cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

i8254.c (10906B)


      1/*
      2 * QEMU 8253/8254 interval timer emulation
      3 *
      4 * Copyright (c) 2003-2004 Fabrice Bellard
      5 *
      6 * Permission is hereby granted, free of charge, to any person obtaining a copy
      7 * of this software and associated documentation files (the "Software"), to deal
      8 * in the Software without restriction, including without limitation the rights
      9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     10 * copies of the Software, and to permit persons to whom the Software is
     11 * furnished to do so, subject to the following conditions:
     12 *
     13 * The above copyright notice and this permission notice shall be included in
     14 * all copies or substantial portions of the Software.
     15 *
     16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     22 * THE SOFTWARE.
     23 */
     24
     25#include "qemu/osdep.h"
     26#include "hw/irq.h"
     27#include "qemu/module.h"
     28#include "qemu/timer.h"
     29#include "hw/timer/i8254.h"
     30#include "hw/timer/i8254_internal.h"
     31#include "qom/object.h"
     32
     33//#define DEBUG_PIT
     34
     35#define RW_STATE_LSB 1
     36#define RW_STATE_MSB 2
     37#define RW_STATE_WORD0 3
     38#define RW_STATE_WORD1 4
     39
     40typedef struct PITClass PITClass;
     41DECLARE_CLASS_CHECKERS(PITClass, PIT,
     42                       TYPE_I8254)
     43
     44struct PITClass {
     45    PITCommonClass parent_class;
     46
     47    DeviceRealize parent_realize;
     48};
     49
     50static void pit_irq_timer_update(PITChannelState *s, int64_t current_time);
     51
     52static int pit_get_count(PITChannelState *s)
     53{
     54    uint64_t d;
     55    int counter;
     56
     57    d = muldiv64(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) - s->count_load_time, PIT_FREQ,
     58                 NANOSECONDS_PER_SECOND);
     59    switch(s->mode) {
     60    case 0:
     61    case 1:
     62    case 4:
     63    case 5:
     64        counter = (s->count - d) & 0xffff;
     65        break;
     66    case 3:
     67        /* XXX: may be incorrect for odd counts */
     68        counter = s->count - ((2 * d) % s->count);
     69        break;
     70    default:
     71        counter = s->count - (d % s->count);
     72        break;
     73    }
     74    return counter;
     75}
     76
     77/* val must be 0 or 1 */
     78static void pit_set_channel_gate(PITCommonState *s, PITChannelState *sc,
     79                                 int val)
     80{
     81    switch (sc->mode) {
     82    default:
     83    case 0:
     84    case 4:
     85        /* XXX: just disable/enable counting */
     86        break;
     87    case 1:
     88    case 5:
     89        if (sc->gate < val) {
     90            /* restart counting on rising edge */
     91            sc->count_load_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
     92            pit_irq_timer_update(sc, sc->count_load_time);
     93        }
     94        break;
     95    case 2:
     96    case 3:
     97        if (sc->gate < val) {
     98            /* restart counting on rising edge */
     99            sc->count_load_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
    100            pit_irq_timer_update(sc, sc->count_load_time);
    101        }
    102        /* XXX: disable/enable counting */
    103        break;
    104    }
    105    sc->gate = val;
    106}
    107
    108static inline void pit_load_count(PITChannelState *s, int val)
    109{
    110    if (val == 0)
    111        val = 0x10000;
    112    s->count_load_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
    113    s->count = val;
    114    pit_irq_timer_update(s, s->count_load_time);
    115}
    116
    117/* if already latched, do not latch again */
    118static void pit_latch_count(PITChannelState *s)
    119{
    120    if (!s->count_latched) {
    121        s->latched_count = pit_get_count(s);
    122        s->count_latched = s->rw_mode;
    123    }
    124}
    125
    126static void pit_ioport_write(void *opaque, hwaddr addr,
    127                             uint64_t val, unsigned size)
    128{
    129    PITCommonState *pit = opaque;
    130    int channel, access;
    131    PITChannelState *s;
    132
    133    addr &= 3;
