cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

pl031.c (9639B)


      1/*
      2 * ARM AMBA PrimeCell PL031 RTC
      3 *
      4 * Copyright (c) 2007 CodeSourcery
      5 *
      6 * This file is free software; you can redistribute it and/or modify
      7 * it under the terms of the GNU General Public License version 2 as
      8 * published by the Free Software Foundation.
      9 *
     10 * Contributions after 2012-01-13 are licensed under the terms of the
     11 * GNU GPL, version 2 or (at your option) any later version.
     12 */
     13
     14#include "qemu/osdep.h"
     15#include "qemu-common.h"
     16#include "hw/rtc/pl031.h"
     17#include "migration/vmstate.h"
     18#include "hw/irq.h"
     19#include "hw/qdev-properties.h"
     20#include "hw/sysbus.h"
     21#include "qemu/timer.h"
     22#include "sysemu/sysemu.h"
     23#include "qemu/cutils.h"
     24#include "qemu/log.h"
     25#include "qemu/module.h"
     26#include "trace.h"
     27
     28#define RTC_DR      0x00    /* Data read register */
     29#define RTC_MR      0x04    /* Match register */
     30#define RTC_LR      0x08    /* Data load register */
     31#define RTC_CR      0x0c    /* Control register */
     32#define RTC_IMSC    0x10    /* Interrupt mask and set register */
     33#define RTC_RIS     0x14    /* Raw interrupt status register */
     34#define RTC_MIS     0x18    /* Masked interrupt status register */
     35#define RTC_ICR     0x1c    /* Interrupt clear register */
     36
     37static const unsigned char pl031_id[] = {
     38    0x31, 0x10, 0x14, 0x00,         /* Device ID        */
     39    0x0d, 0xf0, 0x05, 0xb1          /* Cell ID      */
     40};
     41
     42static void pl031_update(PL031State *s)
     43{
     44    uint32_t flags = s->is & s->im;
     45
     46    trace_pl031_irq_state(flags);
     47    qemu_set_irq(s->irq, flags);
     48}
     49
     50static void pl031_interrupt(void * opaque)
     51{
     52    PL031State *s = (PL031State *)opaque;
     53
     54    s->is = 1;
     55    trace_pl031_alarm_raised();
     56    pl031_update(s);
     57}
     58
     59static uint32_t pl031_get_count(PL031State *s)
     60{
     61    int64_t now = qemu_clock_get_ns(rtc_clock);
     62    return s->tick_offset + now / NANOSECONDS_PER_SECOND;
     63}
     64
     65static void pl031_set_alarm(PL031State *s)
     66{
     67    uint32_t ticks;
     68
     69    /* The timer wraps around.  This subtraction also wraps in the same way,
     70       and gives correct results when alarm < now_ticks.  */
     71    ticks = s->mr - pl031_get_count(s);
     72    trace_pl031_set_alarm(ticks);
     73    if (ticks == 0) {
     74        timer_del(s->timer);
     75        pl031_interrupt(s);
     76    } else {
     77        int64_t now = qemu_clock_get_ns(rtc_clock);
     78        timer_mod(s->timer, now + (int64_t)ticks * NANOSECONDS_PER_SECOND);
     79    }
     80}
     81
     82static uint64_t pl031_read(void *opaque, hwaddr offset,
     83                           unsigned size)
     84{
     85    PL031State *s = (PL031State *)opaque;
     86    uint64_t r;
     87
     88    switch (offset) {
     89    case RTC_DR:
     90        r = pl031_get_count(s);
     91        break;
     92    case RTC_MR:
     93        r = s->mr;
     94        break;
     95    case RTC_IMSC:
     96        r = s->im;
     97        break;
     98    case RTC_RIS:
     99        r = s->is;
    100        break;
    101    case RTC_LR:
    102        r = s->lr;
    103        break;
    104    case RTC_CR:
    105        /* RTC is permanently enabled.  */
    106        r = 1;
    107        break;
    108    case RTC_MIS:
    109        r = s->is & s->im;
    110        break;
    111    case 0xfe0 ... 0xfff:
    112        r = pl031_id[(offset - 0xfe0) >> 2];
