cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

leon3.c (13736B)


      1/*
      2 * QEMU Leon3 System Emulator
      3 *
      4 * Copyright (c) 2010-2019 AdaCore
      5 *
      6 * Permission is hereby granted, free of charge, to any person obtaining a copy
      7 * of this software and associated documentation files (the "Software"), to deal
      8 * in the Software without restriction, including without limitation the rights
      9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     10 * copies of the Software, and to permit persons to whom the Software is
     11 * furnished to do so, subject to the following conditions:
     12 *
     13 * The above copyright notice and this permission notice shall be included in
     14 * all copies or substantial portions of the Software.
     15 *
     16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     22 * THE SOFTWARE.
     23 */
     24
     25#include "qemu/osdep.h"
     26#include "qemu/units.h"
     27#include "qemu/error-report.h"
     28#include "qapi/error.h"
     29#include "qemu-common.h"
     30#include "qemu/datadir.h"
     31#include "cpu.h"
     32#include "hw/irq.h"
     33#include "qemu/timer.h"
     34#include "hw/ptimer.h"
     35#include "hw/qdev-properties.h"
     36#include "sysemu/sysemu.h"
     37#include "sysemu/qtest.h"
     38#include "sysemu/reset.h"
     39#include "hw/boards.h"
     40#include "hw/loader.h"
     41#include "elf.h"
     42#include "trace.h"
     43
     44#include "hw/sparc/grlib.h"
     45#include "hw/misc/grlib_ahb_apb_pnp.h"
     46
     47/* Default system clock.  */
     48#define CPU_CLK (40 * 1000 * 1000)
     49
     50#define LEON3_PROM_FILENAME "u-boot.bin"
     51#define LEON3_PROM_OFFSET    (0x00000000)
     52#define LEON3_RAM_OFFSET     (0x40000000)
     53
     54#define LEON3_UART_OFFSET  (0x80000100)
     55#define LEON3_UART_IRQ     (3)
     56
     57#define LEON3_IRQMP_OFFSET (0x80000200)
     58
     59#define LEON3_TIMER_OFFSET (0x80000300)
     60#define LEON3_TIMER_IRQ    (6)
     61#define LEON3_TIMER_COUNT  (2)
     62
     63#define LEON3_APB_PNP_OFFSET (0x800FF000)
     64#define LEON3_AHB_PNP_OFFSET (0xFFFFF000)
     65
     66typedef struct ResetData {
     67    SPARCCPU *cpu;
     68    uint32_t  entry;            /* save kernel entry in case of reset */
     69    target_ulong sp;            /* initial stack pointer */
     70} ResetData;
     71
     72static uint32_t *gen_store_u32(uint32_t *code, hwaddr addr, uint32_t val)
     73{
     74    stl_p(code++, 0x82100000); /* mov %g0, %g1                */
     75    stl_p(code++, 0x84100000); /* mov %g0, %g2                */
     76    stl_p(code++, 0x03000000 +
     77      extract32(addr, 10, 22));
     78                               /* sethi %hi(addr), %g1        */
     79    stl_p(code++, 0x82106000 +
     80      extract32(addr, 0, 10));
     81                               /* or %g1, addr, %g1           */
     82    stl_p(code++, 0x05000000 +
     83      extract32(val, 10, 22));
     84                               /* sethi %hi(val), %g2         */
     85    stl_p(code++, 0x8410a000 +
     86      extract32(val, 0, 10));
     87                               /* or %g2, val, %g2            */
     88    stl_p(code++, 0xc4204000); /* st %g2, [ %g1 ]             */
     89
     90    return code;
     91}
     92
     93/*
     94 * When loading a kernel in RAM the machine is expected to be in a different
     95 * state (eg: initialized by the bootloader). This little code reproduces
     96 * this behavior.