    134    if (addr == 3) {
    135        channel = val >> 6;
    136        if (channel == 3) {
    137            /* read back command */
    138            for(channel = 0; channel < 3; channel++) {
    139                s = &pit->channels[channel];
    140                if (val & (2 << channel)) {
    141                    if (!(val & 0x20)) {
    142                        pit_latch_count(s);
    143                    }
    144                    if (!(val & 0x10) && !s->status_latched) {
    145                        /* status latch */
    146                        /* XXX: add BCD and null count */
    147                        s->status =
    148                            (pit_get_out(s,
    149                                         qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)) << 7) |
    150                            (s->rw_mode << 4) |
    151                            (s->mode << 1) |
    152                            s->bcd;
    153                        s->status_latched = 1;
    154                    }
    155                }
    156            }
    157        } else {
    158            s = &pit->channels[channel];
    159            access = (val >> 4) & 3;
    160            if (access == 0) {
    161                pit_latch_count(s);
    162            } else {
    163                s->rw_mode = access;
    164                s->read_state = access;
    165                s->write_state = access;
    166
    167                s->mode = (val >> 1) & 7;
    168                s->bcd = val & 1;
    169                /* XXX: update irq timer ? */
    170            }
    171        }
    172    } else {
    173        s = &pit->channels[addr];
    174        switch(s->write_state) {
    175        default:
    176        case RW_STATE_LSB:
    177            pit_load_count(s, val);
    178            break;
    179        case RW_STATE_MSB:
    180            pit_load_count(s, val << 8);
    181            break;
    182        case RW_STATE_WORD0:
    183            s->write_latch = val;
    184            s->write_state = RW_STATE_WORD1;
    185            break;
    186        case RW_STATE_WORD1:
    187            pit_load_count(s, s->write_latch | (val << 8));
    188            s->write_state = RW_STATE_WORD0;
    189            break;
    190        }
    191    }
    192}
    193
    194static uint64_t pit_ioport_read(void *opaque, hwaddr addr,
    195                                unsigned size)
    196{
    197    PITCommonState *pit = opaque;
    198    int ret, count;
    199    PITChannelState *s;
    200
    201    addr &= 3;
    202
    203    if (addr == 3) {
    204        /* Mode/Command register is write only, read is ignored */
    205        return 0;
    206    }
    207
    208    s = &pit->channels[addr];
    209    if (s->status_latched) {
    210        s->status_latched = 0;
    211        ret = s->status;
    212    } else if (s->count_latched) {
    213        switch(s->count_latched) {
    214        default:
    215        case RW_STATE_LSB:
    216            ret = s->latched_count & 0xff;
    217            s->count_latched = 0;
    218            break;
    219        case RW_STATE_MSB:
    220            ret = s->latched_count >> 8;
    221            s->count_latched = 0;
    222            break;
    223        case RW_STATE_WORD0:
    224            ret = s->latched_count & 0xff;
    225            s->count_latched = RW_STATE_MSB;
    226            break;
    227        }
    228    } else {
    229        switch(s->read_state) {
    230        default:
    231        case RW_STATE_LSB:
    232            count = pit_get_count(s);
    233            ret = count & 0xff;
    234            break;
    235        case RW_STATE_MSB:
    236            count = pit_get_count(s);
    237            ret = (count >> 8) & 0xff;
    238            break;
    239        case RW_STATE_WORD0:
    240            count = pit_get_count(s);
    241            ret = count & 0xff;
    242            s->read_state = RW_STATE_WORD1;
    243            break;
    244        case RW_STATE_WORD1:
    245            count = pit_get_count(s);
    246            ret = (count >> 8) & 0xff;
    247            s->read_state = RW_STATE_WORD0;
    248            break;
    249        }
    250    }
    251    return ret;
    252}
    253
    254static void pit_irq_timer_update(PITChannelState *s, int64_t current_time)
