cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

pci.c (15427B)


      1/*
      2 * QEMU IDE Emulation: PCI Bus support.
      3 *
      4 * Copyright (c) 2003 Fabrice Bellard
      5 * Copyright (c) 2006 Openedhand Ltd.
      6 *
      7 * Permission is hereby granted, free of charge, to any person obtaining a copy
      8 * of this software and associated documentation files (the "Software"), to deal
      9 * in the Software without restriction, including without limitation the rights
     10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     11 * copies of the Software, and to permit persons to whom the Software is
     12 * furnished to do so, subject to the following conditions:
     13 *
     14 * The above copyright notice and this permission notice shall be included in
     15 * all copies or substantial portions of the Software.
     16 *
     17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     23 * THE SOFTWARE.
     24 */
     25
     26#include "qemu/osdep.h"
     27#include "hw/pci/pci.h"
     28#include "migration/vmstate.h"
     29#include "sysemu/dma.h"
     30#include "qemu/error-report.h"
     31#include "qemu/module.h"
     32#include "hw/ide/pci.h"
     33#include "trace.h"
     34
     35#define BMDMA_PAGE_SIZE 4096
     36
     37#define BM_MIGRATION_COMPAT_STATUS_BITS \
     38        (IDE_RETRY_DMA | IDE_RETRY_PIO | \
     39        IDE_RETRY_READ | IDE_RETRY_FLUSH)
     40
     41static uint64_t pci_ide_status_read(void *opaque, hwaddr addr, unsigned size)
     42{
     43    IDEBus *bus = opaque;
     44
     45    if (addr != 2 || size != 1) {
     46        return ((uint64_t)1 << (size * 8)) - 1;
     47    }
     48    return ide_status_read(bus, addr + 2);
     49}
     50
     51static void pci_ide_ctrl_write(void *opaque, hwaddr addr,
     52                               uint64_t data, unsigned size)
     53{
     54    IDEBus *bus = opaque;
     55
     56    if (addr != 2 || size != 1) {
     57        return;
     58    }
     59    ide_ctrl_write(bus, addr + 2, data);
     60}
     61
     62const MemoryRegionOps pci_ide_cmd_le_ops = {
     63    .read = pci_ide_status_read,
     64    .write = pci_ide_ctrl_write,
     65    .endianness = DEVICE_LITTLE_ENDIAN,
     66};
     67
     68static uint64_t pci_ide_data_read(void *opaque, hwaddr addr, unsigned size)
     69{
     70    IDEBus *bus = opaque;
     71
     72    if (size == 1) {
     73        return ide_ioport_read(bus, addr);
     74    } else if (addr == 0) {
     75        if (size == 2) {
     76            return ide_data_readw(bus, addr);
     77        } else {
     78            return ide_data_readl(bus, addr);
     79        }
     80    }
     81    return ((uint64_t)1 << (size * 8)) - 1;
     82}
     83
     84static void pci_ide_data_write(void *opaque, hwaddr addr,
     85                               uint64_t data, unsigned size)
     86{
     87    IDEBus *bus = opaque;
     88
     89    if (size == 1) {
     90        ide_ioport_write(bus, addr, data);
     91    } else if (addr == 0) {
     92        if (size == 2) {
     93            ide_data_writew(bus, addr, data);
     94        } else {
     95            ide_data_writel(bus, addr, data);
     96        }
     97    }
     98}
     99
    100const MemoryRegionOps pci_ide_data_le_ops = {
    101    .read = pci_ide_data_read,
    102    .write = pci_ide_data_write,
    103    .endianness = DEVICE_LITTLE_ENDIAN,
    104};
    105
    106static void bmdma_start_dma(const IDEDMA *dma, IDEState *s,
    107                            BlockCompletionFunc *dma_cb)
    108{
    109    BMDMAState *bm = DO_UPCAST(BMDMAState, dma, dma);
    110
    111    bm->dma_cb = dma_cb;
    112    bm->cur_prd_last = 0;
    113    bm->cur_prd_addr = 0;
    114    bm->cur_prd_len = 0;
    115
    116    if (bm->status & BM_STATUS_DMAING) {
    117        bm->dma_cb(bmdma_active_if(bm), 0);
    118    }
    119}
    120
    121/**
    122 * Prepare an sglist based on available PRDs.