     97 */
     98static void write_bootloader(CPUSPARCState *env, uint8_t *base,
     99                             hwaddr kernel_addr)
    100{
    101    uint32_t *p = (uint32_t *) base;
    102
    103    /* Initialize the UARTs                                        */
    104    /* *UART_CONTROL = UART_RECEIVE_ENABLE | UART_TRANSMIT_ENABLE; */
    105    p = gen_store_u32(p, 0x80000108, 3);
    106
    107    /* Initialize the TIMER 0                                      */
    108    /* *GPTIMER_SCALER_RELOAD = 40 - 1;                            */
    109    p = gen_store_u32(p, 0x80000304, 39);
    110    /* *GPTIMER0_COUNTER_RELOAD = 0xFFFE;                          */
    111    p = gen_store_u32(p, 0x80000314, 0xFFFFFFFE);
    112    /* *GPTIMER0_CONFIG = GPTIMER_ENABLE | GPTIMER_RESTART;        */
    113    p = gen_store_u32(p, 0x80000318, 3);
    114
    115    /* JUMP to the entry point                                     */
    116    stl_p(p++, 0x82100000); /* mov %g0, %g1 */
    117    stl_p(p++, 0x03000000 + extract32(kernel_addr, 10, 22));
    118                            /* sethi %hi(kernel_addr), %g1 */
    119    stl_p(p++, 0x82106000 + extract32(kernel_addr, 0, 10));
    120                            /* or kernel_addr, %g1 */
    121    stl_p(p++, 0x81c04000); /* jmp  %g1 */
    122    stl_p(p++, 0x01000000); /* nop */
    123}
    124
    125static void main_cpu_reset(void *opaque)
    126{
    127    ResetData *s   = (ResetData *)opaque;
    128    CPUState *cpu = CPU(s->cpu);
    129    CPUSPARCState  *env = &s->cpu->env;
    130
    131    cpu_reset(cpu);
    132
    133    cpu->halted = 0;
    134    env->pc     = s->entry;
    135    env->npc    = s->entry + 4;
    136    env->regbase[6] = s->sp;
    137}
    138
    139static void leon3_cache_control_int(CPUSPARCState *env)
    140{
    141    uint32_t state = 0;
    142
    143    if (env->cache_control & CACHE_CTRL_IF) {
    144        /* Instruction cache state */
    145        state = env->cache_control & CACHE_STATE_MASK;
    146        if (state == CACHE_ENABLED) {
    147            state = CACHE_FROZEN;
    148            trace_int_helper_icache_freeze();
    149        }
    150
    151        env->cache_control &= ~CACHE_STATE_MASK;
    152        env->cache_control |= state;
    153    }
    154
    155    if (env->cache_control & CACHE_CTRL_DF) {
    156        /* Data cache state */
    157        state = (env->cache_control >> 2) & CACHE_STATE_MASK;
    158        if (state == CACHE_ENABLED) {
    159            state = CACHE_FROZEN;
    160            trace_int_helper_dcache_freeze();
    161        }
    162
    163        env->cache_control &= ~(CACHE_STATE_MASK << 2);
    164        env->cache_control |= (state << 2);
    165    }
    166}
    167
    168static void leon3_irq_ack(void *irq_manager, int intno)
    169{
    170    grlib_irqmp_ack((DeviceState *)irq_manager, intno);
    171}
    172
    173/*
    174 * This device assumes that the incoming 'level' value on the
    175 * qemu_irq is the interrupt number, not just a simple 0/1 level.
    176 */
    177static void leon3_set_pil_in(void *opaque, int n, int level)
    178{
    179    CPUSPARCState *env = opaque;
    180    uint32_t pil_in = level;
    181    CPUState *cs;
    182
    183    assert(env != NULL);
    184
    185    env->pil_in = pil_in;
    186
    187    if (env->pil_in && (env->interrupt_index == 0 ||
    188                        (env->interrupt_index & ~15) == TT_EXTINT)) {
    189        unsigned int i;
    190
    191        for (i = 15; i > 0; i--) {
    192            if (env->pil_in & (1 << i)) {
    193                int old_interrupt = env->interrupt_index;
    194
    195                env->interrupt_index = TT_EXTINT | i;
    196                if (old_interrupt != env->interrupt_index) {
    197                    cs = env_cpu(env);
    198                    trace_leon3_set_irq(i);
    199                    cpu_interrupt(cs, CPU_INTERRUPT_HARD);
    200                }
    201                break;
    202            }
    203        }
    204    } else if (!env->pil_in && (env->interrupt_index & ~15) == TT_EXTINT) {
