1 | /* |
2 | * Virtual hardware watchdog. |
3 | * |
4 | * Copyright (C) 2009 Red Hat Inc. |
5 | * |
6 | * This program is free software; you can redistribute it and/or |
7 | * modify it under the terms of the GNU General Public License |
8 | * as published by the Free Software Foundation; either version 2 |
9 | * of the License, or (at your option) any later version. |
10 | * |
11 | * This program is distributed in the hope that it will be useful, |
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
14 | * GNU General Public License for more details. |
15 | * |
16 | * You should have received a copy of the GNU General Public License |
17 | * along with this program; if not, see <http://www.gnu.org/licenses/>. |
18 | * |
19 | * By Richard W.M. Jones (rjones@redhat.com). |
20 | */ |
21 | |
22 | #include "qemu/osdep.h" |
23 | |
24 | #include "qemu/module.h" |
25 | #include "qemu/timer.h" |
26 | #include "sysemu/watchdog.h" |
27 | #include "hw/pci/pci.h" |
28 | #include "migration/vmstate.h" |
29 | |
30 | /*#define I6300ESB_DEBUG 1*/ |
31 | |
32 | #ifdef I6300ESB_DEBUG |
33 | #define i6300esb_debug(fs,...) \ |
34 | fprintf(stderr,"i6300esb: %s: "fs,__func__,##__VA_ARGS__) |
35 | #else |
36 | #define i6300esb_debug(fs,...) |
37 | #endif |
38 | |
39 | /* PCI configuration registers */ |
40 | #define ESB_CONFIG_REG 0x60 /* Config register */ |
41 | #define ESB_LOCK_REG 0x68 /* WDT lock register */ |
42 | |
43 | /* Memory mapped registers (offset from base address) */ |
44 | #define ESB_TIMER1_REG 0x00 /* Timer1 value after each reset */ |
45 | #define ESB_TIMER2_REG 0x04 /* Timer2 value after each reset */ |
46 | #define ESB_GINTSR_REG 0x08 /* General Interrupt Status Register */ |
47 | #define ESB_RELOAD_REG 0x0c /* Reload register */ |
48 | |
49 | /* Lock register bits */ |
50 | #define ESB_WDT_FUNC (0x01 << 2) /* Watchdog functionality */ |
51 | #define ESB_WDT_ENABLE (0x01 << 1) /* Enable WDT */ |
52 | #define ESB_WDT_LOCK (0x01 << 0) /* Lock (nowayout) */ |
53 | |
54 | /* Config register bits */ |
55 | #define ESB_WDT_REBOOT (0x01 << 5) /* Enable reboot on timeout */ |
56 | #define ESB_WDT_FREQ (0x01 << 2) /* Decrement frequency */ |
57 | #define ESB_WDT_INTTYPE (0x11 << 0) /* Interrupt type on timer1 timeout */ |
58 | |
59 | /* Reload register bits */ |
60 | #define ESB_WDT_RELOAD (0x01 << 8) /* prevent timeout */ |
61 | |
62 | /* Magic constants */ |
63 | #define ESB_UNLOCK1 0x80 /* Step 1 to unlock reset registers */ |
64 | #define ESB_UNLOCK2 0x86 /* Step 2 to unlock reset registers */ |
65 | |
66 | /* Device state. */ |
67 | struct I6300State { |
68 | PCIDevice dev; |
69 | MemoryRegion io_mem; |
70 | |
71 | int reboot_enabled; /* "Reboot" on timer expiry. The real action |
72 | * performed depends on the -watchdog-action |
73 | * param passed on QEMU command line. |
74 | */ |
75 | int clock_scale; /* Clock scale. */ |
76 | #define CLOCK_SCALE_1KHZ 0 |
77 | #define CLOCK_SCALE_1MHZ 1 |
78 | |
79 | int int_type; /* Interrupt type generated. */ |
80 | #define INT_TYPE_IRQ 0 /* APIC 1, INT 10 */ |
81 | #define INT_TYPE_SMI 2 |
82 | #define INT_TYPE_DISABLED 3 |
83 | |
84 | int free_run; /* If true, reload timer on expiry. */ |
85 | int locked; /* If true, enabled field cannot be changed. */ |
86 | int enabled; /* If true, watchdog is enabled. */ |
87 | |
88 | QEMUTimer *timer; /* The actual watchdog timer. */ |