    123 * @limit: How many bytes to prepare total.
    124 *
    125 * Returns the number of bytes prepared, -1 on error.
    126 * IDEState.io_buffer_size will contain the number of bytes described
    127 * by the PRDs, whether or not we added them to the sglist.
    128 */
    129static int32_t bmdma_prepare_buf(const IDEDMA *dma, int32_t limit)
    130{
    131    BMDMAState *bm = DO_UPCAST(BMDMAState, dma, dma);
    132    IDEState *s = bmdma_active_if(bm);
    133    PCIDevice *pci_dev = PCI_DEVICE(bm->pci_dev);
    134    struct {
    135        uint32_t addr;
    136        uint32_t size;
    137    } prd;
    138    int l, len;
    139
    140    pci_dma_sglist_init(&s->sg, pci_dev,
    141                        s->nsector / (BMDMA_PAGE_SIZE / BDRV_SECTOR_SIZE) + 1);
    142    s->io_buffer_size = 0;
    143    for(;;) {
    144        if (bm->cur_prd_len == 0) {
    145            /* end of table (with a fail safe of one page) */
    146            if (bm->cur_prd_last ||
    147                (bm->cur_addr - bm->addr) >= BMDMA_PAGE_SIZE) {
    148                return s->sg.size;
    149            }
    150            pci_dma_read(pci_dev, bm->cur_addr, &prd, 8);
    151            bm->cur_addr += 8;
    152            prd.addr = le32_to_cpu(prd.addr);
    153            prd.size = le32_to_cpu(prd.size);
    154            len = prd.size & 0xfffe;
    155            if (len == 0)
    156                len = 0x10000;
    157            bm->cur_prd_len = len;
    158            bm->cur_prd_addr = prd.addr;
    159            bm->cur_prd_last = (prd.size & 0x80000000);
    160        }
    161        l = bm->cur_prd_len;
    162        if (l > 0) {
    163            uint64_t sg_len;
    164
    165            /* Don't add extra bytes to the SGList; consume any remaining
    166             * PRDs from the guest, but ignore them. */
    167            sg_len = MIN(limit - s->sg.size, bm->cur_prd_len);
    168            if (sg_len) {
    169                qemu_sglist_add(&s->sg, bm->cur_prd_addr, sg_len);
    170            }
    171
    172            bm->cur_prd_addr += l;
    173            bm->cur_prd_len -= l;
    174            s->io_buffer_size += l;
    175        }
    176    }
    177
    178    qemu_sglist_destroy(&s->sg);
    179    s->io_buffer_size = 0;
    180    return -1;
    181}
    182
    183/* return 0 if buffer completed */
    184static int bmdma_rw_buf(const IDEDMA *dma, bool is_write)
    185{
    186    BMDMAState *bm = DO_UPCAST(BMDMAState, dma, dma);
    187    IDEState *s = bmdma_active_if(bm);
    188    PCIDevice *pci_dev = PCI_DEVICE(bm->pci_dev);
    189    struct {
    190        uint32_t addr;
    191        uint32_t size;
    192    } prd;
    193    int l, len;
    194
    195    for(;;) {
    196        l = s->io_buffer_size - s->io_buffer_index;
    197        if (l <= 0)
    198            break;
    199        if (bm->cur_prd_len == 0) {
    200            /* end of table (with a fail safe of one page) */
    201            if (bm->cur_prd_last ||
    202                (bm->cur_addr - bm->addr) >= BMDMA_PAGE_SIZE)
    203                return 0;
    204            pci_dma_read(pci_dev, bm->cur_addr, &prd, 8);
    205            bm->cur_addr += 8;
    206            prd.addr = le32_to_cpu(prd.addr);
    207            prd.size = le32_to_cpu(prd.size);
    208            len = prd.size & 0xfffe;
    209            if (len == 0)
    210                len = 0x10000;
    211            bm->cur_prd_len = len;
    212            bm->cur_prd_addr = prd.addr;
    213            bm->cur_prd_last = (prd.size & 0x80000000);
    214        }
    215        if (l > bm->cur_prd_len)
