 ee71c98434
			
		
	
	
		ee71c98434
		
	
	
	
	
		
			
			There are only three counter/timers on the integrator board: correct the bounds check to avoid an array overrun. (Spotted by Coverity, see bug 887883). Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
		
			
				
	
	
		
			327 lines
		
	
	
		
			8.8 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			327 lines
		
	
	
		
			8.8 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
| /*
 | |
|  * ARM PrimeCell Timer modules.
 | |
|  *
 | |
|  * Copyright (c) 2005-2006 CodeSourcery.
 | |
|  * Written by Paul Brook
 | |
|  *
 | |
|  * This code is licensed under the GPL.
 | |
|  */
 | |
| 
 | |
| #include "sysbus.h"
 | |
| #include "qemu-timer.h"
 | |
| 
 | |
| /* Common timer implementation.  */
 | |
| 
 | |
| #define TIMER_CTRL_ONESHOT      (1 << 0)
 | |
| #define TIMER_CTRL_32BIT        (1 << 1)
 | |
| #define TIMER_CTRL_DIV1         (0 << 2)
 | |
| #define TIMER_CTRL_DIV16        (1 << 2)
 | |
| #define TIMER_CTRL_DIV256       (2 << 2)
 | |
| #define TIMER_CTRL_IE           (1 << 5)
 | |
| #define TIMER_CTRL_PERIODIC     (1 << 6)
 | |
| #define TIMER_CTRL_ENABLE       (1 << 7)
 | |
| 
 | |
| typedef struct {
 | |
|     ptimer_state *timer;
 | |
|     uint32_t control;
 | |
|     uint32_t limit;
 | |
|     int freq;
 | |
|     int int_level;
 | |
|     qemu_irq irq;
 | |
| } arm_timer_state;
 | |
| 
 | |
| /* Check all active timers, and schedule the next timer interrupt.  */
 | |
| 
 | |
| static void arm_timer_update(arm_timer_state *s)
 | |
| {
 | |
|     /* Update interrupts.  */
 | |
|     if (s->int_level && (s->control & TIMER_CTRL_IE)) {
 | |
|         qemu_irq_raise(s->irq);
 | |
|     } else {
 | |
|         qemu_irq_lower(s->irq);
 | |
|     }
 | |
| }
 | |
| 
 | |
| static uint32_t arm_timer_read(void *opaque, target_phys_addr_t offset)
 | |
| {
 | |
|     arm_timer_state *s = (arm_timer_state *)opaque;
 | |
| 
 | |
|     switch (offset >> 2) {
 | |
|     case 0: /* TimerLoad */
 | |
|     case 6: /* TimerBGLoad */
 | |
|         return s->limit;
 | |
|     case 1: /* TimerValue */
 | |
|         return ptimer_get_count(s->timer);
 | |
|     case 2: /* TimerControl */
 | |
|         return s->control;
 | |
|     case 4: /* TimerRIS */
 | |
|         return s->int_level;
 | |
|     case 5: /* TimerMIS */
 | |
|         if ((s->control & TIMER_CTRL_IE) == 0)
 | |
|             return 0;
 | |
|         return s->int_level;
 | |
|     default:
 | |
|         hw_error("arm_timer_read: Bad offset %x\n", (int)offset);
 | |
|         return 0;
 | |
|     }
 | |
| }
 | |
| 
 | |
| /* Reset the timer limit after settings have changed.  */
 | |
| static void arm_timer_recalibrate(arm_timer_state *s, int reload)
 | |
| {
 | |
|     uint32_t limit;
 | |
| 
 | |
|     if ((s->control & (TIMER_CTRL_PERIODIC | TIMER_CTRL_ONESHOT)) == 0) {
 | |
|         /* Free running.  */
 | |
|         if (s->control & TIMER_CTRL_32BIT)
 | |
|             limit = 0xffffffff;
 | |
|         else
 | |
|             limit = 0xffff;
 | |
|     } else {
 | |
|           /* Periodic.  */
 | |
|           limit = s->limit;
 | |
|     }
 | |
|     ptimer_set_limit(s->timer, limit, reload);
 | |
| }
 | |
| 
 | |
| static void arm_timer_write(void *opaque, target_phys_addr_t offset,
 | |
|                             uint32_t value)
 | |
| {
 | |
|     arm_timer_state *s = (arm_timer_state *)opaque;
 | |
|     int freq;
 | |
| 
 | |
|     switch (offset >> 2) {
 | |
|     case 0: /* TimerLoad */
 | |
|         s->limit = value;
 | |
|         arm_timer_recalibrate(s, 1);
 | |
|         break;
 | |
|     case 1: /* TimerValue */
 | |
|         /* ??? Linux seems to want to write to this readonly register.
 | |
|            Ignore it.  */
 | |
|         break;
 | |
|     case 2: /* TimerControl */
 | |
|         if (s->control & TIMER_CTRL_ENABLE) {
 | |
|             /* Pause the timer if it is running.  This may cause some
