cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

eeprom93xx.c (10794B)


      1/*
      2 * QEMU EEPROM 93xx emulation
      3 *
      4 * Copyright (c) 2006-2007 Stefan Weil
      5 *
      6 * This program is free software; you can redistribute it and/or modify
      7 * it under the terms of the GNU General Public License as published by
      8 * the Free Software Foundation; either version 2 of the License, or
      9 * (at your option) any later version.
     10 *
     11 * This program is distributed in the hope that it will be useful,
     12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
     13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     14 * GNU General Public License for more details.
     15 *
     16 * You should have received a copy of the GNU General Public License
     17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
     18 */
     19
     20/* Emulation for serial EEPROMs:
     21 * NMC93C06 256-Bit (16 x 16)
     22 * NMC93C46 1024-Bit (64 x 16)
     23 * NMC93C56 2028 Bit (128 x 16)
     24 * NMC93C66 4096 Bit (256 x 16)
     25 * Compatible devices include FM93C46 and others.
     26 *
     27 * Other drivers use these interface functions:
     28 * eeprom93xx_new   - add a new EEPROM (with 16, 64 or 256 words)
     29 * eeprom93xx_free  - destroy EEPROM
     30 * eeprom93xx_read  - read data from the EEPROM
     31 * eeprom93xx_write - write data to the EEPROM
     32 * eeprom93xx_data  - get EEPROM data array for external manipulation
     33 *
     34 * Todo list:
     35 * - No emulation of EEPROM timings.
     36 */
     37
     38#include "qemu/osdep.h"
     39#include "hw/nvram/eeprom93xx.h"
     40#include "migration/qemu-file-types.h"
     41#include "migration/vmstate.h"
     42
     43/* Debug EEPROM emulation. */
     44//~ #define DEBUG_EEPROM
     45
     46#ifdef DEBUG_EEPROM
     47#define logout(fmt, ...) fprintf(stderr, "EEPROM\t%-24s" fmt, __func__, ## __VA_ARGS__)
     48#else
     49#define logout(fmt, ...) ((void)0)
     50#endif
     51
     52#define EEPROM_INSTANCE  0
     53#define OLD_EEPROM_VERSION 20061112
     54#define EEPROM_VERSION (OLD_EEPROM_VERSION + 1)
     55
     56#if 0
     57typedef enum {
     58  eeprom_read  = 0x80,   /* read register xx */
     59  eeprom_write = 0x40,   /* write register xx */
     60  eeprom_erase = 0xc0,   /* erase register xx */
     61  eeprom_ewen  = 0x30,   /* erase / write enable */
     62  eeprom_ewds  = 0x00,   /* erase / write disable */
     63  eeprom_eral  = 0x20,   /* erase all registers */
     64  eeprom_wral  = 0x10,   /* write all registers */
     65  eeprom_amask = 0x0f,
     66  eeprom_imask = 0xf0
     67} eeprom_instruction_t;
     68#endif
     69
     70#ifdef DEBUG_EEPROM
     71static const char *opstring[] = {
     72  "extended", "write", "read", "erase"
     73};
     74#endif
     75
     76struct _eeprom_t {
     77    uint8_t  tick;
     78    uint8_t  address;
     79    uint8_t  command;
     80    uint8_t  writable;
     81
     82    uint8_t eecs;
     83    uint8_t eesk;
     84    uint8_t eedo;
     85
     86    uint8_t  addrbits;
     87    uint16_t size;
     88    uint16_t data;
     89    uint16_t contents[];
     90};