    205        cs = env_cpu(env);
    206        trace_leon3_reset_irq(env->interrupt_index & 15);
    207        env->interrupt_index = 0;
    208        cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
    209    }
    210}
    211
    212static void leon3_irq_manager(CPUSPARCState *env, void *irq_manager, int intno)
    213{
    214    leon3_irq_ack(irq_manager, intno);
    215    leon3_cache_control_int(env);
    216}
    217
    218static void leon3_generic_hw_init(MachineState *machine)
    219{
    220    ram_addr_t ram_size = machine->ram_size;
    221    const char *bios_name = machine->firmware ?: LEON3_PROM_FILENAME;
    222    const char *kernel_filename = machine->kernel_filename;
    223    SPARCCPU *cpu;
    224    CPUSPARCState   *env;
    225    MemoryRegion *address_space_mem = get_system_memory();
    226    MemoryRegion *prom = g_new(MemoryRegion, 1);
    227    int         ret;
    228    char       *filename;
    229    int         bios_size;
    230    int         prom_size;
    231    ResetData  *reset_info;
    232    DeviceState *dev, *irqmpdev;
    233    int i;
    234    AHBPnp *ahb_pnp;
    235    APBPnp *apb_pnp;
    236
    237    /* Init CPU */
    238    cpu = SPARC_CPU(cpu_create(machine->cpu_type));
    239    env = &cpu->env;
    240
    241    cpu_sparc_set_id(env, 0);
    242
    243    /* Reset data */
    244    reset_info        = g_malloc0(sizeof(ResetData));
    245    reset_info->cpu   = cpu;
    246    reset_info->sp    = LEON3_RAM_OFFSET + ram_size;
    247    qemu_register_reset(main_cpu_reset, reset_info);
    248
    249    ahb_pnp = GRLIB_AHB_PNP(qdev_new(TYPE_GRLIB_AHB_PNP));
    250    sysbus_realize_and_unref(SYS_BUS_DEVICE(ahb_pnp), &error_fatal);
    251    sysbus_mmio_map(SYS_BUS_DEVICE(ahb_pnp), 0, LEON3_AHB_PNP_OFFSET);
    252    grlib_ahb_pnp_add_entry(ahb_pnp, 0, 0, GRLIB_VENDOR_GAISLER,
    253                            GRLIB_LEON3_DEV, GRLIB_AHB_MASTER,
    254                            GRLIB_CPU_AREA);
    255
    256    apb_pnp = GRLIB_APB_PNP(qdev_new(TYPE_GRLIB_APB_PNP));
    257    sysbus_realize_and_unref(SYS_BUS_DEVICE(apb_pnp), &error_fatal);
    258    sysbus_mmio_map(SYS_BUS_DEVICE(apb_pnp), 0, LEON3_APB_PNP_OFFSET);
    259    grlib_ahb_pnp_add_entry(ahb_pnp, LEON3_APB_PNP_OFFSET, 0xFFF,
    260                            GRLIB_VENDOR_GAISLER, GRLIB_APBMST_DEV,
    261                            GRLIB_AHB_SLAVE, GRLIB_AHBMEM_AREA);
    262
    263    /* Allocate IRQ manager */
    264    irqmpdev = qdev_new(TYPE_GRLIB_IRQMP);
    265    qdev_init_gpio_in_named_with_opaque(DEVICE(cpu), leon3_set_pil_in,
    266                                        env, "pil", 1);
    267    qdev_connect_gpio_out_named(irqmpdev, "grlib-irq", 0,
    268                                qdev_get_gpio_in_named(DEVICE(cpu), "pil", 0));
    269    sysbus_realize_and_unref(SYS_BUS_DEVICE(irqmpdev), &error_fatal);
    270    sysbus_mmio_map(SYS_BUS_DEVICE(irqmpdev), 0, LEON3_IRQMP_OFFSET);
    271    env->irq_manager = irqmpdev;
    272    env->qemu_irq_ack = leon3_irq_manager;
    273    grlib_apb_pnp_add_entry(apb_pnp, LEON3_IRQMP_OFFSET, 0xFFF,
    274                            GRLIB_VENDOR_GAISLER, GRLIB_IRQMP_DEV,
    275                            2, 0, GRLIB_APBIO_AREA);
    276
    277    /* Allocate RAM */
    278    if (ram_size > 1 * GiB) {
    279        error_report("Too much memory for this machine: %" PRId64 "MB,"
    280                     " maximum 1G",
    281                     ram_size / MiB);
    282        exit(1);
    283    }
    284
    285    memory_region_add_subregion(address_space_mem, LEON3_RAM_OFFSET,
    286                                machine->ram);
    287
    288    /* Allocate BIOS */
    289    prom_size = 8 * MiB;
    290    memory_region_init_rom(prom, NULL, "Leon3.bios", prom_size, &error_fatal);
    291    memory_region_add_subregion(address_space_mem, LEON3_PROM_OFFSET, prom);
    292
    293    /* Load boot prom */
    294    filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
    295
    296    if (filename) {
    297        bios_size = get_image_size(filename);
