cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

g364fb.c (16639B)

      1/*
      2 * QEMU G364 framebuffer Emulator.
      3 *
      4 * Copyright (c) 2007-2011 Herve Poussineau
      5 *
      6 * This program is free software; you can redistribute it and/or
      7 * modify it under the terms of the GNU General Public License as
      8 * published by the Free Software Foundation; either version 2 of
      9 * the License, or (at your option) any later version.
     10 *
     11 * This program is distributed in the hope that it will be useful,
     12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
     13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     14 * GNU General Public License for more details.
     15 *
     16 * You should have received a copy of the GNU General Public License along
     17 * with this program; if not, see <http://www.gnu.org/licenses/>.
     18 */
     19
     20#include "qemu/osdep.h"
     21#include "qemu/units.h"
     22#include "hw/hw.h"
     23#include "hw/irq.h"
     24#include "hw/qdev-properties.h"
     25#include "qapi/error.h"
     26#include "qemu/error-report.h"
     27#include "qemu/module.h"
     28#include "ui/console.h"
     29#include "ui/pixel_ops.h"
     30#include "trace.h"
     31#include "hw/sysbus.h"
     32#include "migration/vmstate.h"
     33#include "qom/object.h"
     34
     35typedef struct G364State {
     36    /* hardware */
     37    uint32_t vram_size;
     38    qemu_irq irq;
     39    MemoryRegion mem_vram;
     40    MemoryRegion mem_ctrl;
     41    /* registers */
     42    uint8_t color_palette[256][3];
     43    uint8_t cursor_palette[3][3];
     44    uint16_t cursor[512];
     45    uint32_t cursor_position;
     46    uint32_t ctla;
     47    uint32_t top_of_screen;
     48    uint32_t width, height; /* in pixels */
     49    /* display refresh support */
     50    QemuConsole *con;
     51    int depth;
     52    int blanked;
     53} G364State;
     54
     55#define REG_BOOT     0x000000
     56#define REG_DISPLAY  0x000118
     57#define REG_VDISPLAY 0x000150
     58#define REG_CTLA     0x000300
     59#define REG_TOP      0x000400
     60#define REG_CURS_PAL 0x000508
     61#define REG_CURS_POS 0x000638
     62#define REG_CLR_PAL  0x000800
     63#define REG_CURS_PAT 0x001000
     64#define REG_RESET    0x100000
     65
     66#define CTLA_FORCE_BLANK 0x00000400
     67#define CTLA_NO_CURSOR   0x00800000
     68
     69#define G364_PAGE_SIZE 4096
     70
     71static inline int check_dirty(G364State *s, DirtyBitmapSnapshot *snap, ram_addr_t page)
     72{
     73    return memory_region_snapshot_get_dirty(&s->mem_vram, snap, page, G364_PAGE_SIZE);
     74}
     75
     76static void g364fb_draw_graphic8(G364State *s)
     77{
     78    DisplaySurface *surface = qemu_console_surface(s->con);
     79    DirtyBitmapSnapshot *snap;
     80    int i, w;
     81    uint8_t *vram;
     82    uint8_t *data_display, *dd;
     83    ram_addr_t page;
     84    int x, y;
     85    int xmin, xmax;
     86    int ymin, ymax;
     87    int xcursor, ycursor;
     88    unsigned int (*rgb_to_pixel)(unsigned int r, unsigned int g, unsigned int b);
     89
     90    switch (surface_bits_per_pixel(surface)) {
     91        case 8:
     92            rgb_to_pixel = rgb_to_pixel8;
     93            w = 1;
     94            break;
     95        case 15:
     96            rgb_to_pixel = rgb_to_pixel15;
     97            w = 2;
     98            break;
     99        case 16:
    100            rgb_to_pixel = rgb_to_pixel16;
    101            w = 2;
    102            break;
    103        case 32:
    104            rgb_to_pixel = rgb_to_pixel32;
    105            w = 4;
    106            break;
    107        default:
    108            hw_error("g364: unknown host depth %d",
    109                     surface_bits_per_pixel(surface));
    110            return;
    111    }
    112
    113    page = 0;
    114
    115    x = y = 0;
    116    xmin = s->width;
    117    xmax = 0;
    118    ymin = s->height;
    119    ymax = 0;
    120
