cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

xgmac.c (15236B)


      1/*
      2 * QEMU model of XGMAC Ethernet.
      3 *
      4 * derived from the Xilinx AXI-Ethernet by Edgar E. Iglesias.
      5 *
      6 * Copyright (c) 2011 Calxeda, Inc.
      7 *
      8 * Permission is hereby granted, free of charge, to any person obtaining a copy
      9 * of this software and associated documentation files (the "Software"), to deal
     10 * in the Software without restriction, including without limitation the rights
     11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     12 * copies of the Software, and to permit persons to whom the Software is
     13 * furnished to do so, subject to the following conditions:
     14 *
     15 * The above copyright notice and this permission notice shall be included in
     16 * all copies or substantial portions of the Software.
     17 *
     18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     24 * THE SOFTWARE.
     25 */
     26
     27#include "qemu/osdep.h"
     28#include "hw/irq.h"
     29#include "hw/qdev-properties.h"
     30#include "hw/sysbus.h"
     31#include "migration/vmstate.h"
     32#include "qemu/module.h"
     33#include "net/net.h"
     34#include "qom/object.h"
     35
     36#ifdef DEBUG_XGMAC
     37#define DEBUGF_BRK(message, args...) do { \
     38                                         fprintf(stderr, (message), ## args); \
     39                                     } while (0)
     40#else
     41#define DEBUGF_BRK(message, args...) do { } while (0)
     42#endif
     43
     44#define XGMAC_CONTROL           0x00000000   /* MAC Configuration */
     45#define XGMAC_FRAME_FILTER      0x00000001   /* MAC Frame Filter */
     46#define XGMAC_FLOW_CTRL         0x00000006   /* MAC Flow Control */
     47#define XGMAC_VLAN_TAG          0x00000007   /* VLAN Tags */
     48#define XGMAC_VERSION           0x00000008   /* Version */
     49/* VLAN tag for insertion or replacement into tx frames */
     50#define XGMAC_VLAN_INCL         0x00000009
     51#define XGMAC_LPI_CTRL          0x0000000a   /* LPI Control and Status */
     52#define XGMAC_LPI_TIMER         0x0000000b   /* LPI Timers Control */
     53#define XGMAC_TX_PACE           0x0000000c   /* Transmit Pace and Stretch */
     54#define XGMAC_VLAN_HASH         0x0000000d   /* VLAN Hash Table */
     55#define XGMAC_DEBUG             0x0000000e   /* Debug */
     56#define XGMAC_INT_STATUS        0x0000000f   /* Interrupt and Control */
     57/* HASH table registers */
     58#define XGMAC_HASH(n)           ((0x00000300/4) + (n))
     59#define XGMAC_NUM_HASH          16
     60/* Operation Mode */
     61#define XGMAC_OPMODE            (0x00000400/4)
     62/* Remote Wake-Up Frame Filter */
     63#define XGMAC_REMOTE_WAKE       (0x00000700/4)
     64/* PMT Control and Status */
     65#define XGMAC_PMT               (0x00000704/4)
     66
     67#define XGMAC_ADDR_HIGH(reg)    (0x00000010+((reg) * 2))
     68#define XGMAC_ADDR_LOW(reg)     (0x00000011+((reg) * 2))
     69
     70#define DMA_BUS_MODE            0x000003c0   /* Bus Mode */
     71#define DMA_XMT_POLL_DEMAND     0x000003c1   /* Transmit Poll Demand */
     72#define DMA_RCV_POLL_DEMAND     0x000003c2   /* Received Poll Demand */
     73#define DMA_RCV_BASE_ADDR       0x000003c3   /* Receive List Base */
     74#define DMA_TX_BASE_ADDR        0x000003c4   /* Transmit List Base */
