cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

wdt_aspeed.c (12109B)


      1/*
      2 * ASPEED Watchdog Controller
      3 *
      4 * Copyright (C) 2016-2017 IBM Corp.
      5 *
      6 * This code is licensed under the GPL version 2 or later. See the
      7 * COPYING file in the top-level directory.
      8 */
      9
     10#include "qemu/osdep.h"
     11
     12#include "qapi/error.h"
     13#include "qemu/log.h"
     14#include "qemu/module.h"
     15#include "qemu/timer.h"
     16#include "sysemu/watchdog.h"
     17#include "hw/misc/aspeed_scu.h"
     18#include "hw/qdev-properties.h"
     19#include "hw/sysbus.h"
     20#include "hw/watchdog/wdt_aspeed.h"
     21#include "migration/vmstate.h"
     22#include "trace.h"
     23
     24#define WDT_STATUS                      (0x00 / 4)
     25#define WDT_RELOAD_VALUE                (0x04 / 4)
     26#define WDT_RESTART                     (0x08 / 4)
     27#define WDT_CTRL                        (0x0C / 4)
     28#define   WDT_CTRL_RESET_MODE_SOC       (0x00 << 5)
     29#define   WDT_CTRL_RESET_MODE_FULL_CHIP (0x01 << 5)
     30#define   WDT_CTRL_1MHZ_CLK             BIT(4)
     31#define   WDT_CTRL_WDT_EXT              BIT(3)
     32#define   WDT_CTRL_WDT_INTR             BIT(2)
     33#define   WDT_CTRL_RESET_SYSTEM         BIT(1)
     34#define   WDT_CTRL_ENABLE               BIT(0)
     35#define WDT_RESET_WIDTH                 (0x18 / 4)
     36#define   WDT_RESET_WIDTH_ACTIVE_HIGH   BIT(31)
     37#define     WDT_POLARITY_MASK           (0xFF << 24)
     38#define     WDT_ACTIVE_HIGH_MAGIC       (0xA5 << 24)
     39#define     WDT_ACTIVE_LOW_MAGIC        (0x5A << 24)
     40#define   WDT_RESET_WIDTH_PUSH_PULL     BIT(30)
     41#define     WDT_DRIVE_TYPE_MASK         (0xFF << 24)
     42#define     WDT_PUSH_PULL_MAGIC         (0xA8 << 24)
     43#define     WDT_OPEN_DRAIN_MAGIC        (0x8A << 24)
     44#define WDT_RESET_MASK1                 (0x1c / 4)
     45
     46#define WDT_TIMEOUT_STATUS              (0x10 / 4)
     47#define WDT_TIMEOUT_CLEAR               (0x14 / 4)
     48
     49#define WDT_RESTART_MAGIC               0x4755
     50
     51#define AST2600_SCU_RESET_CONTROL1      (0x40 / 4)
     52#define SCU_RESET_CONTROL1              (0x04 / 4)
     53#define    SCU_RESET_SDRAM              BIT(0)
     54
     55static bool aspeed_wdt_is_enabled(const AspeedWDTState *s)
     56{
     57    return s->regs[WDT_CTRL] & WDT_CTRL_ENABLE;
     58}
     59
     60static uint64_t aspeed_wdt_read(void *opaque, hwaddr offset, unsigned size)
     61{
     62    AspeedWDTState *s = ASPEED_WDT(opaque);
     63
     64    trace_aspeed_wdt_read(offset, size);
     65
     66    offset >>= 2;
     67
     68    switch (offset) {
     69    case WDT_STATUS:
     70        return s->regs[WDT_STATUS];
     71    case WDT_RELOAD_VALUE:
     72        return s->regs[WDT_RELOAD_VALUE];
     73    case WDT_RESTART:
     74        qemu_log_mask(LOG_GUEST_ERROR,
     75                      "%s: read from write-only reg at offset 0x%"
     76                      HWADDR_PRIx "\n", __func__, offset);
     77        return 0;
     78    case WDT_CTRL:
     79        return s->regs[WDT_CTRL];
     80    case WDT_RESET_WIDTH:
     81        return s->regs[WDT_RESET_WIDTH];
     82    case WDT_RESET_MASK1:
     83        return s->regs[WDT_RESET_MASK1];
     84    case WDT_TIMEOUT_STATUS:
     85    case WDT_TIMEOUT_CLEAR:
     86        qemu_log_mask(LOG_UNIMP,
     87                      "%s: uninmplemented read at offset 0x%" HWADDR_PRIx "\n",
     88                      __func__, offset);
     89        return 0;
     90    default:
     91        qemu_log_mask(LOG_GUEST_ERROR,
     92                      "%s: Out-of-bounds read at offset 0x%" HWADDR_PRIx "\n",