    255{
    256    int64_t expire_time;
    257    int irq_level;
    258
    259    if (!s->irq_timer || s->irq_disabled) {
    260        return;
    261    }
    262    expire_time = pit_get_next_transition_time(s, current_time);
    263    irq_level = pit_get_out(s, current_time);
    264    qemu_set_irq(s->irq, irq_level);
    265#ifdef DEBUG_PIT
    266    printf("irq_level=%d next_delay=%f\n",
    267           irq_level,
    268           (double)(expire_time - current_time) / NANOSECONDS_PER_SECOND);
    269#endif
    270    s->next_transition_time = expire_time;
    271    if (expire_time != -1)
    272        timer_mod(s->irq_timer, expire_time);
    273    else
    274        timer_del(s->irq_timer);
    275}
    276
    277static void pit_irq_timer(void *opaque)
    278{
    279    PITChannelState *s = opaque;
    280
    281    pit_irq_timer_update(s, s->next_transition_time);
    282}
    283
    284static void pit_reset(DeviceState *dev)
    285{
    286    PITCommonState *pit = PIT_COMMON(dev);
    287    PITChannelState *s;
    288
    289    pit_reset_common(pit);
    290
    291    s = &pit->channels[0];
    292    if (!s->irq_disabled) {
    293        timer_mod(s->irq_timer, s->next_transition_time);
    294    }
    295}
    296
    297/* When HPET is operating in legacy mode, suppress the ignored timer IRQ,
    298 * reenable it when legacy mode is left again. */
    299static void pit_irq_control(void *opaque, int n, int enable)
    300{
    301    PITCommonState *pit = opaque;
    302    PITChannelState *s = &pit->channels[0];
    303
    304    if (enable) {
    305        s->irq_disabled = 0;
    306        pit_irq_timer_update(s, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
    307    } else {
    308        s->irq_disabled = 1;
    309        timer_del(s->irq_timer);
    310    }
    311}
    312
    313static const MemoryRegionOps pit_ioport_ops = {
    314    .read = pit_ioport_read,
    315    .write = pit_ioport_write,
    316    .impl = {
    317        .min_access_size = 1,
    318        .max_access_size = 1,
    319    },
    320    .endianness = DEVICE_LITTLE_ENDIAN,
    321};
    322
    323static void pit_post_load(PITCommonState *s)
    324{
    325    PITChannelState *sc = &s->channels[0];
    326
    327    if (sc->next_transition_time != -1 && !sc->irq_disabled) {
    328        timer_mod(sc->irq_timer, sc->next_transition_time);
    329    } else {
    330        timer_del(sc->irq_timer);
    331    }
    332}
    333
    334static void pit_realizefn(DeviceState *dev, Error **errp)
    335{
    336    PITCommonState *pit = PIT_COMMON(dev);
    337    PITClass *pc = PIT_GET_CLASS(dev);
    338    PITChannelState *s;
    339
    340    s = &pit->channels[0];
    341    /* the timer 0 is connected to an IRQ */
    342    s->irq_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, pit_irq_timer, s);
    343    qdev_init_gpio_out(dev, &s->irq, 1);
    344
    345    memory_region_init_io(&pit->ioports, OBJECT(pit), &pit_ioport_ops,
    346                          pit, "pit", 4);
    347
    348    qdev_init_gpio_in(dev, pit_irq_control, 1);
    349
    350    pc->parent_realize(dev, errp);
    351}
    352
    353static Property pit_properties[] = {
    354    DEFINE_PROP_UINT32("iobase", PITCommonState, iobase,  -1),
    355    DEFINE_PROP_END_OF_LIST(),
    356};
    357
    358static void pit_class_initfn(ObjectClass *klass, void *data)
    359{
    360    PITClass *pc = PIT_CLASS(klass);
    361    PITCommonClass *k = PIT_COMMON_CLASS(klass);
    362    DeviceClass *dc = DEVICE_CLASS(klass);
    363
    364    device_class_set_parent_realize(dc, pit_realizefn, &pc->parent_realize);
    365    k->set_channel_gate = pit_set_channel_gate;
    366    k->get_channel_info = pit_get_channel_info_common;
    367    k->post_load = pit_post_load;
    368    dc->reset = pit_reset;
    369    device_class_set_props(dc, pit_properties);
    370}
    371
    372static const TypeInfo pit_info = {
    373    .name          = TYPE_I8254,
    374    .parent        = TYPE_PIT_COMMON,
    375    .instance_size = sizeof(PITCommonState),
    376    .class_init    = pit_class_initfn,
    377    .class_size    = sizeof(PITClass),
    378};
    379
    380static void pit_register_types(void)
    381{
    382    type_register_static(&pit_info);
    383}
    384
    385type_init(pit_register_types)