    113        break;
    114    case RTC_ICR:
    115        qemu_log_mask(LOG_GUEST_ERROR,
    116                      "pl031: read of write-only register at offset 0x%x\n",
    117                      (int)offset);
    118        r = 0;
    119        break;
    120    default:
    121        qemu_log_mask(LOG_GUEST_ERROR,
    122                      "pl031_read: Bad offset 0x%x\n", (int)offset);
    123        r = 0;
    124        break;
    125    }
    126
    127    trace_pl031_read(offset, r);
    128    return r;
    129}
    130
    131static void pl031_write(void * opaque, hwaddr offset,
    132                        uint64_t value, unsigned size)
    133{
    134    PL031State *s = (PL031State *)opaque;
    135
    136    trace_pl031_write(offset, value);
    137
    138    switch (offset) {
    139    case RTC_LR:
    140        s->tick_offset += value - pl031_get_count(s);
    141        pl031_set_alarm(s);
    142        break;
    143    case RTC_MR:
    144        s->mr = value;
    145        pl031_set_alarm(s);
    146        break;
    147    case RTC_IMSC:
    148        s->im = value & 1;
    149        pl031_update(s);
    150        break;
    151    case RTC_ICR:
    152        s->is &= ~value;
    153        pl031_update(s);
    154        break;
    155    case RTC_CR:
    156        /* Written value is ignored.  */
    157        break;
    158
    159    case RTC_DR:
    160    case RTC_MIS:
    161    case RTC_RIS:
    162        qemu_log_mask(LOG_GUEST_ERROR,
    163                      "pl031: write to read-only register at offset 0x%x\n",
    164                      (int)offset);
    165        break;
    166
    167    default:
    168        qemu_log_mask(LOG_GUEST_ERROR,
    169                      "pl031_write: Bad offset 0x%x\n", (int)offset);
    170        break;
    171    }
    172}
    173
    174static const MemoryRegionOps pl031_ops = {
    175    .read = pl031_read,
    176    .write = pl031_write,
    177    .endianness = DEVICE_NATIVE_ENDIAN,
    178};
    179
    180static void pl031_init(Object *obj)
    181{
    182    PL031State *s = PL031(obj);
    183    SysBusDevice *dev = SYS_BUS_DEVICE(obj);
    184    struct tm tm;
    185
    186    memory_region_init_io(&s->iomem, obj, &pl031_ops, s, "pl031", 0x1000);
    187    sysbus_init_mmio(dev, &s->iomem);
    188
    189    sysbus_init_irq(dev, &s->irq);
    190    qemu_get_timedate(&tm, 0);
    191    s->tick_offset = mktimegm(&tm) -
    192        qemu_clock_get_ns(rtc_clock) / NANOSECONDS_PER_SECOND;
    193
    194    s->timer = timer_new_ns(rtc_clock, pl031_interrupt, s);
    195}
    196
    197static void pl031_finalize(Object *obj)
    198{
    199    PL031State *s = PL031(obj);
    200
    201    timer_free(s->timer);
    202}
    203
    204static int pl031_pre_save(void *opaque)
    205{
    206    PL031State *s = opaque;
    207
    208    /*
    209     * The PL031 device model code uses the tick_offset field, which is
    210     * the offset between what the guest RTC should read and what the
    211     * QEMU rtc_clock reads:
    212     *  guest_rtc = rtc_clock + tick_offset
    213     * and so
    214     *  tick_offset = guest_rtc - rtc_clock
    215     *
    216     * We want to migrate this offset, which sounds straightforward.
    217     * Unfortunately older versions of QEMU migrated a conversion of this
    218     * offset into an offset from the vm_clock. (This was in turn an
    219     * attempt to be compatible with even older QEMU versions, but it
    220     * has incorrect behaviour if the rtc_clock is not the same as the
    221     * vm_clock.) So we put the actual tick_offset into a migration
    222     * subsection, and the backwards-compatible time-relative-to-vm_clock
    223     * in the main migration state.