    121    if (!(s->ctla & CTLA_NO_CURSOR)) {
    122        xcursor = s->cursor_position >> 12;
    123        ycursor = s->cursor_position & 0xfff;
    124    } else {
    125        xcursor = ycursor = -65;
    126    }
    127
    128    vram = memory_region_get_ram_ptr(&s->mem_vram) + s->top_of_screen;
    129    /* XXX: out of range in vram? */
    130    data_display = dd = surface_data(surface);
    131    snap = memory_region_snapshot_and_clear_dirty(&s->mem_vram, 0, s->vram_size,
    132                                                  DIRTY_MEMORY_VGA);
    133    while (y < s->height) {
    134        if (check_dirty(s, snap, page)) {
    135            if (y < ymin)
    136                ymin = ymax = y;
    137            if (x < xmin)
    138                xmin = x;
    139            for (i = 0; i < G364_PAGE_SIZE; i++) {
    140                uint8_t index;
    141                unsigned int color;
    142                if (unlikely((y >= ycursor && y < ycursor + 64) &&
    143                    (x >= xcursor && x < xcursor + 64))) {
    144                    /* pointer area */
    145                    int xdiff = x - xcursor;
    146                    uint16_t curs = s->cursor[(y - ycursor) * 8 + xdiff / 8];
    147                    int op = (curs >> ((xdiff & 7) * 2)) & 3;
    148                    if (likely(op == 0)) {
    149                        /* transparent */
    150                        index = *vram;
    151                        color = (*rgb_to_pixel)(
    152                            s->color_palette[index][0],
    153                            s->color_palette[index][1],
    154                            s->color_palette[index][2]);
    155                    } else {
    156                        /* get cursor color */
    157                        index = op - 1;
    158                        color = (*rgb_to_pixel)(
    159                            s->cursor_palette[index][0],
    160                            s->cursor_palette[index][1],
    161                            s->cursor_palette[index][2]);
    162                    }
    163                } else {
    164                    /* normal area */
    165                    index = *vram;
    166                    color = (*rgb_to_pixel)(
    167                        s->color_palette[index][0],
    168                        s->color_palette[index][1],
    169                        s->color_palette[index][2]);
    170                }
    171                memcpy(dd, &color, w);
    172                dd += w;
    173                x++;
    174                vram++;
    175                if (x == s->width) {
    176                    xmax = s->width - 1;
    177                    y++;
    178                    if (y == s->height) {
    179                        ymax = s->height - 1;
    180                        goto done;
    181                    }
    182                    data_display = dd = data_display + surface_stride(surface);
    183                    xmin = 0;
    184                    x = 0;
    185                }
    186            }
    187            if (x > xmax)
    188                xmax = x;
    189            if (y > ymax)
    190                ymax = y;
    191        } else {
    192            int dy;
    193            if (xmax || ymax) {
    194                dpy_gfx_update(s->con, xmin, ymin,
    195                               xmax - xmin + 1, ymax - ymin + 1);
    196                xmin = s->width;
    197                xmax = 0;
    198                ymin = s->height;
    199                ymax = 0;
    200            }
    201            x += G364_PAGE_SIZE;
    202            dy = x / s->width;
    203            x = x % s->width;
    204            y += dy;
    205            vram += G364_PAGE_SIZE;
    206            data_display += dy * surface_stride(surface);
    207            dd = data_display + x * w;
    208        }
    209        page += G364_PAGE_SIZE;
    210    }
    211
    212done:
    213    if (xmax || ymax) {