    216            l = bm->cur_prd_len;
    217        if (l > 0) {
    218            if (is_write) {
    219                pci_dma_write(pci_dev, bm->cur_prd_addr,
    220                              s->io_buffer + s->io_buffer_index, l);
    221            } else {
    222                pci_dma_read(pci_dev, bm->cur_prd_addr,
    223                             s->io_buffer + s->io_buffer_index, l);
    224            }
    225            bm->cur_prd_addr += l;
    226            bm->cur_prd_len -= l;
    227            s->io_buffer_index += l;
    228        }
    229    }
    230    return 1;
    231}
    232
    233static void bmdma_set_inactive(const IDEDMA *dma, bool more)
    234{
    235    BMDMAState *bm = DO_UPCAST(BMDMAState, dma, dma);
    236
    237    bm->dma_cb = NULL;
    238    if (more) {
    239        bm->status |= BM_STATUS_DMAING;
    240    } else {
    241        bm->status &= ~BM_STATUS_DMAING;
    242    }
    243}
    244
    245static void bmdma_restart_dma(const IDEDMA *dma)
    246{
    247    BMDMAState *bm = DO_UPCAST(BMDMAState, dma, dma);
    248
    249    bm->cur_addr = bm->addr;
    250}
    251
    252static void bmdma_cancel(BMDMAState *bm)
    253{
    254    if (bm->status & BM_STATUS_DMAING) {
    255        /* cancel DMA request */
    256        bmdma_set_inactive(&bm->dma, false);
    257    }
    258}
    259
    260static void bmdma_reset(const IDEDMA *dma)
    261{
    262    BMDMAState *bm = DO_UPCAST(BMDMAState, dma, dma);
    263
    264    trace_bmdma_reset();
    265    bmdma_cancel(bm);
    266    bm->cmd = 0;
    267    bm->status = 0;
    268    bm->addr = 0;
    269    bm->cur_addr = 0;
    270    bm->cur_prd_last = 0;
    271    bm->cur_prd_addr = 0;
    272    bm->cur_prd_len = 0;
    273}
    274
    275static void bmdma_irq(void *opaque, int n, int level)
    276{
    277    BMDMAState *bm = opaque;
    278
    279    if (!level) {
    280        /* pass through lower */
    281        qemu_set_irq(bm->irq, level);
    282        return;
    283    }
    284
    285    bm->status |= BM_STATUS_INT;
    286
    287    /* trigger the real irq */
    288    qemu_set_irq(bm->irq, level);
    289}
    290
    291void bmdma_cmd_writeb(BMDMAState *bm, uint32_t val)
    292{
    293    trace_bmdma_cmd_writeb(val);
    294
    295    /* Ignore writes to SSBM if it keeps the old value */
    296    if ((val & BM_CMD_START) != (bm->cmd & BM_CMD_START)) {
    297        if (!(val & BM_CMD_START)) {
    298            ide_cancel_dma_sync(idebus_active_if(bm->bus));
    299            bm->status &= ~BM_STATUS_DMAING;
    300        } else {
    301            bm->cur_addr = bm->addr;
    302            if (!(bm->status & BM_STATUS_DMAING)) {
    303                bm->status |= BM_STATUS_DMAING;
    304                /* start dma transfer if possible */
    305                if (bm->dma_cb)
    306                    bm->dma_cb(bmdma_active_if(bm), 0);
    307            }
    308        }
    309    }
    310
    311    bm->cmd = val & 0x09;
    312}
    313
    314static uint64_t bmdma_addr_read(void *opaque, hwaddr addr,
    315                                unsigned width)
    316{
    317    BMDMAState *bm = opaque;
    318    uint32_t mask = (1ULL << (width * 8)) - 1;
    319    uint64_t data;
    320
    321    data = (bm->addr >> (addr * 8)) & mask;
    322    trace_bmdma_addr_read(data);
    323    return data;
    324}
    325
    326static void bmdma_addr_write(void *opaque, hwaddr addr,
    327                             uint64_t data, unsigned width)
    328{
    329    BMDMAState *bm = opaque;
    330    int shift = addr * 8;