 | |
|                inaccuracy dure to rounding, but avoids a whole lot of other
 | |
|                messyness.  */
 | |
|             ptimer_stop(s->timer);
 | |
|         }
 | |
|         s->control = value;
 | |
|         freq = s->freq;
 | |
|         /* ??? Need to recalculate expiry time after changing divisor.  */
 | |
|         switch ((value >> 2) & 3) {
 | |
|         case 1: freq >>= 4; break;
 | |
|         case 2: freq >>= 8; break;
 | |
|         }
 | |
|         arm_timer_recalibrate(s, s->control & TIMER_CTRL_ENABLE);
 | |
|         ptimer_set_freq(s->timer, freq);
 | |
|         if (s->control & TIMER_CTRL_ENABLE) {
 | |
|             /* Restart the timer if still enabled.  */
 | |
|             ptimer_run(s->timer, (s->control & TIMER_CTRL_ONESHOT) != 0);
 | |
|         }
 | |
|         break;
 | |
|     case 3: /* TimerIntClr */
 | |
|         s->int_level = 0;
 | |
|         break;
 | |
|     case 6: /* TimerBGLoad */
 | |
|         s->limit = value;
 | |
|         arm_timer_recalibrate(s, 0);
 | |
|         break;
 | |
|     default:
 | |
|         hw_error("arm_timer_write: Bad offset %x\n", (int)offset);
 | |
|     }
 | |
|     arm_timer_update(s);
 | |
| }
 | |
| 
 | |
| static void arm_timer_tick(void *opaque)
 | |
| {
 | |
|     arm_timer_state *s = (arm_timer_state *)opaque;
 | |
|     s->int_level = 1;
 | |
|     arm_timer_update(s);
 | |
| }
 | |
| 
 | |
| static const VMStateDescription vmstate_arm_timer = {
 | |
|     .name = "arm_timer",
 | |
|     .version_id = 1,
 | |
|     .minimum_version_id = 1,
 | |
|     .minimum_version_id_old = 1,
 | |
|     .fields      = (VMStateField[]) {
 | |
|         VMSTATE_UINT32(control, arm_timer_state),
 | |
|         VMSTATE_UINT32(limit, arm_timer_state),
 | |
|         VMSTATE_INT32(int_level, arm_timer_state),
 | |
|         VMSTATE_PTIMER(timer, arm_timer_state),
 | |
|         VMSTATE_END_OF_LIST()
 | |
|     }
 | |
| };
 | |
| 
 | |
| static arm_timer_state *arm_timer_init(uint32_t freq)
 | |
| {
 | |
|     arm_timer_state *s;
 | |
|     QEMUBH *bh;
 | |
| 
 | |
|     s = (arm_timer_state *)g_malloc0(sizeof(arm_timer_state));
 | |
|     s->freq = freq;
 | |
|     s->control = TIMER_CTRL_IE;
 | |
| 
 | |
|     bh = qemu_bh_new(arm_timer_tick, s);
 | |
|     s->timer = ptimer_init(bh);
 | |
|     vmstate_register(NULL, -1, &vmstate_arm_timer, s);
 | |
|     return s;
 | |
| }
 | |
| 
 | |
| /* ARM PrimeCell SP804 dual timer module.
 | |
|    Docs for this device don't seem to be publicly available.  This
 | |
|    implementation is based on guesswork, the linux kernel sources and the
 | |
|    Integrator/CP timer modules.  */
 | |
| 
 | |
| typedef struct {
 | |
|     SysBusDevice busdev;
 | |
|     MemoryRegion iomem;
 | |
|     arm_timer_state *timer[2];
 | |
|     int level[2];
 | |
|     qemu_irq irq;
 | |
| } sp804_state;
 | |
| 
 | |
| /* Merge the IRQs from the two component devices.  */
 | |
| static void sp804_set_irq(void *opaque, int irq, int level)
 | |
| {
 | |
|     sp804_state *s = (sp804_state *)opaque;
 | |
| 
 | |
|     s->level[irq] = level;
 | |
|     qemu_set_irq(s->irq, s->level[0] || s->level[1]);
 | |
| }
 | |
| 
 | |
| static uint64_t sp804_read(void *opaque, target_phys_addr_t offset,
 | |
|                            unsigned size)
 | |
| {
 | |
|     sp804_state *s = (sp804_state *)opaque;
 | |
| 
 | |
|     /* ??? Don't know the PrimeCell ID for this device.  */
 | |
|     if (offset < 0x20) {
 | |
|         return arm_timer_read(s->timer[0], offset);
 | |
|     } else {
 | |
|         return arm_timer_read(s->timer[1], offset - 0x20);
 | |
|     }
 | |
| }
 | |
| 
 | |
| static void sp804_write(void *opaque, target_phys_addr_t offset,
 | |
|                         uint64_t value, unsigned size)
 | |
| {
 | |
|     sp804_state *s = (sp804_state *)opaque;
 | |
| 
 | |
|     if (offset < 0x20) {
 | |
|         arm_timer_write(s->timer[0], offset, value);