     91
     92/* Code for saving and restoring of EEPROM state. */
     93
     94/* Restore an uint16_t from an uint8_t
     95   This is a Big hack, but it is how the old state did it.
     96 */
     97
     98static int get_uint16_from_uint8(QEMUFile *f, void *pv, size_t size,
     99                                 const VMStateField *field)
    100{
    101    uint16_t *v = pv;
    102    *v = qemu_get_ubyte(f);
    103    return 0;
    104}
    105
    106static int put_unused(QEMUFile *f, void *pv, size_t size,
    107                      const VMStateField *field, JSONWriter *vmdesc)
    108{
    109    fprintf(stderr, "uint16_from_uint8 is used only for backwards compatibility.\n");
    110    fprintf(stderr, "Never should be used to write a new state.\n");
    111    exit(0);
    112
    113    return 0;
    114}
    115
    116static const VMStateInfo vmstate_hack_uint16_from_uint8 = {
    117    .name = "uint16_from_uint8",
    118    .get  = get_uint16_from_uint8,
    119    .put  = put_unused,
    120};
    121
    122#define VMSTATE_UINT16_HACK_TEST(_f, _s, _t)                           \
    123    VMSTATE_SINGLE_TEST(_f, _s, _t, 0, vmstate_hack_uint16_from_uint8, uint16_t)
    124
    125static bool is_old_eeprom_version(void *opaque, int version_id)
    126{
    127    return version_id == OLD_EEPROM_VERSION;
    128}
    129
    130static const VMStateDescription vmstate_eeprom = {
    131    .name = "eeprom",
    132    .version_id = EEPROM_VERSION,
    133    .minimum_version_id = OLD_EEPROM_VERSION,
    134    .fields = (VMStateField[]) {
    135        VMSTATE_UINT8(tick, eeprom_t),
    136        VMSTATE_UINT8(address, eeprom_t),
    137        VMSTATE_UINT8(command, eeprom_t),
    138        VMSTATE_UINT8(writable, eeprom_t),
    139
    140        VMSTATE_UINT8(eecs, eeprom_t),
    141        VMSTATE_UINT8(eesk, eeprom_t),
    142        VMSTATE_UINT8(eedo, eeprom_t),
    143
    144        VMSTATE_UINT8(addrbits, eeprom_t),
    145        VMSTATE_UINT16_HACK_TEST(size, eeprom_t, is_old_eeprom_version),
    146        VMSTATE_UNUSED_TEST(is_old_eeprom_version, 1),
    147        VMSTATE_UINT16_EQUAL_V(size, eeprom_t, EEPROM_VERSION, NULL),
    148        VMSTATE_UINT16(data, eeprom_t),
    149        VMSTATE_VARRAY_UINT16_UNSAFE(contents, eeprom_t, size, 0,
    150                                     vmstate_info_uint16, uint16_t),
    151        VMSTATE_END_OF_LIST()
    152    }
    153};
    154
    155void eeprom93xx_write(eeprom_t *eeprom, int eecs, int eesk, int eedi)
    156{
    157    uint8_t tick = eeprom->tick;
    158    uint8_t eedo = eeprom->eedo;
    159    uint16_t address = eeprom->address;
    160    uint8_t command = eeprom->command;
    161
    162    logout("CS=%u SK=%u DI=%u DO=%u, tick = %u\n",
    163           eecs, eesk, eedi, eedo, tick);
    164
    165    if (!eeprom->eecs && eecs) {
    166        /* Start chip select cycle. */
    167        logout("Cycle start, waiting for 1st start bit (0)\n");
    168        tick = 0;
    169        command = 0x0;
    170        address = 0x0;
    171    } else if (eeprom->eecs && !eecs) {
    172        /* End chip select cycle. This triggers write / erase. */
    173        if (eeprom->writable) {
    174            uint8_t subcommand = address >> (eeprom->addrbits - 2);
    175            if (command == 0 && subcommand == 2) {
    176                /* Erase all. */
    177                for (address = 0; address < eeprom->size; address++) {
    178                    eeprom->contents[address] = 0xffff;
    179                }
    180            } else if (command == 3) {
    181                /* Erase word. */
    182                eeprom->contents[address] = 0xffff;
    183            } else if (tick >= 2 + 2 + eeprom->addrbits + 16) {
    184                if (command == 1) {
    185                    /* Write word. */
    186                    eeprom->contents[address] &= eeprom->data;
    187                } else if (command == 0 && subcommand == 1) {
    188                    /* Write all. */
    189                    for (address = 0; address < eeprom->size; address++) {
    190                        eeprom->contents[address] &= eeprom->data;
    191                    }
    192                }
    193            }
    194        }
    195        /* Output DO is tristate, read results in 1. */
    196        eedo = 1;
    197    } else if (eecs && !eeprom->eesk && eesk) {
    198        /* Raising edge of clock shifts data in. */
    199        if (tick == 0) {
    200            /* Wait for 1st start bit. */
    201            if (eedi == 0) {
    202                logout("Got correct 1st start bit, waiting for 2nd start bit (1)\n");
    203                tick++;
    204            } else {
    205                logout("wrong 1st start bit (is 1, should be 0)\n");
    206                tick = 2;
    207                //~ assert(!"wrong start bit");
    208            }