    214        dpy_gfx_update(s->con, xmin, ymin, xmax - xmin + 1, ymax - ymin + 1);
    215    }
    216    g_free(snap);
    217}
    218
    219static void g364fb_draw_blank(G364State *s)
    220{
    221    DisplaySurface *surface = qemu_console_surface(s->con);
    222    int i, w;
    223    uint8_t *d;
    224
    225    if (s->blanked) {
    226        /* Screen is already blank. No need to redraw it */
    227        return;
    228    }
    229
    230    w = s->width * surface_bytes_per_pixel(surface);
    231    d = surface_data(surface);
    232    for (i = 0; i < s->height; i++) {
    233        memset(d, 0, w);
    234        d += surface_stride(surface);
    235    }
    236
    237    dpy_gfx_update_full(s->con);
    238    s->blanked = 1;
    239}
    240
    241static void g364fb_update_display(void *opaque)
    242{
    243    G364State *s = opaque;
    244    DisplaySurface *surface = qemu_console_surface(s->con);
    245
    246    qemu_flush_coalesced_mmio_buffer();
    247
    248    if (s->width == 0 || s->height == 0)
    249        return;
    250
    251    if (s->width != surface_width(surface) ||
    252        s->height != surface_height(surface)) {
    253        qemu_console_resize(s->con, s->width, s->height);
    254    }
    255
    256    if (s->ctla & CTLA_FORCE_BLANK) {
    257        g364fb_draw_blank(s);
    258    } else if (s->depth == 8) {
    259        g364fb_draw_graphic8(s);
    260    } else {
    261        error_report("g364: unknown guest depth %d", s->depth);
    262    }
    263
    264    qemu_irq_raise(s->irq);
    265}
    266
    267static inline void g364fb_invalidate_display(void *opaque)
    268{
    269    G364State *s = opaque;
    270
    271    s->blanked = 0;
    272    memory_region_set_dirty(&s->mem_vram, 0, s->vram_size);
    273}
    274
    275static void g364fb_reset(G364State *s)
    276{
    277    uint8_t *vram = memory_region_get_ram_ptr(&s->mem_vram);
    278
    279    qemu_irq_lower(s->irq);
    280
    281    memset(s->color_palette, 0, sizeof(s->color_palette));
    282    memset(s->cursor_palette, 0, sizeof(s->cursor_palette));
    283    memset(s->cursor, 0, sizeof(s->cursor));
    284    s->cursor_position = 0;
    285    s->ctla = 0;
    286    s->top_of_screen = 0;
    287    s->width = s->height = 0;
    288    memset(vram, 0, s->vram_size);
    289    g364fb_invalidate_display(s);
    290}
    291
    292/* called for accesses to io ports */
    293static uint64_t g364fb_ctrl_read(void *opaque,
    294                                 hwaddr addr,
    295                                 unsigned int size)
    296{
    297    G364State *s = opaque;
    298    uint32_t val;
    299
    300    if (addr >= REG_CURS_PAT && addr < REG_CURS_PAT + 0x1000) {
    301        /* cursor pattern */
    302        int idx = (addr - REG_CURS_PAT) >> 3;
    303        val = s->cursor[idx];
    304    } else if (addr >= REG_CURS_PAL && addr < REG_CURS_PAL + 0x18) {
    305        /* cursor palette */
    306        int idx = (addr - REG_CURS_PAL) >> 3;
    307        val = ((uint32_t)s->cursor_palette[idx][0] << 16);
    308        val |= ((uint32_t)s->cursor_palette[idx][1] << 8);
    309        val |= ((uint32_t)s->cursor_palette[idx][2] << 0);
    310    } else {
    311        switch (addr) {
    312            case REG_DISPLAY:
    313                val = s->width / 4;
    314                break;
    315            case REG_VDISPLAY:
    316                val = s->height * 2;
    317                break;
    318            case REG_CTLA:
    319                val = s->ctla;
    320                break;
    321            default:
    322            {
    323                error_report("g364: invalid read at [" TARGET_FMT_plx "]",
    324                             addr);
    325                val = 0;
    326                break;
    327            }
    328        }
    329    }
    330
    331    trace_g364fb_read(addr, val);
    332
    333    return val;
    334}
    335
    336static void g364fb_update_depth(G364State *s)
    337{
    338    static const int depths[8] = { 1, 2, 4, 8, 15, 16, 0 };
