cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

cmsdk-apb-watchdog.c (12429B)


      1/*
      2 * ARM CMSDK APB watchdog emulation
      3 *
      4 * Copyright (c) 2018 Linaro Limited
      5 * Written by Peter Maydell
      6 *
      7 *  This program is free software; you can redistribute it and/or modify
      8 *  it under the terms of the GNU General Public License version 2 or
      9 *  (at your option) any later version.
     10 */
     11
     12/*
     13 * This is a model of the "APB watchdog" which is part of the Cortex-M
     14 * System Design Kit (CMSDK) and documented in the Cortex-M System
     15 * Design Kit Technical Reference Manual (ARM DDI0479C):
     16 * https://developer.arm.com/products/system-design/system-design-kits/cortex-m-system-design-kit
     17 *
     18 * We also support the variant of this device found in the TI
     19 * Stellaris/Luminary boards and documented in:
     20 * http://www.ti.com/lit/ds/symlink/lm3s6965.pdf
     21 */
     22
     23#include "qemu/osdep.h"
     24#include "qemu/log.h"
     25#include "trace.h"
     26#include "qapi/error.h"
     27#include "qemu/module.h"
     28#include "sysemu/watchdog.h"
     29#include "hw/sysbus.h"
     30#include "hw/irq.h"
     31#include "hw/qdev-properties.h"
     32#include "hw/registerfields.h"
     33#include "hw/qdev-clock.h"
     34#include "hw/watchdog/cmsdk-apb-watchdog.h"
     35#include "migration/vmstate.h"
     36
     37REG32(WDOGLOAD, 0x0)
     38REG32(WDOGVALUE, 0x4)
     39REG32(WDOGCONTROL, 0x8)
     40    FIELD(WDOGCONTROL, INTEN, 0, 1)
     41    FIELD(WDOGCONTROL, RESEN, 1, 1)
     42#define R_WDOGCONTROL_VALID_MASK (R_WDOGCONTROL_INTEN_MASK | \
     43                                  R_WDOGCONTROL_RESEN_MASK)
     44REG32(WDOGINTCLR, 0xc)
     45REG32(WDOGRIS, 0x10)
     46    FIELD(WDOGRIS, INT, 0, 1)
     47REG32(WDOGMIS, 0x14)
     48REG32(WDOGTEST, 0x418) /* only in Stellaris/Luminary version of the device */
     49REG32(WDOGLOCK, 0xc00)
     50#define WDOG_UNLOCK_VALUE 0x1ACCE551
     51REG32(WDOGITCR, 0xf00)
     52    FIELD(WDOGITCR, ENABLE, 0, 1)
     53#define R_WDOGITCR_VALID_MASK R_WDOGITCR_ENABLE_MASK
     54REG32(WDOGITOP, 0xf04)
     55    FIELD(WDOGITOP, WDOGRES, 0, 1)
     56    FIELD(WDOGITOP, WDOGINT, 1, 1)
     57#define R_WDOGITOP_VALID_MASK (R_WDOGITOP_WDOGRES_MASK | \
     58                               R_WDOGITOP_WDOGINT_MASK)
     59REG32(PID4, 0xfd0)
     60REG32(PID5, 0xfd4)
     61REG32(PID6, 0xfd8)
     62REG32(PID7, 0xfdc)
     63REG32(PID0, 0xfe0)
     64REG32(PID1, 0xfe4)
     65REG32(PID2, 0xfe8)
     66REG32(PID3, 0xfec)
     67REG32(CID0, 0xff0)
     68REG32(CID1, 0xff4)
     69REG32(CID2, 0xff8)
     70REG32(CID3, 0xffc)
     71
     72/* PID/CID values */
     73static const uint32_t cmsdk_apb_watchdog_id[] = {
     74    0x04, 0x00, 0x00, 0x00, /* PID4..PID7 */
     75    0x24, 0xb8, 0x1b, 0x00, /* PID0..PID3 */
     76    0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
     77};
     78
     79static const uint32_t luminary_watchdog_id[] = {
     80    0x00, 0x00, 0x00, 0x00, /* PID4..PID7 */
     81    0x05, 0x18, 0x18, 0x01, /* PID0..PID3 */
     82    0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
     83};
     84
     85static bool cmsdk_apb_watchdog_intstatus(CMSDKAPBWatchdog *s)
     86{
     87    /* Return masked interrupt status */
     88    return s->intstatus && (s->control & R_WDOGCONTROL_INTEN_MASK);
     89}
     90
     91static bool cmsdk_apb_watchdog_resetstatus(CMSDKAPBWatchdog *s)
     92{
     93    /* Return masked reset status */
     94    return s->resetstatus && (s->control & R_WDOGCONTROL_RESEN_MASK);
     95}
     96
     97static void cmsdk_apb_watchdog_update(CMSDKAPBWatchdog *s)
     98{
     99    bool wdogint;
    100    bool wdogres;
    101
    102    if (s->itcr) {
    103        /*
    104         * Not checking that !s->is_luminary since s->itcr can't be written
    105         * when s->is_luminary in the first place.
