cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

stellaris_enet.c (15374B)


      1/*
      2 * Luminary Micro Stellaris Ethernet Controller
      3 *
      4 * Copyright (c) 2007 CodeSourcery.
      5 * Written by Paul Brook
      6 *
      7 * This code is licensed under the GPL.
      8 */
      9
     10#include "qemu/osdep.h"
     11#include "hw/irq.h"
     12#include "hw/qdev-properties.h"
     13#include "hw/sysbus.h"
     14#include "migration/vmstate.h"
     15#include "net/net.h"
     16#include "qemu/log.h"
     17#include "qemu/module.h"
     18#include <zlib.h>
     19#include "qom/object.h"
     20
     21//#define DEBUG_STELLARIS_ENET 1
     22
     23#ifdef DEBUG_STELLARIS_ENET
     24#define DPRINTF(fmt, ...) \
     25do { printf("stellaris_enet: " fmt , ## __VA_ARGS__); } while (0)
     26#define BADF(fmt, ...) \
     27do { fprintf(stderr, "stellaris_enet: error: " fmt , ## __VA_ARGS__); exit(1);} while (0)
     28#else
     29#define DPRINTF(fmt, ...) do {} while(0)
     30#define BADF(fmt, ...) \
     31do { fprintf(stderr, "stellaris_enet: error: " fmt , ## __VA_ARGS__);} while (0)
     32#endif
     33
     34#define SE_INT_RX       0x01
     35#define SE_INT_TXER     0x02
     36#define SE_INT_TXEMP    0x04
     37#define SE_INT_FOV      0x08
     38#define SE_INT_RXER     0x10
     39#define SE_INT_MD       0x20
     40#define SE_INT_PHY      0x40
     41
     42#define SE_RCTL_RXEN    0x01
     43#define SE_RCTL_AMUL    0x02
     44#define SE_RCTL_PRMS    0x04
     45#define SE_RCTL_BADCRC  0x08
     46#define SE_RCTL_RSTFIFO 0x10
     47
     48#define SE_TCTL_TXEN    0x01
     49#define SE_TCTL_PADEN   0x02
     50#define SE_TCTL_CRC     0x04
     51#define SE_TCTL_DUPLEX  0x08
     52
     53#define TYPE_STELLARIS_ENET "stellaris_enet"
     54OBJECT_DECLARE_SIMPLE_TYPE(stellaris_enet_state, STELLARIS_ENET)
     55
     56typedef struct {
     57    uint8_t data[2048];
     58    uint32_t len;
     59} StellarisEnetRxFrame;
     60
     61struct stellaris_enet_state {
     62    SysBusDevice parent_obj;
     63
     64    uint32_t ris;
     65    uint32_t im;
     66    uint32_t rctl;
     67    uint32_t tctl;
     68    uint32_t thr;
     69    uint32_t mctl;
     70    uint32_t mdv;
     71    uint32_t mtxd;
     72    uint32_t mrxd;
     73    uint32_t np;
     74    uint32_t tx_fifo_len;
     75    uint8_t tx_fifo[2048];
     76    /* Real hardware has a 2k fifo, which works out to be at most 31 packets.
     77       We implement a full 31 packet fifo.  */
     78    StellarisEnetRxFrame rx[31];
     79    uint32_t rx_fifo_offset;
     80    uint32_t next_packet;
     81    NICState *nic;
     82    NICConf conf;
     83    qemu_irq irq;
     84    MemoryRegion mmio;
     85};
     86
     87static const VMStateDescription vmstate_rx_frame = {
     88    .name = "stellaris_enet/rx_frame",
     89    .version_id = 1,
     90    .minimum_version_id = 1,
     91    .fields = (VMStateField[]) {
     92        VMSTATE_UINT8_ARRAY(data, StellarisEnetRxFrame, 2048),
     93        VMSTATE_UINT32(len, StellarisEnetRxFrame),
     94        VMSTATE_END_OF_LIST()
     95    }
     96};
     97
     98static int stellaris_enet_post_load(void *opaque, int version_id)
     99{
    100    stellaris_enet_state *s = opaque;
    101    int i;
    102
    103    /* Sanitize inbound state. Note that next_packet is an index but
    104     * np is a size; hence their valid upper bounds differ.