    339    s->depth = depths[(s->ctla & 0x00700000) >> 20];
    340}
    341
    342static void g364_invalidate_cursor_position(G364State *s)
    343{
    344    DisplaySurface *surface = qemu_console_surface(s->con);
    345    int ymin, ymax, start, end;
    346
    347    /* invalidate only near the cursor */
    348    ymin = s->cursor_position & 0xfff;
    349    ymax = MIN(s->height, ymin + 64);
    350    start = ymin * surface_stride(surface);
    351    end = (ymax + 1) * surface_stride(surface);
    352
    353    memory_region_set_dirty(&s->mem_vram, start, end - start);
    354}
    355
    356static void g364fb_ctrl_write(void *opaque,
    357                              hwaddr addr,
    358                              uint64_t val,
    359                              unsigned int size)
    360{
    361    G364State *s = opaque;
    362
    363    trace_g364fb_write(addr, val);
    364
    365    if (addr >= REG_CLR_PAL && addr < REG_CLR_PAL + 0x800) {
    366        /* color palette */
    367        int idx = (addr - REG_CLR_PAL) >> 3;
    368        s->color_palette[idx][0] = (val >> 16) & 0xff;
    369        s->color_palette[idx][1] = (val >> 8) & 0xff;
    370        s->color_palette[idx][2] = val & 0xff;
    371        g364fb_invalidate_display(s);
    372    } else if (addr >= REG_CURS_PAT && addr < REG_CURS_PAT + 0x1000) {
    373        /* cursor pattern */
    374        int idx = (addr - REG_CURS_PAT) >> 3;
    375        s->cursor[idx] = val;
    376        g364fb_invalidate_display(s);
    377    } else if (addr >= REG_CURS_PAL && addr < REG_CURS_PAL + 0x18) {
    378        /* cursor palette */
    379        int idx = (addr - REG_CURS_PAL) >> 3;
    380        s->cursor_palette[idx][0] = (val >> 16) & 0xff;
    381        s->cursor_palette[idx][1] = (val >> 8) & 0xff;
    382        s->cursor_palette[idx][2] = val & 0xff;
    383        g364fb_invalidate_display(s);
    384    } else {
    385        switch (addr) {
    386        case REG_BOOT: /* Boot timing */
    387        case 0x00108: /* Line timing: half sync */
    388        case 0x00110: /* Line timing: back porch */
    389        case 0x00120: /* Line timing: short display */
    390        case 0x00128: /* Frame timing: broad pulse */
    391        case 0x00130: /* Frame timing: v sync */
    392        case 0x00138: /* Frame timing: v preequalise */
    393        case 0x00140: /* Frame timing: v postequalise */
    394        case 0x00148: /* Frame timing: v blank */
    395        case 0x00158: /* Line timing: line time */
    396        case 0x00160: /* Frame store: line start */
    397        case 0x00168: /* vram cycle: mem init */
    398        case 0x00170: /* vram cycle: transfer delay */
    399        case 0x00200: /* vram cycle: mask register */
    400            /* ignore */
    401            break;
    402        case REG_TOP:
    403            s->top_of_screen = val;
    404            g364fb_invalidate_display(s);
    405            break;
    406        case REG_DISPLAY:
    407            s->width = val * 4;
    408            break;
    409        case REG_VDISPLAY:
    410            s->height = val / 2;
    411            break;
    412        case REG_CTLA:
    413            s->ctla = val;
    414            g364fb_update_depth(s);
    415            g364fb_invalidate_display(s);
    416            break;
    417        case REG_CURS_POS:
    418            g364_invalidate_cursor_position(s);
    419            s->cursor_position = val;
    420            g364_invalidate_cursor_position(s);
    421            break;
    422        case REG_RESET:
    423            g364fb_reset(s);
    424            break;
    425        default:
    426            error_report("g364: invalid write of 0x%" PRIx64
    427                         " at [" TARGET_FMT_plx "]", val, addr);
    428            break;
    429        }
    430    }
    431    qemu_irq_lower(s->irq);
    432}
    433
    434static const MemoryRegionOps g364fb_ctrl_ops = {
    435    .read = g364fb_ctrl_read,
    436    .write = g364fb_ctrl_write,