 | |
|     } else {
 | |
|         arm_timer_write(s->timer[1], offset - 0x20, value);
 | |
|     }
 | |
| }
 | |
| 
 | |
| static const MemoryRegionOps sp804_ops = {
 | |
|     .read = sp804_read,
 | |
|     .write = sp804_write,
 | |
|     .endianness = DEVICE_NATIVE_ENDIAN,
 | |
| };
 | |
| 
 | |
| static const VMStateDescription vmstate_sp804 = {
 | |
|     .name = "sp804",
 | |
|     .version_id = 1,
 | |
|     .minimum_version_id = 1,
 | |
|     .minimum_version_id_old = 1,
 | |
|     .fields      = (VMStateField[]) {
 | |
|         VMSTATE_INT32_ARRAY(level, sp804_state, 2),
 | |
|         VMSTATE_END_OF_LIST()
 | |
|     }
 | |
| };
 | |
| 
 | |
| static int sp804_init(SysBusDevice *dev)
 | |
| {
 | |
|     sp804_state *s = FROM_SYSBUS(sp804_state, dev);
 | |
|     qemu_irq *qi;
 | |
| 
 | |
|     qi = qemu_allocate_irqs(sp804_set_irq, s, 2);
 | |
|     sysbus_init_irq(dev, &s->irq);
 | |
|     /* ??? The timers are actually configurable between 32kHz and 1MHz, but
 | |
|        we don't implement that.  */
 | |
|     s->timer[0] = arm_timer_init(1000000);
 | |
|     s->timer[1] = arm_timer_init(1000000);
 | |
|     s->timer[0]->irq = qi[0];
 | |
|     s->timer[1]->irq = qi[1];
 | |
|     memory_region_init_io(&s->iomem, &sp804_ops, s, "sp804", 0x1000);
 | |
|     sysbus_init_mmio_region(dev, &s->iomem);
 | |
|     vmstate_register(&dev->qdev, -1, &vmstate_sp804, s);
 | |
|     return 0;
 | |
| }
 | |
| 
 | |
| 
 | |
| /* Integrator/CP timer module.  */
 | |
| 
 | |
| typedef struct {
 | |
|     SysBusDevice busdev;
 | |
|     MemoryRegion iomem;
 | |
|     arm_timer_state *timer[3];
 | |
| } icp_pit_state;
 | |
| 
 | |
| static uint64_t icp_pit_read(void *opaque, target_phys_addr_t offset,
 | |
|                              unsigned size)
 | |
| {
 | |
|     icp_pit_state *s = (icp_pit_state *)opaque;
 | |
|     int n;
 | |
| 
 | |
|     /* ??? Don't know the PrimeCell ID for this device.  */
 | |
|     n = offset >> 8;
 | |
|     if (n > 2) {
 | |
|         hw_error("sp804_read: Bad timer %d\n", n);
 | |
|     }
 | |
| 
 | |
|     return arm_timer_read(s->timer[n], offset & 0xff);
 | |
| }
 | |
| 
 | |
| static void icp_pit_write(void *opaque, target_phys_addr_t offset,
 | |
|                           uint64_t value, unsigned size)
 | |
| {
 | |
|     icp_pit_state *s = (icp_pit_state *)opaque;
 | |
|     int n;
 | |
| 
 | |
|     n = offset >> 8;
 | |
|     if (n > 2) {
 | |
|         hw_error("sp804_write: Bad timer %d\n", n);
 | |
|     }
 | |
| 
 | |
|     arm_timer_write(s->timer[n], offset & 0xff, value);
 | |
| }
 | |
| 
 | |
| static const MemoryRegionOps icp_pit_ops = {
 | |
|     .read = icp_pit_read,
 | |
|     .write = icp_pit_write,
 | |
|     .endianness = DEVICE_NATIVE_ENDIAN,
 | |
| };
 | |
| 
 | |
| static int icp_pit_init(SysBusDevice *dev)
 | |
| {
 | |
|     icp_pit_state *s = FROM_SYSBUS(icp_pit_state, dev);
 | |
| 
 | |
|     /* Timer 0 runs at the system clock speed (40MHz).  */
 | |
|     s->timer[0] = arm_timer_init(40000000);
 | |
|     /* The other two timers run at 1MHz.  */
 | |
|     s->timer[1] = arm_timer_init(1000000);
 | |
|     s->timer[2] = arm_timer_init(1000000);
 | |
| 
 | |
|     sysbus_init_irq(dev, &s->timer[0]->irq);
 | |
|     sysbus_init_irq(dev, &s->timer[1]->irq);
 | |
|     sysbus_init_irq(dev, &s->timer[2]->irq);
 | |
| 
 | |
|     memory_region_init_io(&s->iomem, &icp_pit_ops, s, "icp_pit", 0x1000);
 | |
|     sysbus_init_mmio_region(dev, &s->iomem);
 | |
|     /* This device has no state to save/restore.  The component timers will
 | |
|        save themselves.  */
 | |
|     return 0;
 | |
| }
 | |
| 
 | |
| static void arm_timer_register_devices(void)
 | |
| {
 | |
|     sysbus_register_dev("integrator_pit", sizeof(icp_pit_state), icp_pit_init);
 | |
|     sysbus_register_dev("sp804", sizeof(sp804_state), sp804_init);
 | |
| }
 | |
| 
 | |
| device_init(arm_timer_register_devices)
 |