    105     */
    106    if (s->next_packet >= ARRAY_SIZE(s->rx)) {
    107        return -1;
    108    }
    109
    110    if (s->np > ARRAY_SIZE(s->rx)) {
    111        return -1;
    112    }
    113
    114    for (i = 0; i < ARRAY_SIZE(s->rx); i++) {
    115        if (s->rx[i].len > ARRAY_SIZE(s->rx[i].data)) {
    116            return -1;
    117        }
    118    }
    119
    120    if (s->rx_fifo_offset > ARRAY_SIZE(s->rx[0].data) - 4) {
    121        return -1;
    122    }
    123
    124    if (s->tx_fifo_len > ARRAY_SIZE(s->tx_fifo)) {
    125        return -1;
    126    }
    127
    128    return 0;
    129}
    130
    131static const VMStateDescription vmstate_stellaris_enet = {
    132    .name = "stellaris_enet",
    133    .version_id = 2,
    134    .minimum_version_id = 2,
    135    .post_load = stellaris_enet_post_load,
    136    .fields = (VMStateField[]) {
    137        VMSTATE_UINT32(ris, stellaris_enet_state),
    138        VMSTATE_UINT32(im, stellaris_enet_state),
    139        VMSTATE_UINT32(rctl, stellaris_enet_state),
    140        VMSTATE_UINT32(tctl, stellaris_enet_state),
    141        VMSTATE_UINT32(thr, stellaris_enet_state),
    142        VMSTATE_UINT32(mctl, stellaris_enet_state),
    143        VMSTATE_UINT32(mdv, stellaris_enet_state),
    144        VMSTATE_UINT32(mtxd, stellaris_enet_state),
    145        VMSTATE_UINT32(mrxd, stellaris_enet_state),
    146        VMSTATE_UINT32(np, stellaris_enet_state),
    147        VMSTATE_UINT32(tx_fifo_len, stellaris_enet_state),
    148        VMSTATE_UINT8_ARRAY(tx_fifo, stellaris_enet_state, 2048),
    149        VMSTATE_STRUCT_ARRAY(rx, stellaris_enet_state, 31, 1,
    150                             vmstate_rx_frame, StellarisEnetRxFrame),
    151        VMSTATE_UINT32(rx_fifo_offset, stellaris_enet_state),
    152        VMSTATE_UINT32(next_packet, stellaris_enet_state),
    153        VMSTATE_END_OF_LIST()
    154    }
    155};
    156
    157static void stellaris_enet_update(stellaris_enet_state *s)
    158{
    159    qemu_set_irq(s->irq, (s->ris & s->im) != 0);
    160}
    161
    162/* Return the data length of the packet currently being assembled
    163 * in the TX fifo.
    164 */
    165static inline int stellaris_txpacket_datalen(stellaris_enet_state *s)
    166{
    167    return s->tx_fifo[0] | (s->tx_fifo[1] << 8);
    168}
    169
    170/* Return true if the packet currently in the TX FIFO is complete,
    171* ie the FIFO holds enough bytes for the data length, ethernet header,
    172* payload and optionally CRC.
    173*/
    174static inline bool stellaris_txpacket_complete(stellaris_enet_state *s)
    175{
    176    int framelen = stellaris_txpacket_datalen(s);
    177    framelen += 16;
    178    if (!(s->tctl & SE_TCTL_CRC)) {
    179        framelen += 4;
    180    }
    181    /* Cover the corner case of a 2032 byte payload with auto-CRC disabled:
    182     * this requires more bytes than will fit in the FIFO. It's not totally
    183     * clear how the h/w handles this, but if using threshold-based TX
    184     * it will definitely try to transmit something.
    185     */
    186    framelen = MIN(framelen, ARRAY_SIZE(s->tx_fifo));
    187    return s->tx_fifo_len >= framelen;
    188}
    189
    190/* Return true if the TX FIFO threshold is enabled and the FIFO
    191 * has filled enough to reach it.
    192 */
    193static inline bool stellaris_tx_thr_reached(stellaris_enet_state *s)
    194{
    195    return (s->thr < 0x3f &&
    196            (s->tx_fifo_len >= 4 * (s->thr * 8 + 1)));
    197}
    198
    199/* Send the packet currently in the TX FIFO */
    200static void stellaris_enet_send(stellaris_enet_state *s)
    201{
    202    int framelen = stellaris_txpacket_datalen(s);
    203
    204    /* Ethernet header is in the FIFO but not in the datacount.