    437    .endianness = DEVICE_LITTLE_ENDIAN,
    438    .impl.min_access_size = 4,
    439    .impl.max_access_size = 4,
    440};
    441
    442static int g364fb_post_load(void *opaque, int version_id)
    443{
    444    G364State *s = opaque;
    445
    446    /* force refresh */
    447    g364fb_update_depth(s);
    448    g364fb_invalidate_display(s);
    449
    450    return 0;
    451}
    452
    453static const VMStateDescription vmstate_g364fb = {
    454    .name = "g364fb",
    455    .version_id = 2,
    456    .minimum_version_id = 2,
    457    .post_load = g364fb_post_load,
    458    .fields = (VMStateField[]) {
    459        VMSTATE_BUFFER_UNSAFE(color_palette, G364State, 0, 256 * 3),
    460        VMSTATE_BUFFER_UNSAFE(cursor_palette, G364State, 0, 9),
    461        VMSTATE_UINT16_ARRAY(cursor, G364State, 512),
    462        VMSTATE_UINT32(cursor_position, G364State),
    463        VMSTATE_UINT32(ctla, G364State),
    464        VMSTATE_UINT32(top_of_screen, G364State),
    465        VMSTATE_UINT32(width, G364State),
    466        VMSTATE_UINT32(height, G364State),
    467        VMSTATE_END_OF_LIST()
    468    }
    469};
    470
    471static const GraphicHwOps g364fb_ops = {
    472    .invalidate  = g364fb_invalidate_display,
    473    .gfx_update  = g364fb_update_display,
    474};
    475
    476static void g364fb_init(DeviceState *dev, G364State *s)
    477{
    478    s->con = graphic_console_init(dev, 0, &g364fb_ops, s);
    479
    480    memory_region_init_io(&s->mem_ctrl, OBJECT(dev), &g364fb_ctrl_ops, s,
    481                          "ctrl", 0x180000);
    482    memory_region_init_ram(&s->mem_vram, NULL, "g364fb.vram", s->vram_size,
    483                           &error_fatal);
    484    memory_region_set_log(&s->mem_vram, true, DIRTY_MEMORY_VGA);
    485}
    486
    487#define TYPE_G364 "sysbus-g364"
    488OBJECT_DECLARE_SIMPLE_TYPE(G364SysBusState, G364)
    489
    490struct G364SysBusState {
    491    SysBusDevice parent_obj;
    492
    493    G364State g364;
    494};
    495
    496static void g364fb_sysbus_realize(DeviceState *dev, Error **errp)
    497{
    498    G364SysBusState *sbs = G364(dev);
    499    G364State *s = &sbs->g364;
    500    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
    501
    502    g364fb_init(dev, s);
    503    sysbus_init_irq(sbd, &s->irq);
    504    sysbus_init_mmio(sbd, &s->mem_ctrl);
    505    sysbus_init_mmio(sbd, &s->mem_vram);
    506}
    507
    508static void g364fb_sysbus_reset(DeviceState *d)
    509{
    510    G364SysBusState *s = G364(d);
    511
    512    g364fb_reset(&s->g364);
    513}
    514
    515static Property g364fb_sysbus_properties[] = {
    516    DEFINE_PROP_UINT32("vram_size", G364SysBusState, g364.vram_size, 8 * MiB),
    517    DEFINE_PROP_END_OF_LIST(),
    518};
    519
    520static const VMStateDescription vmstate_g364fb_sysbus = {
    521    .name = "g364fb-sysbus",
    522    .version_id = 2,
    523    .minimum_version_id = 2,
    524    .fields = (VMStateField[]) {
    525        VMSTATE_STRUCT(g364, G364SysBusState, 2, vmstate_g364fb, G364State),
    526        VMSTATE_END_OF_LIST()
    527    }
    528};
    529
    530static void g364fb_sysbus_class_init(ObjectClass *klass, void *data)
    531{
    532    DeviceClass *dc = DEVICE_CLASS(klass);
    533
    534    dc->realize = g364fb_sysbus_realize;
    535    set_bit(DEVICE_CATEGORY_DISPLAY, dc->categories);
    536    dc->desc = "G364 framebuffer";
    537    dc->reset = g364fb_sysbus_reset;
    538    dc->vmsd = &vmstate_g364fb_sysbus;
    539    device_class_set_props(dc, g364fb_sysbus_properties);
    540}
    541
    542static const TypeInfo g364fb_sysbus_info = {
    543    .name          = TYPE_G364,
    544    .parent        = TYPE_SYS_BUS_DEVICE,
    545    .instance_size = sizeof(G364SysBusState),
    546    .class_init    = g364fb_sysbus_class_init,
    547};
    548
    549static void g364fb_register_types(void)
    550{
    551    type_register_static(&g364fb_sysbus_info);
    552}
    553
    554type_init(g364fb_register_types)