89 | |
90 | uint32_t timer1_preload; /* Values preloaded into timer1, timer2. */ |
91 | uint32_t timer2_preload; |
92 | int stage; /* Stage (1 or 2). */ |
93 | |
94 | int unlock_state; /* Guest writes 0x80, 0x86 to unlock the |
95 | * registers, and we transition through |
96 | * states 0 -> 1 -> 2 when this happens. |
97 | */ |
98 | |
99 | int previous_reboot_flag; /* If the watchdog caused the previous |
100 | * reboot, this flag will be set. |
101 | */ |
102 | }; |
103 | |
104 | typedef struct I6300State I6300State; |
105 | |
106 | #define TYPE_WATCHDOG_I6300ESB_DEVICE "i6300esb" |
107 | #define WATCHDOG_I6300ESB_DEVICE(obj) \ |
108 | OBJECT_CHECK(I6300State, (obj), TYPE_WATCHDOG_I6300ESB_DEVICE) |
109 | |
110 | /* This function is called when the watchdog has either been enabled |
111 | * (hence it starts counting down) or has been keep-alived. |
112 | */ |
113 | static void i6300esb_restart_timer(I6300State *d, int stage) |
114 | { |
115 | int64_t timeout; |
116 | |
117 | if (!d->enabled) |
118 | return; |
119 | |
120 | d->stage = stage; |
121 | |
122 | if (d->stage <= 1) |
123 | timeout = d->timer1_preload; |
124 | else |
125 | timeout = d->timer2_preload; |
126 | |
127 | if (d->clock_scale == CLOCK_SCALE_1KHZ) |
128 | timeout <<= 15; |
129 | else |
130 | timeout <<= 5; |
131 | |
132 | /* Get the timeout in nanoseconds. */ |
133 | |
134 | timeout = timeout * 30; /* on a PCI bus, 1 tick is 30 ns*/ |
135 | |
136 | i6300esb_debug("stage %d, timeout %" PRIi64 "\n" , d->stage, timeout); |
137 | |
138 | timer_mod(d->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + timeout); |
139 | } |
140 | |
141 | /* This is called when the guest disables the watchdog. */ |
142 | static void i6300esb_disable_timer(I6300State *d) |
143 | { |
144 | i6300esb_debug("timer disabled\n" ); |
145 | |
146 | timer_del(d->timer); |
147 | } |
148 | |
149 | static void i6300esb_reset(DeviceState *dev) |
150 | { |
151 | PCIDevice *pdev = PCI_DEVICE(dev); |
152 | I6300State *d = WATCHDOG_I6300ESB_DEVICE(pdev); |
153 | |
154 | i6300esb_debug("I6300State = %p\n" , d); |
155 | |
156 | i6300esb_disable_timer(d); |
157 | |
158 | /* NB: Don't change d->previous_reboot_flag in this function. */ |
159 | |
160 | d->reboot_enabled = 1; |
161 | d->clock_scale = CLOCK_SCALE_1KHZ; |
162 | d->int_type = INT_TYPE_IRQ; |
163 | d->free_run = 0; |
164 | d->locked = 0; |
165 | d->enabled = 0; |
166 | d->timer1_preload = 0xfffff; |
167 | d->timer2_preload = 0xfffff; |
168 | d->stage = 1; |
169 | d->unlock_state = 0; |
170 | } |
171 | |
172 | /* This function is called when the watchdog expires. Note that |
173 | * the hardware has two timers, and so expiry happens in two stages. |
174 | * If d->stage == 1 then we perform the first stage action (usually, |
175 | * sending an interrupt) and then restart the timer again for the |
176 | * second stage. If the second stage expires then the watchdog |
177 | * really has run out. |
178 | */ |
179 | static void i6300esb_timer_expired(void *vp) |
180 | { |
181 | I6300State *d = vp; |
182 | |
183 | i6300esb_debug("stage %d\n" , d->stage); |
184 | |
185 | if (d->stage == 1) { |
186 | /* What to do at the end of stage 1? */ |
187 | switch (d->int_type) { |
188 | case INT_TYPE_IRQ: |
189 | fprintf(stderr, "i6300esb_timer_expired: I would send APIC 1 INT 10 here if I knew how (XXX)\n" ); |
190 | break; |