    298    } else {
    299        bios_size = -1;
    300    }
    301
    302    if (bios_size > prom_size) {
    303        error_report("could not load prom '%s': file too big", filename);
    304        exit(1);
    305    }
    306
    307    if (bios_size > 0) {
    308        ret = load_image_targphys(filename, LEON3_PROM_OFFSET, bios_size);
    309        if (ret < 0 || ret > prom_size) {
    310            error_report("could not load prom '%s'", filename);
    311            exit(1);
    312        }
    313    } else if (kernel_filename == NULL && !qtest_enabled()) {
    314        error_report("Can't read bios image '%s'", filename
    315                                                   ? filename
    316                                                   : LEON3_PROM_FILENAME);
    317        exit(1);
    318    }
    319    g_free(filename);
    320
    321    /* Can directly load an application. */
    322    if (kernel_filename != NULL) {
    323        long     kernel_size;
    324        uint64_t entry;
    325
    326        kernel_size = load_elf(kernel_filename, NULL, NULL, NULL,
    327                               &entry, NULL, NULL, NULL,
    328                               1 /* big endian */, EM_SPARC, 0, 0);
    329        if (kernel_size < 0) {
    330            kernel_size = load_uimage(kernel_filename, NULL, &entry,
    331                                      NULL, NULL, NULL);
    332        }
    333        if (kernel_size < 0) {
    334            error_report("could not load kernel '%s'", kernel_filename);
    335            exit(1);
    336        }
    337        if (bios_size <= 0) {
    338            /*
    339             * If there is no bios/monitor just start the application but put
    340             * the machine in an initialized state through a little
    341             * bootloader.
    342             */
    343            uint8_t *bootloader_entry;
    344
    345            bootloader_entry = memory_region_get_ram_ptr(prom);
    346            write_bootloader(env, bootloader_entry, entry);
    347            env->pc = LEON3_PROM_OFFSET;
    348            env->npc = LEON3_PROM_OFFSET + 4;
    349            reset_info->entry = LEON3_PROM_OFFSET;
    350        }
    351    }
    352
    353    /* Allocate timers */
    354    dev = qdev_new(TYPE_GRLIB_GPTIMER);
    355    qdev_prop_set_uint32(dev, "nr-timers", LEON3_TIMER_COUNT);
    356    qdev_prop_set_uint32(dev, "frequency", CPU_CLK);
    357    qdev_prop_set_uint32(dev, "irq-line", LEON3_TIMER_IRQ);
    358    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
    359
    360    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, LEON3_TIMER_OFFSET);
    361    for (i = 0; i < LEON3_TIMER_COUNT; i++) {
    362        sysbus_connect_irq(SYS_BUS_DEVICE(dev), i,
    363                           qdev_get_gpio_in(irqmpdev, LEON3_TIMER_IRQ + i));
    364    }
    365
    366    grlib_apb_pnp_add_entry(apb_pnp, LEON3_TIMER_OFFSET, 0xFFF,
    367                            GRLIB_VENDOR_GAISLER, GRLIB_GPTIMER_DEV,
    368                            0, LEON3_TIMER_IRQ, GRLIB_APBIO_AREA);
    369
    370    /* Allocate uart */
    371    dev = qdev_new(TYPE_GRLIB_APB_UART);
    372    qdev_prop_set_chr(dev, "chrdev", serial_hd(0));
    373    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
    374    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, LEON3_UART_OFFSET);
    375    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
    376                       qdev_get_gpio_in(irqmpdev, LEON3_UART_IRQ));
    377    grlib_apb_pnp_add_entry(apb_pnp, LEON3_UART_OFFSET, 0xFFF,
    378                            GRLIB_VENDOR_GAISLER, GRLIB_APBUART_DEV, 1,
    379                            LEON3_UART_IRQ, GRLIB_APBIO_AREA);
    380}
    381
    382static void leon3_generic_machine_init(MachineClass *mc)
    383{
    384    mc->desc = "Leon-3 generic";
    385    mc->init = leon3_generic_hw_init;
    386    mc->default_cpu_type = SPARC_CPU_TYPE_NAME("LEON3");
    387    mc->default_ram_id = "leon3.ram";
    388}
    389
    390DEFINE_MACHINE("leon3_generic", leon3_generic_machine_init)