    331    uint32_t mask = (1ULL << (width * 8)) - 1;
    332
    333    trace_bmdma_addr_write(data);
    334    bm->addr &= ~(mask << shift);
    335    bm->addr |= ((data & mask) << shift) & ~3;
    336}
    337
    338MemoryRegionOps bmdma_addr_ioport_ops = {
    339    .read = bmdma_addr_read,
    340    .write = bmdma_addr_write,
    341    .endianness = DEVICE_LITTLE_ENDIAN,
    342};
    343
    344static bool ide_bmdma_current_needed(void *opaque)
    345{
    346    BMDMAState *bm = opaque;
    347
    348    return (bm->cur_prd_len != 0);
    349}
    350
    351static bool ide_bmdma_status_needed(void *opaque)
    352{
    353    BMDMAState *bm = opaque;
    354
    355    /* Older versions abused some bits in the status register for internal
    356     * error state. If any of these bits are set, we must add a subsection to
    357     * transfer the real status register */
    358    uint8_t abused_bits = BM_MIGRATION_COMPAT_STATUS_BITS;
    359
    360    return ((bm->status & abused_bits) != 0);
    361}
    362
    363static int ide_bmdma_pre_save(void *opaque)
    364{
    365    BMDMAState *bm = opaque;
    366    uint8_t abused_bits = BM_MIGRATION_COMPAT_STATUS_BITS;
    367
    368    if (!(bm->status & BM_STATUS_DMAING) && bm->dma_cb) {
    369        bm->bus->error_status =
    370            ide_dma_cmd_to_retry(bmdma_active_if(bm)->dma_cmd);
    371    }
    372    bm->migration_retry_unit = bm->bus->retry_unit;
    373    bm->migration_retry_sector_num = bm->bus->retry_sector_num;
    374    bm->migration_retry_nsector = bm->bus->retry_nsector;
    375    bm->migration_compat_status =
    376        (bm->status & ~abused_bits) | (bm->bus->error_status & abused_bits);
    377
    378    return 0;
    379}
    380
    381/* This function accesses bm->bus->error_status which is loaded only after
    382 * BMDMA itself. This is why the function is called from ide_pci_post_load
    383 * instead of being registered with VMState where it would run too early. */
    384static int ide_bmdma_post_load(void *opaque, int version_id)
    385{
    386    BMDMAState *bm = opaque;
    387    uint8_t abused_bits = BM_MIGRATION_COMPAT_STATUS_BITS;
    388
    389    if (bm->status == 0) {
    390        bm->status = bm->migration_compat_status & ~abused_bits;
    391        bm->bus->error_status |= bm->migration_compat_status & abused_bits;
    392    }
    393    if (bm->bus->error_status) {
    394        bm->bus->retry_sector_num = bm->migration_retry_sector_num;
    395        bm->bus->retry_nsector = bm->migration_retry_nsector;
    396        bm->bus->retry_unit = bm->migration_retry_unit;
    397    }
    398
    399    return 0;
    400}
    401
    402static const VMStateDescription vmstate_bmdma_current = {
    403    .name = "ide bmdma_current",
    404    .version_id = 1,
    405    .minimum_version_id = 1,
    406    .needed = ide_bmdma_current_needed,
    407    .fields = (VMStateField[]) {
    408        VMSTATE_UINT32(cur_addr, BMDMAState),
    409        VMSTATE_UINT32(cur_prd_last, BMDMAState),
    410        VMSTATE_UINT32(cur_prd_addr, BMDMAState),
    411        VMSTATE_UINT32(cur_prd_len, BMDMAState),
    412        VMSTATE_END_OF_LIST()
    413    }
    414};
    415
    416static const VMStateDescription vmstate_bmdma_status = {
    417    .name ="ide bmdma/status",
    418    .version_id = 1,
    419    .minimum_version_id = 1,
    420    .needed = ide_bmdma_status_needed,
    421    .fields = (VMStateField[]) {
    422        VMSTATE_UINT8(status, BMDMAState),
    423        VMSTATE_END_OF_LIST()
    424    }
    425};
    426
    427static const VMStateDescription vmstate_bmdma = {