191 | case INT_TYPE_SMI: |
192 | fprintf(stderr, "i6300esb_timer_expired: I would send SMI here if I knew how (XXX)\n" ); |
193 | break; |
194 | } |
195 | |
196 | /* Start the second stage. */ |
197 | i6300esb_restart_timer(d, 2); |
198 | } else { |
199 | /* Second stage expired, reboot for real. */ |
200 | if (d->reboot_enabled) { |
201 | d->previous_reboot_flag = 1; |
202 | watchdog_perform_action(); /* This reboots, exits, etc */ |
203 | i6300esb_reset(DEVICE(d)); |
204 | } |
205 | |
206 | /* In "free running mode" we start stage 1 again. */ |
207 | if (d->free_run) |
208 | i6300esb_restart_timer(d, 1); |
209 | } |
210 | } |
211 | |
212 | static void i6300esb_config_write(PCIDevice *dev, uint32_t addr, |
213 | uint32_t data, int len) |
214 | { |
215 | I6300State *d = WATCHDOG_I6300ESB_DEVICE(dev); |
216 | int old; |
217 | |
218 | i6300esb_debug("addr = %x, data = %x, len = %d\n" , addr, data, len); |
219 | |
220 | if (addr == ESB_CONFIG_REG && len == 2) { |
221 | d->reboot_enabled = (data & ESB_WDT_REBOOT) == 0; |
222 | d->clock_scale = |
223 | (data & ESB_WDT_FREQ) != 0 ? CLOCK_SCALE_1MHZ : CLOCK_SCALE_1KHZ; |
224 | d->int_type = (data & ESB_WDT_INTTYPE); |
225 | } else if (addr == ESB_LOCK_REG && len == 1) { |
226 | if (!d->locked) { |
227 | d->locked = (data & ESB_WDT_LOCK) != 0; |
228 | d->free_run = (data & ESB_WDT_FUNC) != 0; |
229 | old = d->enabled; |
230 | d->enabled = (data & ESB_WDT_ENABLE) != 0; |
231 | if (!old && d->enabled) /* Enabled transitioned from 0 -> 1 */ |
232 | i6300esb_restart_timer(d, 1); |
233 | else if (!d->enabled) |
234 | i6300esb_disable_timer(d); |
235 | } |
236 | } else { |
237 | pci_default_write_config(dev, addr, data, len); |
238 | } |
239 | } |
240 | |
241 | static uint32_t i6300esb_config_read(PCIDevice *dev, uint32_t addr, int len) |
242 | { |
243 | I6300State *d = WATCHDOG_I6300ESB_DEVICE(dev); |
244 | uint32_t data; |
245 | |
246 | i6300esb_debug ("addr = %x, len = %d\n" , addr, len); |
247 | |
248 | if (addr == ESB_CONFIG_REG && len == 2) { |
249 | data = |
250 | (d->reboot_enabled ? 0 : ESB_WDT_REBOOT) | |
251 | (d->clock_scale == CLOCK_SCALE_1MHZ ? ESB_WDT_FREQ : 0) | |
252 | d->int_type; |
253 | return data; |
254 | } else if (addr == ESB_LOCK_REG && len == 1) { |
255 | data = |
256 | (d->free_run ? ESB_WDT_FUNC : 0) | |
257 | (d->locked ? ESB_WDT_LOCK : 0) | |
258 | (d->enabled ? ESB_WDT_ENABLE : 0); |
259 | return data; |
260 | } else { |
261 | return pci_default_read_config(dev, addr, len); |
262 | } |
263 | } |
264 | |
265 | static uint32_t i6300esb_mem_readb(void *vp, hwaddr addr) |
266 | { |
267 | i6300esb_debug ("addr = %x\n" , (int) addr); |
268 | |
269 | return 0; |
270 | } |
271 | |
272 | static uint32_t i6300esb_mem_readw(void *vp, hwaddr addr) |
273 | { |
274 | uint32_t data = 0; |
275 | I6300State *d = vp; |
276 | |
277 | i6300esb_debug("addr = %x\n" , (int) addr); |
278 | |
279 | if (addr == 0xc) { |
280 | /* The previous reboot flag is really bit 9, but there is |
281 | * a bug in the Linux driver where it thinks it's bit 12. |
282 | * Set both. |
283 | */ |
284 | data = d->previous_reboot_flag ? 0x1200 : 0; |
285 | } |
286 | |
287 | return data; |
288 | } |
289 | |
290 | static uint32_t i6300esb_mem_readl(void *vp, hwaddr addr) |
291 | { |
292 | i6300esb_debug("addr = %x\n" , (int) addr); |
293 | |
294 | return 0; |
295 | } |
296 | |
