .max_access_size = 4,
    273    },
    274};
    275
    276static const GraphicHwOps cg3_ops = {
    277    .invalidate = cg3_invalidate_display,
    278    .gfx_update = cg3_update_display,
    279};
    280
    281static void cg3_initfn(Object *obj)
    282{
    283    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
    284    CG3State *s = CG3(obj);
    285
    286    memory_region_init_rom_nomigrate(&s->rom, obj, "cg3.prom",
    287                                     FCODE_MAX_ROM_SIZE, &error_fatal);
    288    sysbus_init_mmio(sbd, &s->rom);
    289
    290    memory_region_init_io(&s->reg, obj, &cg3_reg_ops, s, "cg3.reg",
    291                          CG3_REG_SIZE);
    292    sysbus_init_mmio(sbd, &s->reg);
    293}
    294
    295static void cg3_realizefn(DeviceState *dev, Error **errp)
    296{
    297    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
    298    CG3State *s = CG3(dev);
    299    int ret;
    300    char *fcode_filename;
    301
    302    /* FCode ROM */
    303    vmstate_register_ram_global(&s->rom);
    304    fcode_filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, CG3_ROM_FILE);
    305    if (fcode_filename) {
    306        ret = load_image_mr(fcode_filename, &s->rom);
    307        g_free(fcode_filename);
    308        if (ret < 0 || ret > FCODE_MAX_ROM_SIZE) {
    309            warn_report("cg3: could not load prom '%s'", CG3_ROM_FILE);
    310        }
    311    }
    312
    313    memory_region_init_ram(&s->vram_mem, NULL, "cg3.vram", s->vram_size,
    314                           &error_fatal);
    315    memory_region_set_log(&s->vram_mem, true, DIRTY_MEMORY_VGA);
    316    sysbus_init_mmio(sbd, &s->vram_mem);
    317
    318    sysbus_init_irq(sbd, &s->irq);
    319
    320    s->con = graphic_console_init(dev, 0, &cg3_ops, s);
    321    qemu_console_resize(s->con, s->width, s->height);
    322}
    323
    324static int vmstate_cg3_post_load(void *opaque, int version_id)
    325{
    326    CG3State *s = opaque;
    327
    328    cg3_invalidate_display(s);
    329
    330    return 0;
    331}
    332
    333static const VMStateDescription vmstate_cg3 = {
    334    .name = "cg3",
    335    .version_id = 1,
    336    .minimum_version_id = 1,
    337    .post_load = vmstate_cg3_post_load,
    338    .fields = (VMStateField[]) {
    339        VMSTATE_UINT16(height, CG3State),
    340        VMSTATE_UINT16(width, CG3State),
    341        VMSTATE_UINT16(depth, CG3State),
    342        VMSTATE_BUFFER(r, CG3State),
    343        VMSTATE_BUFFER(g, CG3State),
    344        VMSTATE_BUFFER(b, CG3State),
    345        VMSTATE_UINT8(dac_index, CG3State),
    346        VMSTATE_UINT8(dac_state, CG3State),
    347        VMSTATE_END_OF_LIST()
    348    }
    349};
    350
    351static void cg3_reset(DeviceState *d)
    352{
    353    CG3State *s = CG3(d);
    354
    355    /* Initialize palette */
    356    memset(s->r, 0, 256);
    357    memset(s->g, 0, 256);
    358    memset(s->b, 0, 256);
    359
    360    s->dac_state = 0;
    361    s->full_update = 1;
    362    qemu_irq_lower(s->irq);
    363}
    364
    365static Property cg3_properties[] = {
    366    DEFINE_PROP_UINT32("vram-size",    CG3State, vram_size, -1),
    367    DEFINE_PROP_UINT16("width",        CG3State, width,     -1),
    368    DEFINE_PROP_UINT16("height",       CG3State, height,    -1),
    369    DEFINE_PROP_UINT16("depth",        CG3State, depth,     -1),
    370    DEFINE_PROP_END_OF_LIST(),
    371};
    372
    373static void cg3_class_init(ObjectClass *klass, void *data)
    374{
    375    DeviceClass *dc = DEVICE_CLASS(klass);
    376
    377    dc->realize = cg3_realizefn;
    378    dc->reset = cg3_reset;
    379    dc->vmsd = &vmstate_cg3;
    380    device_class_set_props(dc, cg3_properties);
    381}
    382
    383static const TypeInfo cg3_info = {
    384    .name          = TYPE_CG3,
    385    .parent        = TYPE_SYS_BUS_DEVICE,
    386    .instance_size = sizeof(CG3State),
    387    .instance_init = cg3_initfn,
    388    .class_init    = cg3_class_init,
    389};
    390
    391static void cg3_register_types(void)
    392{
    393    type_register_static(&cg3_info);
    394}
    395
    396type_init(cg3_register_types)