    205     * We don't implement explicit CRC, so just ignore any
    206     * CRC value in the FIFO.
    207     */
    208    framelen += 14;
    209    if ((s->tctl & SE_TCTL_PADEN) && framelen < 60) {
    210        memset(&s->tx_fifo[framelen + 2], 0, 60 - framelen);
    211        framelen = 60;
    212    }
    213    /* This MIN will have no effect unless the FIFO data is corrupt
    214     * (eg bad data from an incoming migration); otherwise the check
    215     * on the datalen at the start of writing the data into the FIFO
    216     * will have caught this. Silently write a corrupt half-packet,
    217     * which is what the hardware does in FIFO underrun situations.
    218     */
    219    framelen = MIN(framelen, ARRAY_SIZE(s->tx_fifo) - 2);
    220    qemu_send_packet(qemu_get_queue(s->nic), s->tx_fifo + 2, framelen);
    221    s->tx_fifo_len = 0;
    222    s->ris |= SE_INT_TXEMP;
    223    stellaris_enet_update(s);
    224    DPRINTF("Done TX\n");
    225}
    226
    227/* TODO: Implement MAC address filtering.  */
    228static ssize_t stellaris_enet_receive(NetClientState *nc, const uint8_t *buf, size_t size)
    229{
    230    stellaris_enet_state *s = qemu_get_nic_opaque(nc);
    231    int n;
    232    uint8_t *p;
    233    uint32_t crc;
    234
    235    if ((s->rctl & SE_RCTL_RXEN) == 0)
    236        return -1;
    237    if (s->np >= 31) {
    238        return 0;
    239    }
    240
    241    DPRINTF("Received packet len=%zu\n", size);
    242    n = s->next_packet + s->np;
    243    if (n >= 31)
    244        n -= 31;
    245
    246    if (size >= sizeof(s->rx[n].data) - 6) {
    247        /* If the packet won't fit into the
    248         * emulated 2K RAM, this is reported
    249         * as a FIFO overrun error.
    250         */
    251        s->ris |= SE_INT_FOV;
    252        stellaris_enet_update(s);
    253        return -1;
    254    }
    255
    256    s->np++;
    257    s->rx[n].len = size + 6;
    258    p = s->rx[n].data;
    259    *(p++) = (size + 6);
    260    *(p++) = (size + 6) >> 8;
    261    memcpy (p, buf, size);
    262    p += size;
    263    crc = crc32(~0, buf, size);
    264    *(p++) = crc;
    265    *(p++) = crc >> 8;
    266    *(p++) = crc >> 16;
    267    *(p++) = crc >> 24;
    268    /* Clear the remaining bytes in the last word.  */
    269    if ((size & 3) != 2) {
    270        memset(p, 0, (6 - size) & 3);
    271    }
    272
    273    s->ris |= SE_INT_RX;
    274    stellaris_enet_update(s);
    275
    276    return size;
    277}
    278
    279static int stellaris_enet_can_receive(stellaris_enet_state *s)
    280{
    281    return (s->np < 31);
    282}
    283
    284static uint64_t stellaris_enet_read(void *opaque, hwaddr offset,
    285                                    unsigned size)
    286{
    287    stellaris_enet_state *s = (stellaris_enet_state *)opaque;
    288    uint32_t val;
    289
    290    switch (offset) {
    291    case 0x00: /* RIS */
    292        DPRINTF("IRQ status %02x\n", s->ris);
    293        return s->ris;
    294    case 0x04: /* IM */
    295        return s->im;
    296    case 0x08: /* RCTL */
    297        return s->rctl;
    298    case 0x0c: /* TCTL */
    299        return s->tctl;
    300    case 0x10: /* DATA */
    301    {
    302        uint8_t *rx_fifo;
    303
    304        if (s->np == 0) {
    305            BADF("RX underflow\n");
    306            return 0;
    307        }
    308
    309        rx_fifo = s->rx[s->next_packet].data + s->rx_fifo_offset;
    310
    311        val = rx_fifo[0] | (rx_fifo[1] << 8) | (rx_fifo[2] << 16)
    312              | (rx_fifo[3] << 24);
    313        s->rx_fifo_offset += 4;
    314        if (s->rx_fifo_offset >= s->rx[s->next_packet].len) {
    315            s->rx_fifo_offset = 0;
    316            s->next_packet++;
    317            if (s->next_packet >= 31)
    318                s->next_packet = 0;
    319            s->np--;
    320            DPRINTF("RX done np=%d\n", s->np);