297 | static void i6300esb_mem_writeb(void *vp, hwaddr addr, uint32_t val) |
298 | { |
299 | I6300State *d = vp; |
300 | |
301 | i6300esb_debug("addr = %x, val = %x\n" , (int) addr, val); |
302 | |
303 | if (addr == 0xc && val == 0x80) |
304 | d->unlock_state = 1; |
305 | else if (addr == 0xc && val == 0x86 && d->unlock_state == 1) |
306 | d->unlock_state = 2; |
307 | } |
308 | |
309 | static void i6300esb_mem_writew(void *vp, hwaddr addr, uint32_t val) |
310 | { |
311 | I6300State *d = vp; |
312 | |
313 | i6300esb_debug("addr = %x, val = %x\n" , (int) addr, val); |
314 | |
315 | if (addr == 0xc && val == 0x80) |
316 | d->unlock_state = 1; |
317 | else if (addr == 0xc && val == 0x86 && d->unlock_state == 1) |
318 | d->unlock_state = 2; |
319 | else { |
320 | if (d->unlock_state == 2) { |
321 | if (addr == 0xc) { |
322 | if ((val & 0x100) != 0) |
323 | /* This is the "ping" from the userspace watchdog in |
324 | * the guest ... |
325 | */ |
326 | i6300esb_restart_timer(d, 1); |
327 | |
328 | /* Setting bit 9 resets the previous reboot flag. |
329 | * There's a bug in the Linux driver where it sets |
330 | * bit 12 instead. |
331 | */ |
332 | if ((val & 0x200) != 0 || (val & 0x1000) != 0) { |
333 | d->previous_reboot_flag = 0; |
334 | } |
335 | } |
336 | |
337 | d->unlock_state = 0; |
338 | } |
339 | } |
340 | } |
341 | |
342 | static void i6300esb_mem_writel(void *vp, hwaddr addr, uint32_t val) |
343 | { |
344 | I6300State *d = vp; |
345 | |
346 | i6300esb_debug ("addr = %x, val = %x\n" , (int) addr, val); |
347 | |
348 | if (addr == 0xc && val == 0x80) |
349 | d->unlock_state = 1; |
350 | else if (addr == 0xc && val == 0x86 && d->unlock_state == 1) |
351 | d->unlock_state = 2; |
352 | else { |
353 | if (d->unlock_state == 2) { |
354 | if (addr == 0) |
355 | d->timer1_preload = val & 0xfffff; |
356 | else if (addr == 4) |
357 | d->timer2_preload = val & 0xfffff; |
358 | |
359 | d->unlock_state = 0; |
360 | } |
361 | } |
362 | } |
363 | |
364 | static uint64_t i6300esb_mem_readfn(void *opaque, hwaddr addr, unsigned size) |
365 | { |
366 | switch (size) { |
367 | case 1: |
368 | return i6300esb_mem_readb(opaque, addr); |
369 | case 2: |
370 | return i6300esb_mem_readw(opaque, addr); |
371 | case 4: |
372 | return i6300esb_mem_readl(opaque, addr); |
373 | default: |
374 | g_assert_not_reached(); |
375 | } |
376 | } |
377 | |
378 | static void i6300esb_mem_writefn(void *opaque, hwaddr addr, |
379 | uint64_t value, unsigned size) |
380 | { |
381 | switch (size) { |
382 | case 1: |
383 | i6300esb_mem_writeb(opaque, addr, value); |
384 | break; |
385 | case 2: |
386 | i6300esb_mem_writew(opaque, addr, value); |
387 | break; |
388 | case 4: |
389 | i6300esb_mem_writel(opaque, addr, value); |
390 | break; |
391 | default: |
392 | g_assert_not_reached(); |
393 | } |
394 | } |
395 | |
396 | static const MemoryRegionOps i6300esb_ops = { |
397 | .read = i6300esb_mem_readfn, |
398 | .write = i6300esb_mem_writefn, |
399 | .valid.min_access_size = 1, |
400 | .valid.max_access_size = 4, |
401 | .endianness = DEVICE_LITTLE_ENDIAN, |
402 | }; |
403 | |
404 | static const VMStateDescription vmstate_i6300esb = { |
405 | .name = "i6300esb_wdt" , |
406 | /* With this VMSD's introduction, version_id/minimum_version_id were |
407 | * erroneously set to sizeof(I6300State), causing a somewhat random |
408 | * version_id to be set for every build. This eventually broke |