    224     *
    225     * Calculate base time relative to QEMU_CLOCK_VIRTUAL:
    226     */
    227    int64_t delta = qemu_clock_get_ns(rtc_clock) - qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
    228    s->tick_offset_vmstate = s->tick_offset + delta / NANOSECONDS_PER_SECOND;
    229
    230    return 0;
    231}
    232
    233static int pl031_pre_load(void *opaque)
    234{
    235    PL031State *s = opaque;
    236
    237    s->tick_offset_migrated = false;
    238    return 0;
    239}
    240
    241static int pl031_post_load(void *opaque, int version_id)
    242{
    243    PL031State *s = opaque;
    244
    245    /*
    246     * If we got the tick_offset subsection, then we can just use
    247     * the value in that. Otherwise the source is an older QEMU and
    248     * has given us the offset from the vm_clock; convert it back to
    249     * an offset from the rtc_clock. This will cause time to incorrectly
    250     * go backwards compared to the host RTC, but this is unavoidable.
    251     */
    252
    253    if (!s->tick_offset_migrated) {
    254        int64_t delta = qemu_clock_get_ns(rtc_clock) -
    255            qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
    256        s->tick_offset = s->tick_offset_vmstate -
    257            delta / NANOSECONDS_PER_SECOND;
    258    }
    259    pl031_set_alarm(s);
    260    return 0;
    261}
    262
    263static int pl031_tick_offset_post_load(void *opaque, int version_id)
    264{
    265    PL031State *s = opaque;
    266
    267    s->tick_offset_migrated = true;
    268    return 0;
    269}
    270
    271static bool pl031_tick_offset_needed(void *opaque)
    272{
    273    PL031State *s = opaque;
    274
    275    return s->migrate_tick_offset;
    276}
    277
    278static const VMStateDescription vmstate_pl031_tick_offset = {
    279    .name = "pl031/tick-offset",
    280    .version_id = 1,
    281    .minimum_version_id = 1,
    282    .needed = pl031_tick_offset_needed,
    283    .post_load = pl031_tick_offset_post_load,
    284    .fields = (VMStateField[]) {
    285        VMSTATE_UINT32(tick_offset, PL031State),
    286        VMSTATE_END_OF_LIST()
    287    }
    288};
    289
    290static const VMStateDescription vmstate_pl031 = {
    291    .name = "pl031",
    292    .version_id = 1,
    293    .minimum_version_id = 1,
    294    .pre_save = pl031_pre_save,
    295    .pre_load = pl031_pre_load,
    296    .post_load = pl031_post_load,
    297    .fields = (VMStateField[]) {
    298        VMSTATE_UINT32(tick_offset_vmstate, PL031State),
    299        VMSTATE_UINT32(mr, PL031State),
    300        VMSTATE_UINT32(lr, PL031State),
    301        VMSTATE_UINT32(cr, PL031State),
    302        VMSTATE_UINT32(im, PL031State),
    303        VMSTATE_UINT32(is, PL031State),
    304        VMSTATE_END_OF_LIST()
    305    },
    306    .subsections = (const VMStateDescription*[]) {
    307        &vmstate_pl031_tick_offset,
    308        NULL
    309    }
    310};
    311
    312static Property pl031_properties[] = {
    313    /*
    314     * True to correctly migrate the tick offset of the RTC. False to
    315     * obtain backward migration compatibility with older QEMU versions,
    316     * at the expense of the guest RTC going backwards compared with the
    317     * host RTC when the VM is saved/restored if using -rtc host.
    318     * (Even if set to 'true' older QEMU can migrate forward to newer QEMU;
    319     * 'false' also permits newer QEMU to migrate to older QEMU.)
    320     */
    321    DEFINE_PROP_BOOL("migrate-tick-offset",
    322                     PL031State, migrate_tick_offset, true),
    323    DEFINE_PROP_END_OF_LIST()
    324};
    325
    326static void pl031_class_init(ObjectClass *klass, void *data)
    327{
    328    DeviceClass *dc = DEVICE_CLASS(klass);
    329
    330    dc->vmsd = &vmstate_pl031;
    331    device_class_set_props(dc, pl031_properties);
    332}
    333
    334static const TypeInfo pl031_info = {
    335    .name          = TYPE_PL031,
    336    .parent        = TYPE_SYS_BUS_DEVICE,
    337    .instance_size = sizeof(PL031State),
    338    .instance_init = pl031_init,
    339    .instance_finalize = pl031_finalize,
    340    .class_init    = pl031_class_init,
    341};
    342
    343static void pl031_register_types(void)
    344{
    345    type_register_static(&pl031_info);
    346}
    347
    348type_init(pl031_register_types)