     75#define DMA_STATUS              0x000003c5   /* Status Register */
     76#define DMA_CONTROL             0x000003c6   /* Ctrl (Operational Mode) */
     77#define DMA_INTR_ENA            0x000003c7   /* Interrupt Enable */
     78#define DMA_MISSED_FRAME_CTR    0x000003c8   /* Missed Frame Counter */
     79/* Receive Interrupt Watchdog Timer */
     80#define DMA_RI_WATCHDOG_TIMER   0x000003c9
     81#define DMA_AXI_BUS             0x000003ca   /* AXI Bus Mode */
     82#define DMA_AXI_STATUS          0x000003cb   /* AXI Status */
     83#define DMA_CUR_TX_DESC_ADDR    0x000003d2   /* Current Host Tx Descriptor */
     84#define DMA_CUR_RX_DESC_ADDR    0x000003d3   /* Current Host Rx Descriptor */
     85#define DMA_CUR_TX_BUF_ADDR     0x000003d4   /* Current Host Tx Buffer */
     86#define DMA_CUR_RX_BUF_ADDR     0x000003d5   /* Current Host Rx Buffer */
     87#define DMA_HW_FEATURE          0x000003d6   /* Enabled Hardware Features */
     88
     89/* DMA Status register defines */
     90#define DMA_STATUS_GMI          0x08000000   /* MMC interrupt */
     91#define DMA_STATUS_GLI          0x04000000   /* GMAC Line interface int */
     92#define DMA_STATUS_EB_MASK      0x00380000   /* Error Bits Mask */
     93#define DMA_STATUS_EB_TX_ABORT  0x00080000   /* Error Bits - TX Abort */
     94#define DMA_STATUS_EB_RX_ABORT  0x00100000   /* Error Bits - RX Abort */
     95#define DMA_STATUS_TS_MASK      0x00700000   /* Transmit Process State */
     96#define DMA_STATUS_TS_SHIFT     20
     97#define DMA_STATUS_RS_MASK      0x000e0000   /* Receive Process State */
     98#define DMA_STATUS_RS_SHIFT     17
     99#define DMA_STATUS_NIS          0x00010000   /* Normal Interrupt Summary */
    100#define DMA_STATUS_AIS          0x00008000   /* Abnormal Interrupt Summary */
    101#define DMA_STATUS_ERI          0x00004000   /* Early Receive Interrupt */
    102#define DMA_STATUS_FBI          0x00002000   /* Fatal Bus Error Interrupt */
    103#define DMA_STATUS_ETI          0x00000400   /* Early Transmit Interrupt */
    104#define DMA_STATUS_RWT          0x00000200   /* Receive Watchdog Timeout */
    105#define DMA_STATUS_RPS          0x00000100   /* Receive Process Stopped */
    106#define DMA_STATUS_RU           0x00000080   /* Receive Buffer Unavailable */
    107#define DMA_STATUS_RI           0x00000040   /* Receive Interrupt */
    108#define DMA_STATUS_UNF          0x00000020   /* Transmit Underflow */
    109#define DMA_STATUS_OVF          0x00000010   /* Receive Overflow */
    110#define DMA_STATUS_TJT          0x00000008   /* Transmit Jabber Timeout */
    111#define DMA_STATUS_TU           0x00000004   /* Transmit Buffer Unavailable */
    112#define DMA_STATUS_TPS          0x00000002   /* Transmit Process Stopped */
    113#define DMA_STATUS_TI           0x00000001   /* Transmit Interrupt */
    114
    115/* DMA Control register defines */
    116#define DMA_CONTROL_ST          0x00002000   /* Start/Stop Transmission */
    117#define DMA_CONTROL_SR          0x00000002   /* Start/Stop Receive */
    118#define DMA_CONTROL_DFF         0x01000000   /* Disable flush of rx frames */
    119
    120struct desc {
    121    uint32_t ctl_stat;
    122    uint16_t buffer1_size;
    123    uint16_t buffer2_size;
    124    uint32_t buffer1_addr;
    125    uint32_t buffer2_addr;
    126    uint32_t ext_stat;