409 | * migration. |
410 | * |
411 | * To correct this without breaking old->new migration for older |
412 | * versions of QEMU, we've set version_id to a value high enough |
413 | * to exceed all past values of sizeof(I6300State) across various |
414 | * build environments, and have reset minimum_version_id to 1, |
415 | * since this VMSD has never changed and thus can accept all past |
416 | * versions. |
417 | * |
418 | * For future changes we can treat these values as we normally would. |
419 | */ |
420 | .version_id = 10000, |
421 | .minimum_version_id = 1, |
422 | .fields = (VMStateField[]) { |
423 | VMSTATE_PCI_DEVICE(dev, I6300State), |
424 | VMSTATE_INT32(reboot_enabled, I6300State), |
425 | VMSTATE_INT32(clock_scale, I6300State), |
426 | VMSTATE_INT32(int_type, I6300State), |
427 | VMSTATE_INT32(free_run, I6300State), |
428 | VMSTATE_INT32(locked, I6300State), |
429 | VMSTATE_INT32(enabled, I6300State), |
430 | VMSTATE_TIMER_PTR(timer, I6300State), |
431 | VMSTATE_UINT32(timer1_preload, I6300State), |
432 | VMSTATE_UINT32(timer2_preload, I6300State), |
433 | VMSTATE_INT32(stage, I6300State), |
434 | VMSTATE_INT32(unlock_state, I6300State), |
435 | VMSTATE_INT32(previous_reboot_flag, I6300State), |
436 | VMSTATE_END_OF_LIST() |
437 | } |
438 | }; |
439 | |
440 | static void i6300esb_realize(PCIDevice *dev, Error **errp) |
441 | { |
442 | I6300State *d = WATCHDOG_I6300ESB_DEVICE(dev); |
443 | |
444 | i6300esb_debug("I6300State = %p\n" , d); |
445 | |
446 | d->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, i6300esb_timer_expired, d); |
447 | d->previous_reboot_flag = 0; |
448 | |
449 | memory_region_init_io(&d->io_mem, OBJECT(d), &i6300esb_ops, d, |
450 | "i6300esb" , 0x10); |
451 | pci_register_bar(&d->dev, 0, 0, &d->io_mem); |
452 | } |
453 | |
454 | static void i6300esb_exit(PCIDevice *dev) |
455 | { |
456 | I6300State *d = WATCHDOG_I6300ESB_DEVICE(dev); |
457 | |
458 | timer_del(d->timer); |
459 | timer_free(d->timer); |
460 | } |
461 | |
462 | static WatchdogTimerModel model = { |
463 | .wdt_name = "i6300esb" , |
464 | .wdt_description = "Intel 6300ESB" , |
465 | }; |
466 | |
467 | static void i6300esb_class_init(ObjectClass *klass, void *data) |
468 | { |
469 | DeviceClass *dc = DEVICE_CLASS(klass); |
470 | PCIDeviceClass *k = PCI_DEVICE_CLASS(klass); |
471 | |
472 | k->config_read = i6300esb_config_read; |
473 | k->config_write = i6300esb_config_write; |
474 | k->realize = i6300esb_realize; |
475 | k->exit = i6300esb_exit; |
476 | k->vendor_id = PCI_VENDOR_ID_INTEL; |
477 | k->device_id = PCI_DEVICE_ID_INTEL_ESB_9; |
478 | k->class_id = PCI_CLASS_SYSTEM_OTHER; |
479 | dc->reset = i6300esb_reset; |
480 | dc->vmsd = &vmstate_i6300esb; |
481 | set_bit(DEVICE_CATEGORY_MISC, dc->categories); |
482 | } |
483 | |
484 | static const TypeInfo i6300esb_info = { |
485 | .name = TYPE_WATCHDOG_I6300ESB_DEVICE, |
486 | .parent = TYPE_PCI_DEVICE, |
487 | .instance_size = sizeof(I6300State), |
488 | .class_init = i6300esb_class_init, |
489 | .interfaces = (InterfaceInfo[]) { |
490 | { INTERFACE_CONVENTIONAL_PCI_DEVICE }, |
491 | { }, |
492 | }, |
493 | }; |
494 | |
495 | static void i6300esb_register_types(void) |
496 | { |
497 | watchdog_add_model(&model); |
498 | type_register_static(&i6300esb_info); |
499 | } |
500 | |
501 | type_init(i6300esb_register_types) |
502 | |