     93                      __func__, offset);
     94        return 0;
     95    }
     96
     97}
     98
     99static void aspeed_wdt_reload(AspeedWDTState *s)
    100{
    101    uint64_t reload;
    102
    103    if (!(s->regs[WDT_CTRL] & WDT_CTRL_1MHZ_CLK)) {
    104        reload = muldiv64(s->regs[WDT_RELOAD_VALUE], NANOSECONDS_PER_SECOND,
    105                          s->pclk_freq);
    106    } else {
    107        reload = s->regs[WDT_RELOAD_VALUE] * 1000ULL;
    108    }
    109
    110    if (aspeed_wdt_is_enabled(s)) {
    111        timer_mod(s->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + reload);
    112    }
    113}
    114
    115static void aspeed_wdt_reload_1mhz(AspeedWDTState *s)
    116{
    117    uint64_t reload = s->regs[WDT_RELOAD_VALUE] * 1000ULL;
    118
    119    if (aspeed_wdt_is_enabled(s)) {
    120        timer_mod(s->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + reload);
    121    }
    122}
    123
    124static uint64_t aspeed_2400_sanitize_ctrl(uint64_t data)
    125{
    126    return data & 0xffff;
    127}
    128
    129static uint64_t aspeed_2500_sanitize_ctrl(uint64_t data)
    130{
    131    return (data & ~(0xfUL << 8)) | WDT_CTRL_1MHZ_CLK;
    132}
    133
    134static uint64_t aspeed_2600_sanitize_ctrl(uint64_t data)
    135{
    136    return data & ~(0x7UL << 7);
    137}
    138
    139static void aspeed_wdt_write(void *opaque, hwaddr offset, uint64_t data,
    140                             unsigned size)
    141{
    142    AspeedWDTState *s = ASPEED_WDT(opaque);
    143    AspeedWDTClass *awc = ASPEED_WDT_GET_CLASS(s);
    144    bool enable;
    145
    146    trace_aspeed_wdt_write(offset, size, data);
    147
    148    offset >>= 2;
    149
    150    switch (offset) {
    151    case WDT_STATUS:
    152        qemu_log_mask(LOG_GUEST_ERROR,
    153                      "%s: write to read-only reg at offset 0x%"
    154                      HWADDR_PRIx "\n", __func__, offset);
    155        break;
    156    case WDT_RELOAD_VALUE:
    157        s->regs[WDT_RELOAD_VALUE] = data;
    158        break;
    159    case WDT_RESTART:
    160        if ((data & 0xFFFF) == WDT_RESTART_MAGIC) {
    161            s->regs[WDT_STATUS] = s->regs[WDT_RELOAD_VALUE];
    162            awc->wdt_reload(s);
    163        }
    164        break;
    165    case WDT_CTRL:
    166        data = awc->sanitize_ctrl(data);
    167        enable = data & WDT_CTRL_ENABLE;
    168        if (enable && !aspeed_wdt_is_enabled(s)) {
    169            s->regs[WDT_CTRL] = data;
    170            awc->wdt_reload(s);
    171        } else if (!enable && aspeed_wdt_is_enabled(s)) {
    172            s->regs[WDT_CTRL] = data;
    173            timer_del(s->timer);
    174        } else {
    175            s->regs[WDT_CTRL] = data;
    176        }
    177        break;
    178    case WDT_RESET_WIDTH:
    179        if (awc->reset_pulse) {
    180            awc->reset_pulse(s, data & WDT_POLARITY_MASK);
    181        }
    182        s->regs[WDT_RESET_WIDTH] &= ~awc->ext_pulse_width_mask;
    183        s->regs[WDT_RESET_WIDTH] |= data & awc->ext_pulse_width_mask;
    184        break;
    185
    186    case WDT_RESET_MASK1:
    187        /* TODO: implement */
    188        s->regs[WDT_RESET_MASK1] = data;
    189        break;
    190
    191    case WDT_TIMEOUT_STATUS:
    192    case WDT_TIMEOUT_CLEAR:
    193        qemu_log_mask(LOG_UNIMP,
    194                      "%s: uninmplemented write at offset 0x%" HWADDR_PRIx "\n",
    195                      __func__, offset);
    196        break;
    197    default:
    198        qemu_log_mask(LOG_GUEST_ERROR,