    127    uint32_t res[3];
    128};
    129
    130#define R_MAX 0x400
    131
    132typedef struct RxTxStats {
    133    uint64_t rx_bytes;
    134    uint64_t tx_bytes;
    135
    136    uint64_t rx;
    137    uint64_t rx_bcast;
    138    uint64_t rx_mcast;
    139} RxTxStats;
    140
    141#define TYPE_XGMAC "xgmac"
    142OBJECT_DECLARE_SIMPLE_TYPE(XgmacState, XGMAC)
    143
    144struct XgmacState {
    145    SysBusDevice parent_obj;
    146
    147    MemoryRegion iomem;
    148    qemu_irq sbd_irq;
    149    qemu_irq pmt_irq;
    150    qemu_irq mci_irq;
    151    NICState *nic;
    152    NICConf conf;
    153
    154    struct RxTxStats stats;
    155    uint32_t regs[R_MAX];
    156};
    157
    158static const VMStateDescription vmstate_rxtx_stats = {
    159    .name = "xgmac_stats",
    160    .version_id = 1,
    161    .minimum_version_id = 1,
    162    .fields = (VMStateField[]) {
    163        VMSTATE_UINT64(rx_bytes, RxTxStats),
    164        VMSTATE_UINT64(tx_bytes, RxTxStats),
    165        VMSTATE_UINT64(rx, RxTxStats),
    166        VMSTATE_UINT64(rx_bcast, RxTxStats),
    167        VMSTATE_UINT64(rx_mcast, RxTxStats),
    168        VMSTATE_END_OF_LIST()
    169    }
    170};
    171
    172static const VMStateDescription vmstate_xgmac = {
    173    .name = "xgmac",
    174    .version_id = 1,
    175    .minimum_version_id = 1,
    176    .fields = (VMStateField[]) {
    177        VMSTATE_STRUCT(stats, XgmacState, 0, vmstate_rxtx_stats, RxTxStats),
    178        VMSTATE_UINT32_ARRAY(regs, XgmacState, R_MAX),
    179        VMSTATE_END_OF_LIST()
    180    }
    181};
    182
    183static void xgmac_read_desc(XgmacState *s, struct desc *d, int rx)
    184{
    185    uint32_t addr = rx ? s->regs[DMA_CUR_RX_DESC_ADDR] :
    186        s->regs[DMA_CUR_TX_DESC_ADDR];
    187    cpu_physical_memory_read(addr, d, sizeof(*d));
    188}
    189
    190static void xgmac_write_desc(XgmacState *s, struct desc *d, int rx)
    191{
    192    int reg = rx ? DMA_CUR_RX_DESC_ADDR : DMA_CUR_TX_DESC_ADDR;
    193    uint32_t addr = s->regs[reg];
    194
    195    if (!rx && (d->ctl_stat & 0x00200000)) {
    196        s->regs[reg] = s->regs[DMA_TX_BASE_ADDR];
    197    } else if (rx && (d->buffer1_size & 0x8000)) {
    198        s->regs[reg] = s->regs[DMA_RCV_BASE_ADDR];
    199    } else {
    200        s->regs[reg] += sizeof(*d);
    201    }
    202    cpu_physical_memory_write(addr, d, sizeof(*d));
    203}
    204
    205static void xgmac_enet_send(XgmacState *s)
    206{
    207    struct desc bd;
    208    int frame_size;
    209    int len;
    210    uint8_t frame[8192];
    211    uint8_t *ptr;
    212
    213    ptr = frame;
    214    frame_size = 0;
    215    while (1) {
    216        xgmac_read_desc(s, &bd, 0);
    217        if ((bd.ctl_stat & 0x80000000) == 0) {
    218            /* Run out of descriptors to transmit.  */
    219            break;
    220        }
    221        len = (bd.buffer1_size & 0xfff) + (bd.buffer2_size & 0xfff);
    222
    223        /*
    224         * FIXME: these cases of malformed tx descriptors (bad sizes)
    225         * should probably be reported back to the guest somehow
    226         * rather than simply silently stopping processing, but we
    227         * don't know what the hardware does in this situation.
    228         * This will only happen for buggy guests anyway.