    106         */
    107        wdogint = s->itop & R_WDOGITOP_WDOGINT_MASK;
    108        wdogres = s->itop & R_WDOGITOP_WDOGRES_MASK;
    109    } else {
    110        wdogint = cmsdk_apb_watchdog_intstatus(s);
    111        wdogres = cmsdk_apb_watchdog_resetstatus(s);
    112    }
    113
    114    qemu_set_irq(s->wdogint, wdogint);
    115    if (wdogres) {
    116        watchdog_perform_action();
    117    }
    118}
    119
    120static uint64_t cmsdk_apb_watchdog_read(void *opaque, hwaddr offset,
    121                                        unsigned size)
    122{
    123    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(opaque);
    124    uint64_t r;
    125
    126    switch (offset) {
    127    case A_WDOGLOAD:
    128        r = ptimer_get_limit(s->timer);
    129        break;
    130    case A_WDOGVALUE:
    131        r = ptimer_get_count(s->timer);
    132        break;
    133    case A_WDOGCONTROL:
    134        r = s->control;
    135        break;
    136    case A_WDOGRIS:
    137        r = s->intstatus;
    138        break;
    139    case A_WDOGMIS:
    140        r = cmsdk_apb_watchdog_intstatus(s);
    141        break;
    142    case A_WDOGLOCK:
    143        r = s->lock;
    144        break;
    145    case A_WDOGITCR:
    146        if (s->is_luminary) {
    147            goto bad_offset;
    148        }
    149        r = s->itcr;
    150        break;
    151    case A_PID4 ... A_CID3:
    152        r = s->id[(offset - A_PID4) / 4];
    153        break;
    154    case A_WDOGINTCLR:
    155    case A_WDOGITOP:
    156        if (s->is_luminary) {
    157            goto bad_offset;
    158        }
    159        qemu_log_mask(LOG_GUEST_ERROR,
    160                      "CMSDK APB watchdog read: read of WO offset %x\n",
    161                      (int)offset);
    162        r = 0;
    163        break;
    164    case A_WDOGTEST:
    165        if (!s->is_luminary) {
    166            goto bad_offset;
    167        }
    168        qemu_log_mask(LOG_UNIMP,
    169                      "Luminary watchdog read: stall not implemented\n");
    170        r = 0;
    171        break;
    172    default:
    173bad_offset:
    174        qemu_log_mask(LOG_GUEST_ERROR,
    175                      "CMSDK APB watchdog read: bad offset %x\n", (int)offset);
    176        r = 0;
    177        break;
    178    }
    179    trace_cmsdk_apb_watchdog_read(offset, r, size);
    180    return r;
    181}
    182
    183static void cmsdk_apb_watchdog_write(void *opaque, hwaddr offset,
    184                                     uint64_t value, unsigned size)
    185{
    186    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(opaque);
    187
    188    trace_cmsdk_apb_watchdog_write(offset, value, size);
    189
    190    if (s->lock && offset != A_WDOGLOCK) {
    191        /* Write access is disabled via WDOGLOCK */
    192        qemu_log_mask(LOG_GUEST_ERROR,
    193                      "CMSDK APB watchdog write: write to locked watchdog\n");
    194        return;
    195    }
    196
    197    switch (offset) {
    198    case A_WDOGLOAD:
    199        /*
    200         * Reset the load value and the current count, and make sure
    201         * we're counting.