    321            if (!s->np && stellaris_enet_can_receive(s)) {
    322                qemu_flush_queued_packets(qemu_get_queue(s->nic));
    323            }
    324        }
    325        return val;
    326    }
    327    case 0x14: /* IA0 */
    328        return s->conf.macaddr.a[0] | (s->conf.macaddr.a[1] << 8)
    329            | (s->conf.macaddr.a[2] << 16)
    330            | ((uint32_t)s->conf.macaddr.a[3] << 24);
    331    case 0x18: /* IA1 */
    332        return s->conf.macaddr.a[4] | (s->conf.macaddr.a[5] << 8);
    333    case 0x1c: /* THR */
    334        return s->thr;
    335    case 0x20: /* MCTL */
    336        return s->mctl;
    337    case 0x24: /* MDV */
    338        return s->mdv;
    339    case 0x28: /* MADD */
    340        return 0;
    341    case 0x2c: /* MTXD */
    342        return s->mtxd;
    343    case 0x30: /* MRXD */
    344        return s->mrxd;
    345    case 0x34: /* NP */
    346        return s->np;
    347    case 0x38: /* TR */
    348        return 0;
    349    case 0x3c: /* Undocumented: Timestamp? */
    350        return 0;
    351    default:
    352        qemu_log_mask(LOG_GUEST_ERROR, "stellaris_enet_rd%d: Illegal register"
    353                                       " 0x02%" HWADDR_PRIx "\n",
    354                      size * 8, offset);
    355        return 0;
    356    }
    357}
    358
    359static void stellaris_enet_write(void *opaque, hwaddr offset,
    360                                 uint64_t value, unsigned size)
    361{
    362    stellaris_enet_state *s = (stellaris_enet_state *)opaque;
    363
    364    switch (offset) {
    365    case 0x00: /* IACK */
    366        s->ris &= ~value;
    367        DPRINTF("IRQ ack %02" PRIx64 "/%02x\n", value, s->ris);
    368        stellaris_enet_update(s);
    369        /* Clearing TXER also resets the TX fifo.  */
    370        if (value & SE_INT_TXER) {
    371            s->tx_fifo_len = 0;
    372        }
    373        break;
    374    case 0x04: /* IM */
    375        DPRINTF("IRQ mask %02" PRIx64 "/%02x\n", value, s->ris);
    376        s->im = value;
    377        stellaris_enet_update(s);
    378        break;
    379    case 0x08: /* RCTL */
    380        s->rctl = value;
    381        if (value & SE_RCTL_RSTFIFO) {
    382            s->np = 0;
    383            s->rx_fifo_offset = 0;
    384            stellaris_enet_update(s);
    385        }
    386        break;
    387    case 0x0c: /* TCTL */
    388        s->tctl = value;
    389        break;
    390    case 0x10: /* DATA */
    391        if (s->tx_fifo_len == 0) {
    392            /* The first word is special, it contains the data length */
    393            int framelen = value & 0xffff;
    394            if (framelen > 2032) {
    395                DPRINTF("TX frame too long (%d)\n", framelen);
    396                s->ris |= SE_INT_TXER;
    397                stellaris_enet_update(s);
    398                break;
    399            }
    400        }
    401
    402        if (s->tx_fifo_len + 4 <= ARRAY_SIZE(s->tx_fifo)) {
    403            s->tx_fifo[s->tx_fifo_len++] = value;
    404            s->tx_fifo[s->tx_fifo_len++] = value >> 8;
    405            s->tx_fifo[s->tx_fifo_len++] = value >> 16;
    406            s->tx_fifo[s->tx_fifo_len++] = value >> 24;
    407        }
    408
    409        if (stellaris_tx_thr_reached(s) && stellaris_txpacket_complete(s)) {
    410            stellaris_enet_send(s);
    411        }
    412        break;
    413    case 0x14: /* IA0 */
    414        s->conf.macaddr.a[0] = value;
    415        s->conf.macaddr.a[1] = value >> 8;
    416        s->conf.macaddr.a[2] = value >> 16;
    417        s->conf.macaddr.a[3] = value >> 24;
    418        break;
    419    case 0x18: /* IA1 */
    420        s->conf.macaddr.a[4] = value;
    421        s->conf.macaddr.a[5] = value >> 8;
    422        break;
    423    case 0x1c: /* THR */
    424        s->thr = value;
    425        break;
    426    case 0x20: /* MCTL */
    427        /* TODO: MII registers aren't modelled.