    209        } else if (tick == 1) {
    210            /* Wait for 2nd start bit. */
    211            if (eedi != 0) {
    212                logout("Got correct 2nd start bit, getting command + address\n");
    213                tick++;
    214            } else {
    215                logout("1st start bit is longer than needed\n");
    216            }
    217        } else if (tick < 2 + 2) {
    218            /* Got 2 start bits, transfer 2 opcode bits. */
    219            tick++;
    220            command <<= 1;
    221            if (eedi) {
    222                command += 1;
    223            }
    224        } else if (tick < 2 + 2 + eeprom->addrbits) {
    225            /* Got 2 start bits and 2 opcode bits, transfer all address bits. */
    226            tick++;
    227            address = ((address << 1) | eedi);
    228            if (tick == 2 + 2 + eeprom->addrbits) {
    229                logout("%s command, address = 0x%02x (value 0x%04x)\n",
    230                       opstring[command], address, eeprom->contents[address]);
    231                if (command == 2) {
    232                    eedo = 0;
    233                }
    234                address = address % eeprom->size;
    235                if (command == 0) {
    236                    /* Command code in upper 2 bits of address. */
    237                    switch (address >> (eeprom->addrbits - 2)) {
    238                    case 0:
    239                        logout("write disable command\n");
    240                        eeprom->writable = 0;
    241                        break;
    242                    case 1:
    243                        logout("write all command\n");
    244                        break;
    245                    case 2:
    246                        logout("erase all command\n");
    247                        break;
    248                    case 3:
    249                        logout("write enable command\n");
    250                        eeprom->writable = 1;
    251                        break;
    252                    }
    253                } else {
    254                    /* Read, write or erase word. */
    255                    eeprom->data = eeprom->contents[address];
    256                }
    257            }
    258        } else if (tick < 2 + 2 + eeprom->addrbits + 16) {
    259            /* Transfer 16 data bits. */
    260            tick++;
    261            if (command == 2) {
    262                /* Read word. */
    263                eedo = ((eeprom->data & 0x8000) != 0);
    264            }
    265            eeprom->data <<= 1;
    266            eeprom->data += eedi;
    267        } else {
    268            logout("additional unneeded tick, not processed\n");
    269        }
    270    }
    271    /* Save status of EEPROM. */
    272    eeprom->tick = tick;
    273    eeprom->eecs = eecs;
    274    eeprom->eesk = eesk;
    275    eeprom->eedo = eedo;
    276    eeprom->address = address;
    277    eeprom->command = command;
    278}
    279
    280uint16_t eeprom93xx_read(eeprom_t *eeprom)
    281{
    282    /* Return status of pin DO (0 or 1). */
    283    logout("CS=%u DO=%u\n", eeprom->eecs, eeprom->eedo);
    284    return eeprom->eedo;
    285}
    286
    287#if 0
    288void eeprom93xx_reset(eeprom_t *eeprom)
    289{
    290    /* prepare eeprom */
    291    logout("eeprom = 0x%p\n", eeprom);
    292    eeprom->tick = 0;
    293    eeprom->command = 0;
    294}
    295#endif
    296
    297eeprom_t *eeprom93xx_new(DeviceState *dev, uint16_t nwords)
    298{
    299    /* Add a new EEPROM (with 16, 64 or 256 words). */
    300    eeprom_t *eeprom;
    301    uint8_t addrbits;
    302
    303    switch (nwords) {
    304    case 16:
    305    case 64:
    306        addrbits = 6;
    307        break;
    308    case 128:
    309    case 256:
    310        addrbits = 8;
    311        break;
    312    default:
    313        assert(!"Unsupported EEPROM size, fallback to 64 words!");
    314        nwords = 64;
    315        addrbits = 6;
    316    }
    317
    318    eeprom = (eeprom_t *)g_malloc0(sizeof(*eeprom) + nwords * 2);
    319    eeprom->size = nwords;
    320    eeprom->addrbits = addrbits;
    321    /* Output DO is tristate, read results in 1. */
    322    eeprom->eedo = 1;
    323    logout("eeprom = 0x%p, nwords = %u\n", eeprom, nwords);
    324    vmstate_register(VMSTATE_IF(dev), 0, &vmstate_eeprom, eeprom);
    325    return eeprom;
    326}
    327
    328void eeprom93xx_free(DeviceState *dev, eeprom_t *eeprom)
    329{
    330    /* Destroy EEPROM. */
    331    logout("eeprom = 0x%p\n", eeprom);
    332    vmstate_unregister(VMSTATE_IF(dev), &vmstate_eeprom, eeprom);
    333    g_free(eeprom);
    334}
    335
    336uint16_t *eeprom93xx_data(eeprom_t *eeprom)
    337{
    338    /* Get EEPROM data array. */
    339    return &eeprom->contents[0];
    340}
    341
    342/* eof */