    202         */
    203        ptimer_transaction_begin(s->timer);
    204        ptimer_set_limit(s->timer, value, 1);
    205        ptimer_run(s->timer, 0);
    206        ptimer_transaction_commit(s->timer);
    207        break;
    208    case A_WDOGCONTROL:
    209        if (s->is_luminary && 0 != (R_WDOGCONTROL_INTEN_MASK & s->control)) {
    210            /*
    211             * The Luminary version of this device ignores writes to
    212             * this register after the guest has enabled interrupts
    213             * (so they can only be disabled again via reset).
    214             */
    215            break;
    216        }
    217        s->control = value & R_WDOGCONTROL_VALID_MASK;
    218        cmsdk_apb_watchdog_update(s);
    219        break;
    220    case A_WDOGINTCLR:
    221        s->intstatus = 0;
    222        ptimer_transaction_begin(s->timer);
    223        ptimer_set_count(s->timer, ptimer_get_limit(s->timer));
    224        ptimer_transaction_commit(s->timer);
    225        cmsdk_apb_watchdog_update(s);
    226        break;
    227    case A_WDOGLOCK:
    228        s->lock = (value != WDOG_UNLOCK_VALUE);
    229        trace_cmsdk_apb_watchdog_lock(s->lock);
    230        break;
    231    case A_WDOGITCR:
    232        if (s->is_luminary) {
    233            goto bad_offset;
    234        }
    235        s->itcr = value & R_WDOGITCR_VALID_MASK;
    236        cmsdk_apb_watchdog_update(s);
    237        break;
    238    case A_WDOGITOP:
    239        if (s->is_luminary) {
    240            goto bad_offset;
    241        }
    242        s->itop = value & R_WDOGITOP_VALID_MASK;
    243        cmsdk_apb_watchdog_update(s);
    244        break;
    245    case A_WDOGVALUE:
    246    case A_WDOGRIS:
    247    case A_WDOGMIS:
    248    case A_PID4 ... A_CID3:
    249        qemu_log_mask(LOG_GUEST_ERROR,
    250                      "CMSDK APB watchdog write: write to RO offset 0x%x\n",
    251                      (int)offset);
    252        break;
    253    case A_WDOGTEST:
    254        if (!s->is_luminary) {
    255            goto bad_offset;
    256        }
    257        qemu_log_mask(LOG_UNIMP,
    258                      "Luminary watchdog write: stall not implemented\n");
    259        break;
    260    default:
    261bad_offset:
    262        qemu_log_mask(LOG_GUEST_ERROR,
    263                      "CMSDK APB watchdog write: bad offset 0x%x\n",
    264                      (int)offset);
    265        break;
    266    }
    267}
    268
    269static const MemoryRegionOps cmsdk_apb_watchdog_ops = {
    270    .read = cmsdk_apb_watchdog_read,
    271    .write = cmsdk_apb_watchdog_write,
    272    .endianness = DEVICE_LITTLE_ENDIAN,
    273    /* byte/halfword accesses are just zero-padded on reads and writes */
    274    .impl.min_access_size = 4,
    275    .impl.max_access_size = 4,
    276    .valid.min_access_size = 1,
    277    .valid.max_access_size = 4,
    278};
    279
    280static void cmsdk_apb_watchdog_tick(void *opaque)
    281{
    282    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(opaque);
    283
    284    if (!s->intstatus) {
    285        /* Count expired for the first time: raise interrupt */
    286        s->intstatus = R_WDOGRIS_INT_MASK;
    287    } else {
    288        /* Count expired for the second time: raise reset and stop clock */
    289        s->resetstatus = 1;
    290        ptimer_stop(s->timer);
    291    }
    292    cmsdk_apb_watchdog_update(s);
    293}
    294
    295static void cmsdk_apb_watchdog_reset(DeviceState *dev)
    296{
    297    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(dev);
    298
    299    trace_cmsdk_apb_watchdog_reset();
    300    s->control = 0;
    301    s->intstatus = 0;
    302    s->lock = 0;
    303    s->itcr = 0;
    304    s->itop = 0;
    305    s->resetstatus = 0;
    306    /* Set the limit and the count */
    307    ptimer_transaction_begin(s->timer);
    308    ptimer_set_limit(s->timer, 0xffffffff, 1);
    309    ptimer_run(s->timer, 0);
    310    ptimer_transaction_commit(s->timer);