    428         * Clear START, indicating that the operation completes immediately.
    429         */
    430        s->mctl = value & ~1;
    431        break;
    432    case 0x24: /* MDV */
    433        s->mdv = value;
    434        break;
    435    case 0x28: /* MADD */
    436        /* ignored.  */
    437        break;
    438    case 0x2c: /* MTXD */
    439        s->mtxd = value & 0xff;
    440        break;
    441    case 0x38: /* TR */
    442        if (value & 1) {
    443            stellaris_enet_send(s);
    444        }
    445        break;
    446    case 0x30: /* MRXD */
    447    case 0x34: /* NP */
    448        /* Ignored.  */
    449    case 0x3c: /* Undocuented: Timestamp? */
    450        /* Ignored.  */
    451        break;
    452    default:
    453        qemu_log_mask(LOG_GUEST_ERROR, "stellaris_enet_wr%d: Illegal register "
    454                                       "0x02%" HWADDR_PRIx " = 0x%" PRIx64 "\n",
    455                      size * 8, offset, value);
    456    }
    457}
    458
    459static const MemoryRegionOps stellaris_enet_ops = {
    460    .read = stellaris_enet_read,
    461    .write = stellaris_enet_write,
    462    .endianness = DEVICE_NATIVE_ENDIAN,
    463};
    464
    465static void stellaris_enet_reset(DeviceState *dev)
    466{
    467    stellaris_enet_state *s =  STELLARIS_ENET(dev);
    468
    469    s->mdv = 0x80;
    470    s->rctl = SE_RCTL_BADCRC;
    471    s->im = SE_INT_PHY | SE_INT_MD | SE_INT_RXER | SE_INT_FOV | SE_INT_TXEMP
    472            | SE_INT_TXER | SE_INT_RX;
    473    s->thr = 0x3f;
    474    s->tx_fifo_len = 0;
    475}
    476
    477static NetClientInfo net_stellaris_enet_info = {
    478    .type = NET_CLIENT_DRIVER_NIC,
    479    .size = sizeof(NICState),
    480    .receive = stellaris_enet_receive,
    481};
    482
    483static void stellaris_enet_realize(DeviceState *dev, Error **errp)
    484{
    485    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
    486    stellaris_enet_state *s = STELLARIS_ENET(dev);
    487
    488    memory_region_init_io(&s->mmio, OBJECT(s), &stellaris_enet_ops, s,
    489                          "stellaris_enet", 0x1000);
    490    sysbus_init_mmio(sbd, &s->mmio);
    491    sysbus_init_irq(sbd, &s->irq);
    492    qemu_macaddr_default_if_unset(&s->conf.macaddr);
    493
    494    s->nic = qemu_new_nic(&net_stellaris_enet_info, &s->conf,
    495                          object_get_typename(OBJECT(dev)), dev->id, s);
    496    qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
    497}
    498
    499static Property stellaris_enet_properties[] = {
    500    DEFINE_NIC_PROPERTIES(stellaris_enet_state, conf),
    501    DEFINE_PROP_END_OF_LIST(),
    502};
    503
    504static void stellaris_enet_class_init(ObjectClass *klass, void *data)
    505{
    506    DeviceClass *dc = DEVICE_CLASS(klass);
    507
    508    dc->realize = stellaris_enet_realize;
    509    dc->reset = stellaris_enet_reset;
    510    device_class_set_props(dc, stellaris_enet_properties);
    511    dc->vmsd = &vmstate_stellaris_enet;
    512}
    513
    514static const TypeInfo stellaris_enet_info = {
    515    .name          = TYPE_STELLARIS_ENET,
    516    .parent        = TYPE_SYS_BUS_DEVICE,
    517    .instance_size = sizeof(stellaris_enet_state),
    518    .class_init    = stellaris_enet_class_init,
    519};
    520
    521static void stellaris_enet_register_types(void)
    522{
    523    type_register_static(&stellaris_enet_info);
    524}
    525
    526type_init(stellaris_enet_register_types)