    229         */
    230        if ((bd.buffer1_size & 0xfff) > 2048) {
    231            DEBUGF_BRK("qemu:%s:ERROR...ERROR...ERROR... -- "
    232                        "xgmac buffer 1 len on send > 2048 (0x%x)\n",
    233                         __func__, bd.buffer1_size & 0xfff);
    234            break;
    235        }
    236        if ((bd.buffer2_size & 0xfff) != 0) {
    237            DEBUGF_BRK("qemu:%s:ERROR...ERROR...ERROR... -- "
    238                        "xgmac buffer 2 len on send != 0 (0x%x)\n",
    239                        __func__, bd.buffer2_size & 0xfff);
    240            break;
    241        }
    242        if (frame_size + len >= sizeof(frame)) {
    243            DEBUGF_BRK("qemu:%s: buffer overflow %d read into %zu "
    244                        "buffer\n" , __func__, frame_size + len, sizeof(frame));
    245            DEBUGF_BRK("qemu:%s: buffer1.size=%d; buffer2.size=%d\n",
    246                        __func__, bd.buffer1_size, bd.buffer2_size);
    247            break;
    248        }
    249
    250        cpu_physical_memory_read(bd.buffer1_addr, ptr, len);
    251        ptr += len;
    252        frame_size += len;
    253        if (bd.ctl_stat & 0x20000000) {
    254            /* Last buffer in frame.  */
    255            qemu_send_packet(qemu_get_queue(s->nic), frame, len);
    256            ptr = frame;
    257            frame_size = 0;
    258            s->regs[DMA_STATUS] |= DMA_STATUS_TI | DMA_STATUS_NIS;
    259        }
    260        bd.ctl_stat &= ~0x80000000;
    261        /* Write back the modified descriptor.  */
    262        xgmac_write_desc(s, &bd, 0);
    263    }
    264}
    265
    266static void enet_update_irq(XgmacState *s)
    267{
    268    int stat = s->regs[DMA_STATUS] & s->regs[DMA_INTR_ENA];
    269    qemu_set_irq(s->sbd_irq, !!stat);
    270}
    271
    272static uint64_t enet_read(void *opaque, hwaddr addr, unsigned size)
    273{
    274    XgmacState *s = opaque;
    275    uint64_t r = 0;
    276    addr >>= 2;
    277
    278    switch (addr) {
    279    case XGMAC_VERSION:
    280        r = 0x1012;
    281        break;
    282    default:
    283        if (addr < ARRAY_SIZE(s->regs)) {
    284            r = s->regs[addr];
    285        }
    286        break;
    287    }
    288    return r;
    289}
    290
    291static void enet_write(void *opaque, hwaddr addr,
    292                       uint64_t value, unsigned size)
    293{
    294    XgmacState *s = opaque;
    295
    296    addr >>= 2;
    297    switch (addr) {
    298    case DMA_BUS_MODE:
    299        s->regs[DMA_BUS_MODE] = value & ~0x1;
    300        break;
    301    case DMA_XMT_POLL_DEMAND:
    302        xgmac_enet_send(s);
    303        break;
    304    case DMA_STATUS:
    305        s->regs[DMA_STATUS] = s->regs[DMA_STATUS] & ~value;
    306        break;
    307    case DMA_RCV_BASE_ADDR:
    308        s->regs[DMA_RCV_BASE_ADDR] = s->regs[DMA_CUR_RX_DESC_ADDR] = value;
    309        break;
    310    case DMA_TX_BASE_ADDR:
    311        s->regs[DMA_TX_BASE_ADDR] = s->regs[DMA_CUR_TX_DESC_ADDR] = value;
    312        break;
    313    default:
    314        if (addr < ARRAY_SIZE(s->regs)) {
    315            s->regs[addr] = value;
    316        }
    317        break;
    318    }
    319    enet_update_irq(s);
    320}
    321
    322static const MemoryRegionOps enet_mem_ops = {
    323    .read = enet_read,
    324    .write = enet_write,
    325    .endianness = DEVICE_LITTLE_ENDIAN,
    326};
    327
    328static int eth_can_rx(XgmacState *s)
    329{
    330    /* RX enabled?  */
    331    return s->regs[DMA_CONTROL] & DMA_CONTROL_SR;
    332}
    333
    334static ssize_t eth_rx(NetClientState *nc, const uint8_t *buf, size_t size)
    335{