    199                      "%s: Out-of-bounds write at offset 0x%" HWADDR_PRIx "\n",
    200                      __func__, offset);
    201    }
    202    return;
    203}
    204
    205static WatchdogTimerModel model = {
    206    .wdt_name = TYPE_ASPEED_WDT,
    207    .wdt_description = "Aspeed watchdog device",
    208};
    209
    210static const VMStateDescription vmstate_aspeed_wdt = {
    211    .name = "vmstate_aspeed_wdt",
    212    .version_id = 0,
    213    .minimum_version_id = 0,
    214    .fields = (VMStateField[]) {
    215        VMSTATE_TIMER_PTR(timer, AspeedWDTState),
    216        VMSTATE_UINT32_ARRAY(regs, AspeedWDTState, ASPEED_WDT_REGS_MAX),
    217        VMSTATE_END_OF_LIST()
    218    }
    219};
    220
    221static const MemoryRegionOps aspeed_wdt_ops = {
    222    .read = aspeed_wdt_read,
    223    .write = aspeed_wdt_write,
    224    .endianness = DEVICE_LITTLE_ENDIAN,
    225    .valid.min_access_size = 4,
    226    .valid.max_access_size = 4,
    227    .valid.unaligned = false,
    228};
    229
    230static void aspeed_wdt_reset(DeviceState *dev)
    231{
    232    AspeedWDTState *s = ASPEED_WDT(dev);
    233    AspeedWDTClass *awc = ASPEED_WDT_GET_CLASS(s);
    234
    235    s->regs[WDT_STATUS] = 0x3EF1480;
    236    s->regs[WDT_RELOAD_VALUE] = 0x03EF1480;
    237    s->regs[WDT_RESTART] = 0;
    238    s->regs[WDT_CTRL] = awc->sanitize_ctrl(0);
    239    s->regs[WDT_RESET_WIDTH] = 0xFF;
    240
    241    timer_del(s->timer);
    242}
    243
    244static void aspeed_wdt_timer_expired(void *dev)
    245{
    246    AspeedWDTState *s = ASPEED_WDT(dev);
    247    uint32_t reset_ctrl_reg = ASPEED_WDT_GET_CLASS(s)->reset_ctrl_reg;
    248
    249    /* Do not reset on SDRAM controller reset */
    250    if (s->scu->regs[reset_ctrl_reg] & SCU_RESET_SDRAM) {
    251        timer_del(s->timer);
    252        s->regs[WDT_CTRL] = 0;
    253        return;
    254    }
    255
    256    qemu_log_mask(CPU_LOG_RESET, "Watchdog timer %" HWADDR_PRIx " expired.\n",
    257                  s->iomem.addr);
    258    watchdog_perform_action();
    259    timer_del(s->timer);
    260}
    261
    262#define PCLK_HZ 24000000
    263
    264static void aspeed_wdt_realize(DeviceState *dev, Error **errp)
    265{
    266    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
    267    AspeedWDTState *s = ASPEED_WDT(dev);
    268
    269    assert(s->scu);
    270
    271    s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, aspeed_wdt_timer_expired, dev);
    272
    273    /* FIXME: This setting should be derived from the SCU hw strapping
    274     * register SCU70
    275     */
    276    s->pclk_freq = PCLK_HZ;
    277
    278    memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_wdt_ops, s,
    279                          TYPE_ASPEED_WDT, ASPEED_WDT_REGS_MAX * 4);
    280    sysbus_init_mmio(sbd, &s->iomem);
    281}
    282
    283static Property aspeed_wdt_properties[] = {
    284    DEFINE_PROP_LINK("scu", AspeedWDTState, scu, TYPE_ASPEED_SCU,
    285                     AspeedSCUState *),
    286    DEFINE_PROP_END_OF_LIST(),
    287};
    288
    289static void aspeed_wdt_class_init(ObjectClass *klass, void *data)
    290{
    291    DeviceClass *dc = DEVICE_CLASS(klass);
    292
    293    dc->desc = "ASPEED Watchdog Controller";
    294    dc->realize = aspeed_wdt_realize;
    295    dc->reset = aspeed_wdt_reset;
    296    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
    297    dc->vmsd = &vmstate_aspeed_wdt;
    298    device_class_set_props(dc, aspeed_wdt_properties);
    299}
    300
    301static const TypeInfo aspeed_wdt_info = {
    302    .parent = TYPE_SYS_BUS_DEVICE,
    303    .name  = TYPE_ASPEED_WDT,