    311}
    312
    313static void cmsdk_apb_watchdog_clk_update(void *opaque, ClockEvent event)
    314{
    315    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(opaque);
    316
    317    ptimer_transaction_begin(s->timer);
    318    ptimer_set_period_from_clock(s->timer, s->wdogclk, 1);
    319    ptimer_transaction_commit(s->timer);
    320}
    321
    322static void cmsdk_apb_watchdog_init(Object *obj)
    323{
    324    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
    325    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(obj);
    326
    327    memory_region_init_io(&s->iomem, obj, &cmsdk_apb_watchdog_ops,
    328                          s, "cmsdk-apb-watchdog", 0x1000);
    329    sysbus_init_mmio(sbd, &s->iomem);
    330    sysbus_init_irq(sbd, &s->wdogint);
    331    s->wdogclk = qdev_init_clock_in(DEVICE(s), "WDOGCLK",
    332                                    cmsdk_apb_watchdog_clk_update, s,
    333                                    ClockUpdate);
    334
    335    s->is_luminary = false;
    336    s->id = cmsdk_apb_watchdog_id;
    337}
    338
    339static void cmsdk_apb_watchdog_realize(DeviceState *dev, Error **errp)
    340{
    341    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(dev);
    342
    343    if (!clock_has_source(s->wdogclk)) {
    344        error_setg(errp,
    345                   "CMSDK APB watchdog: WDOGCLK clock must be connected");
    346        return;
    347    }
    348
    349    s->timer = ptimer_init(cmsdk_apb_watchdog_tick, s,
    350                           PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD |
    351                           PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT |
    352                           PTIMER_POLICY_NO_IMMEDIATE_RELOAD |
    353                           PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
    354
    355    ptimer_transaction_begin(s->timer);
    356    ptimer_set_period_from_clock(s->timer, s->wdogclk, 1);
    357    ptimer_transaction_commit(s->timer);
    358}
    359
    360static const VMStateDescription cmsdk_apb_watchdog_vmstate = {
    361    .name = "cmsdk-apb-watchdog",
    362    .version_id = 2,
    363    .minimum_version_id = 2,
    364    .fields = (VMStateField[]) {
    365        VMSTATE_CLOCK(wdogclk, CMSDKAPBWatchdog),
    366        VMSTATE_PTIMER(timer, CMSDKAPBWatchdog),
    367        VMSTATE_UINT32(control, CMSDKAPBWatchdog),
    368        VMSTATE_UINT32(intstatus, CMSDKAPBWatchdog),
    369        VMSTATE_UINT32(lock, CMSDKAPBWatchdog),
    370        VMSTATE_UINT32(itcr, CMSDKAPBWatchdog),
    371        VMSTATE_UINT32(itop, CMSDKAPBWatchdog),
    372        VMSTATE_UINT32(resetstatus, CMSDKAPBWatchdog),
    373        VMSTATE_END_OF_LIST()
    374    }
    375};
    376
    377static void cmsdk_apb_watchdog_class_init(ObjectClass *klass, void *data)
    378{
    379    DeviceClass *dc = DEVICE_CLASS(klass);
    380
    381    dc->realize = cmsdk_apb_watchdog_realize;
    382    dc->vmsd = &cmsdk_apb_watchdog_vmstate;
    383    dc->reset = cmsdk_apb_watchdog_reset;
    384}
    385
    386static const TypeInfo cmsdk_apb_watchdog_info = {
    387    .name = TYPE_CMSDK_APB_WATCHDOG,
    388    .parent = TYPE_SYS_BUS_DEVICE,
    389    .instance_size = sizeof(CMSDKAPBWatchdog),
    390    .instance_init = cmsdk_apb_watchdog_init,
    391    .class_init = cmsdk_apb_watchdog_class_init,
    392};
    393
    394static void luminary_watchdog_init(Object *obj)
    395{
    396    CMSDKAPBWatchdog *s = CMSDK_APB_WATCHDOG(obj);
    397
    398    s->is_luminary = true;
    399    s->id = luminary_watchdog_id;
    400}
    401
    402static const TypeInfo luminary_watchdog_info = {
    403    .name = TYPE_LUMINARY_WATCHDOG,
    404    .parent = TYPE_CMSDK_APB_WATCHDOG,
    405    .instance_init = luminary_watchdog_init
    406};
    407
    408static void cmsdk_apb_watchdog_register_types(void)
    409{
    410    type_register_static(&cmsdk_apb_watchdog_info);
    411    type_register_static(&luminary_watchdog_info);
    412}
    413
    414type_init(cmsdk_apb_watchdog_register_types);