    428    .name = "ide bmdma",
    429    .version_id = 3,
    430    .minimum_version_id = 0,
    431    .pre_save  = ide_bmdma_pre_save,
    432    .fields = (VMStateField[]) {
    433        VMSTATE_UINT8(cmd, BMDMAState),
    434        VMSTATE_UINT8(migration_compat_status, BMDMAState),
    435        VMSTATE_UINT32(addr, BMDMAState),
    436        VMSTATE_INT64(migration_retry_sector_num, BMDMAState),
    437        VMSTATE_UINT32(migration_retry_nsector, BMDMAState),
    438        VMSTATE_UINT8(migration_retry_unit, BMDMAState),
    439        VMSTATE_END_OF_LIST()
    440    },
    441    .subsections = (const VMStateDescription*[]) {
    442        &vmstate_bmdma_current,
    443        &vmstate_bmdma_status,
    444        NULL
    445    }
    446};
    447
    448static int ide_pci_post_load(void *opaque, int version_id)
    449{
    450    PCIIDEState *d = opaque;
    451    int i;
    452
    453    for(i = 0; i < 2; i++) {
    454        /* current versions always store 0/1, but older version
    455           stored bigger values. We only need last bit */
    456        d->bmdma[i].migration_retry_unit &= 1;
    457        ide_bmdma_post_load(&d->bmdma[i], -1);
    458    }
    459
    460    return 0;
    461}
    462
    463const VMStateDescription vmstate_ide_pci = {
    464    .name = "ide",
    465    .version_id = 3,
    466    .minimum_version_id = 0,
    467    .post_load = ide_pci_post_load,
    468    .fields = (VMStateField[]) {
    469        VMSTATE_PCI_DEVICE(parent_obj, PCIIDEState),
    470        VMSTATE_STRUCT_ARRAY(bmdma, PCIIDEState, 2, 0,
    471                             vmstate_bmdma, BMDMAState),
    472        VMSTATE_IDE_BUS_ARRAY(bus, PCIIDEState, 2),
    473        VMSTATE_IDE_DRIVES(bus[0].ifs, PCIIDEState),
    474        VMSTATE_IDE_DRIVES(bus[1].ifs, PCIIDEState),
    475        VMSTATE_END_OF_LIST()
    476    }
    477};
    478
    479/* hd_table must contain 4 block drivers */
    480void pci_ide_create_devs(PCIDevice *dev)
    481{
    482    PCIIDEState *d = PCI_IDE(dev);
    483    DriveInfo *hd_table[2 * MAX_IDE_DEVS];
    484    static const int bus[4]  = { 0, 0, 1, 1 };
    485    static const int unit[4] = { 0, 1, 0, 1 };
    486    int i;
    487
    488    ide_drive_get(hd_table, ARRAY_SIZE(hd_table));
    489    for (i = 0; i < 4; i++) {
    490        if (hd_table[i]) {
    491            ide_create_drive(d->bus + bus[i], unit[i], hd_table[i]);
    492        }
    493    }
    494}
    495
    496static const struct IDEDMAOps bmdma_ops = {
    497    .start_dma = bmdma_start_dma,
    498    .prepare_buf = bmdma_prepare_buf,
    499    .rw_buf = bmdma_rw_buf,
    500    .restart_dma = bmdma_restart_dma,
    501    .set_inactive = bmdma_set_inactive,
    502    .reset = bmdma_reset,
    503};
    504
    505void bmdma_init(IDEBus *bus, BMDMAState *bm, PCIIDEState *d)
    506{
    507    if (bus->dma == &bm->dma) {
    508        return;
    509    }
    510
    511    bm->dma.ops = &bmdma_ops;
    512    bus->dma = &bm->dma;
    513    bm->irq = bus->irq;
    514    bus->irq = qemu_allocate_irq(bmdma_irq, bm, 0);
    515    bm->pci_dev = d;
    516}
    517
    518static const TypeInfo pci_ide_type_info = {
    519    .name = TYPE_PCI_IDE,
    520    .parent = TYPE_PCI_DEVICE,
    521    .instance_size = sizeof(PCIIDEState),
    522    .abstract = true,
    523    .interfaces = (InterfaceInfo[]) {
    524        { INTERFACE_CONVENTIONAL_PCI_DEVICE },
    525        { },
    526    },
    527};
    528
    529static void pci_ide_register_types(void)
    530{
    531    type_register_static(&pci_ide_type_info);
    532}
    533
    534type_init(pci_ide_register_types)