    304    .instance_size  = sizeof(AspeedWDTState),
    305    .class_init = aspeed_wdt_class_init,
    306    .class_size    = sizeof(AspeedWDTClass),
    307    .abstract      = true,
    308};
    309
    310static void aspeed_2400_wdt_class_init(ObjectClass *klass, void *data)
    311{
    312    DeviceClass *dc = DEVICE_CLASS(klass);
    313    AspeedWDTClass *awc = ASPEED_WDT_CLASS(klass);
    314
    315    dc->desc = "ASPEED 2400 Watchdog Controller";
    316    awc->offset = 0x20;
    317    awc->ext_pulse_width_mask = 0xff;
    318    awc->reset_ctrl_reg = SCU_RESET_CONTROL1;
    319    awc->wdt_reload = aspeed_wdt_reload;
    320    awc->sanitize_ctrl = aspeed_2400_sanitize_ctrl;
    321}
    322
    323static const TypeInfo aspeed_2400_wdt_info = {
    324    .name = TYPE_ASPEED_2400_WDT,
    325    .parent = TYPE_ASPEED_WDT,
    326    .instance_size = sizeof(AspeedWDTState),
    327    .class_init = aspeed_2400_wdt_class_init,
    328};
    329
    330static void aspeed_2500_wdt_reset_pulse(AspeedWDTState *s, uint32_t property)
    331{
    332    if (property) {
    333        if (property == WDT_ACTIVE_HIGH_MAGIC) {
    334            s->regs[WDT_RESET_WIDTH] |= WDT_RESET_WIDTH_ACTIVE_HIGH;
    335        } else if (property == WDT_ACTIVE_LOW_MAGIC) {
    336            s->regs[WDT_RESET_WIDTH] &= ~WDT_RESET_WIDTH_ACTIVE_HIGH;
    337        } else if (property == WDT_PUSH_PULL_MAGIC) {
    338            s->regs[WDT_RESET_WIDTH] |= WDT_RESET_WIDTH_PUSH_PULL;
    339        } else if (property == WDT_OPEN_DRAIN_MAGIC) {
    340            s->regs[WDT_RESET_WIDTH] &= ~WDT_RESET_WIDTH_PUSH_PULL;
    341        }
    342    }
    343}
    344
    345static void aspeed_2500_wdt_class_init(ObjectClass *klass, void *data)
    346{
    347    DeviceClass *dc = DEVICE_CLASS(klass);
    348    AspeedWDTClass *awc = ASPEED_WDT_CLASS(klass);
    349
    350    dc->desc = "ASPEED 2500 Watchdog Controller";
    351    awc->offset = 0x20;
    352    awc->ext_pulse_width_mask = 0xfffff;
    353    awc->reset_ctrl_reg = SCU_RESET_CONTROL1;
    354    awc->reset_pulse = aspeed_2500_wdt_reset_pulse;
    355    awc->wdt_reload = aspeed_wdt_reload_1mhz;
    356    awc->sanitize_ctrl = aspeed_2500_sanitize_ctrl;
    357}
    358
    359static const TypeInfo aspeed_2500_wdt_info = {
    360    .name = TYPE_ASPEED_2500_WDT,
    361    .parent = TYPE_ASPEED_WDT,
    362    .instance_size = sizeof(AspeedWDTState),
    363    .class_init = aspeed_2500_wdt_class_init,
    364};
    365
    366static void aspeed_2600_wdt_class_init(ObjectClass *klass, void *data)
    367{
    368    DeviceClass *dc = DEVICE_CLASS(klass);
    369    AspeedWDTClass *awc = ASPEED_WDT_CLASS(klass);
    370
    371    dc->desc = "ASPEED 2600 Watchdog Controller";
    372    awc->offset = 0x40;
    373    awc->ext_pulse_width_mask = 0xfffff; /* TODO */
    374    awc->reset_ctrl_reg = AST2600_SCU_RESET_CONTROL1;
    375    awc->reset_pulse = aspeed_2500_wdt_reset_pulse;
    376    awc->wdt_reload = aspeed_wdt_reload_1mhz;
    377    awc->sanitize_ctrl = aspeed_2600_sanitize_ctrl;
    378}
    379
    380static const TypeInfo aspeed_2600_wdt_info = {
    381    .name = TYPE_ASPEED_2600_WDT,
    382    .parent = TYPE_ASPEED_WDT,
    383    .instance_size = sizeof(AspeedWDTState),
    384    .class_init = aspeed_2600_wdt_class_init,
    385};
    386
    387static void wdt_aspeed_register_types(void)
    388{
    389    watchdog_add_model(&model);
    390    type_register_static(&aspeed_wdt_info);
    391    type_register_static(&aspeed_2400_wdt_info);
    392    type_register_static(&aspeed_2500_wdt_info);
    393    type_register_static(&aspeed_2600_wdt_info);
    394}
    395
    396type_init(wdt_aspeed_register_types)