    336    XgmacState *s = qemu_get_nic_opaque(nc);
    337    static const unsigned char sa_bcast[6] = {0xff, 0xff, 0xff,
    338                                              0xff, 0xff, 0xff};
    339    int unicast, broadcast, multicast;
    340    struct desc bd;
    341    ssize_t ret;
    342
    343    if (!eth_can_rx(s)) {
    344        return -1;
    345    }
    346    unicast = ~buf[0] & 0x1;
    347    broadcast = memcmp(buf, sa_bcast, 6) == 0;
    348    multicast = !unicast && !broadcast;
    349    if (size < 12) {
    350        s->regs[DMA_STATUS] |= DMA_STATUS_RI | DMA_STATUS_NIS;
    351        ret = -1;
    352        goto out;
    353    }
    354
    355    xgmac_read_desc(s, &bd, 1);
    356    if ((bd.ctl_stat & 0x80000000) == 0) {
    357        s->regs[DMA_STATUS] |= DMA_STATUS_RU | DMA_STATUS_AIS;
    358        ret = size;
    359        goto out;
    360    }
    361
    362    cpu_physical_memory_write(bd.buffer1_addr, buf, size);
    363
    364    /* Add in the 4 bytes for crc (the real hw returns length incl crc) */
    365    size += 4;
    366    bd.ctl_stat = (size << 16) | 0x300;
    367    xgmac_write_desc(s, &bd, 1);
    368
    369    s->stats.rx_bytes += size;
    370    s->stats.rx++;
    371    if (multicast) {
    372        s->stats.rx_mcast++;
    373    } else if (broadcast) {
    374        s->stats.rx_bcast++;
    375    }
    376
    377    s->regs[DMA_STATUS] |= DMA_STATUS_RI | DMA_STATUS_NIS;
    378    ret = size;
    379
    380out:
    381    enet_update_irq(s);
    382    return ret;
    383}
    384
    385static NetClientInfo net_xgmac_enet_info = {
    386    .type = NET_CLIENT_DRIVER_NIC,
    387    .size = sizeof(NICState),
    388    .receive = eth_rx,
    389};
    390
    391static void xgmac_enet_realize(DeviceState *dev, Error **errp)
    392{
    393    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
    394    XgmacState *s = XGMAC(dev);
    395
    396    memory_region_init_io(&s->iomem, OBJECT(s), &enet_mem_ops, s,
    397                          "xgmac", 0x1000);
    398    sysbus_init_mmio(sbd, &s->iomem);
    399    sysbus_init_irq(sbd, &s->sbd_irq);
    400    sysbus_init_irq(sbd, &s->pmt_irq);
    401    sysbus_init_irq(sbd, &s->mci_irq);
    402
    403    qemu_macaddr_default_if_unset(&s->conf.macaddr);
    404    s->nic = qemu_new_nic(&net_xgmac_enet_info, &s->conf,
    405                          object_get_typename(OBJECT(dev)), dev->id, s);
    406    qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
    407
    408    s->regs[XGMAC_ADDR_HIGH(0)] = (s->conf.macaddr.a[5] << 8) |
    409                                   s->conf.macaddr.a[4];
    410    s->regs[XGMAC_ADDR_LOW(0)] = (s->conf.macaddr.a[3] << 24) |
    411                                 (s->conf.macaddr.a[2] << 16) |
    412                                 (s->conf.macaddr.a[1] << 8) |
    413                                  s->conf.macaddr.a[0];
    414}
    415
    416static Property xgmac_properties[] = {
    417    DEFINE_NIC_PROPERTIES(XgmacState, conf),
    418    DEFINE_PROP_END_OF_LIST(),
    419};
    420
    421static void xgmac_enet_class_init(ObjectClass *klass, void *data)
    422{
    423    DeviceClass *dc = DEVICE_CLASS(klass);
    424
    425    dc->realize = xgmac_enet_realize;
    426    dc->vmsd = &vmstate_xgmac;
    427    device_class_set_props(dc, xgmac_properties);
    428}
    429
    430static const TypeInfo xgmac_enet_info = {
    431    .name          = TYPE_XGMAC,
    432    .parent        = TYPE_SYS_BUS_DEVICE,
    433    .instance_size = sizeof(XgmacState),
    434    .class_init    = xgmac_enet_class_init,
    435};
    436
    437static void xgmac_enet_register_types(void)
    438{
    439    type_register_static(&xgmac_enet_info);
    440}
    441
    442type_init(xgmac_enet_register_types)