1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright (c) 2014, Neel Natu (neel@freebsd.org) 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice unmodified, this list of conditions, and the following 12 * disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 /* 30 * Copyright 2018 Joyent, Inc. 31 * Copyright 2023 Oxide Computer Company 32 */ 33 34 #include <sys/cdefs.h> 35 __FBSDID("$FreeBSD$"); 36 37 #include <sys/param.h> 38 #include <sys/systm.h> 39 #include <sys/queue.h> 40 #include <sys/kernel.h> 41 #include <sys/kmem.h> 42 #include <sys/mutex.h> 43 #include <sys/clock.h> 44 #include <sys/sysctl.h> 45 46 #include <machine/vmm.h> 47 48 #include <isa/rtc.h> 49 50 #include "vatpic.h" 51 #include "vioapic.h" 52 #include "vrtc.h" 53 54 /* 55 * Virtual RTC: Fashioned after the MC146818 56 * 57 * Current limitations: 58 * - Clock divider will only run at 32768Hz (not 1.x or 4.x MHz) 59 * - Date-times prior to 1970-01-01 are not supported 60 * - If date-time held in CMOS is not valid (such as a nonsensical month/day) 61 * then updates to the time (hours/minutes/seconds) will not occur, even if 62 * they are enabled through the divider and flags. 63 */ 64 65 /* Register layout of the RTC */ 66 struct rtcdev { 67 uint8_t sec; 68 uint8_t alarm_sec; 69 uint8_t min; 70 uint8_t alarm_min; 71 uint8_t hour; 72 uint8_t alarm_hour; 73 uint8_t day_of_week; 74 uint8_t day_of_month; 75 uint8_t month; 76 uint8_t year; 77 uint8_t reg_a; 78 uint8_t reg_b; 79 uint8_t reg_c; 80 uint8_t reg_d; 81 uint8_t nvram[36]; 82 uint8_t century; 83 uint8_t nvram2[128 - 51]; 84 } __packed; 85 CTASSERT(sizeof (struct rtcdev) == 128); 86 CTASSERT(offsetof(struct rtcdev, century) == RTC_CENTURY); 87 88 struct vrtc { 89 struct vm *vm; 90 kmutex_t lock; 91 struct callout callout; 92 93 /* 94 * Address within the RTC to access when reading/writing from the data 95 * IO port. 96 */ 97 uint8_t addr; 98 99 /* 100 * Time base for RTC functionality driven from the output of the 101 * (emulated) divider. Holds the hrtime at the edge of the last update 102 * to seconds, be that an "official" update of the running RTC, the 103 * divider being enabled by the guest (and thus implying a start 500ms 104 * earlier), or the time being set by a userspace consumer. 105 */ 106 hrtime_t base_clock; 107 108 /* 109 * Time for most recent periodic-timer-driven event. Should be kept in 110 * phase with base_clock as it relates to edge boundaries of seconds. 111 */ 112 hrtime_t last_period; 113 114 /* 115 * (UNIX) Time at the last base_clock reading. 116 * 117 * If an invalid date/time is specified in the RTC fields, this will 118 * hold VRTC_BROKEN_TIME to indicate to the rest of the vRTC logic that 119 * further updates will not occur on divider ticks (until the RTC fields 120 * are updated to hold a valid date/time). 121 */ 122 time_t base_rtctime; 123 124 struct rtcdev rtcdev; 125 }; 126 127 #define VRTC_LOCK(vrtc) mutex_enter(&((vrtc)->lock)) 128 #define VRTC_UNLOCK(vrtc) mutex_exit(&((vrtc)->lock)) 129 #define VRTC_LOCKED(vrtc) MUTEX_HELD(&((vrtc)->lock)) 130 131 /* 132 * RTC time is considered "broken" if: 133 * - RTC updates are halted by the guest 134 * - RTC date/time fields have invalid values 135 */ 136 #define VRTC_BROKEN_TIME ((time_t)-1) 137 138 #define RTC_IRQ 8 139 140 #define RTCSA_DIVIDER_MASK 0x70 141 #define RTCSA_DIVIDER_32K 0x20 142 #define RTCSA_PERIOD_MASK 0x0f 143 #define RTCSB_BIN 0x04 144 #define RTCSB_INTR_MASK (RTCSB_UINTR | RTCSB_AINTR | RTCSB_PINTR) 145 #define RTCSC_MASK (RTCIR_UPDATE | RTCIR_ALARM | RTCIR_PERIOD | RTCIR_INT) 146 147 /* 148 * Setting the two high bits in the alarm fields indicates a "don't care" 149 * condition, where that alarm field is to match against any value residing in 150 * its associated time field. 151 */ 152 #define ALARM_DONT_CARE(x) (((x) & 0xc0) == 0xc0) 153 154 /* The high bit of the hour field indicates PM when in 12-hour mode */ 155 #define HOUR_IS_PM 0x80 156 157 #define SEC_PER_DAY (24 * 60 * 60) 158 159 #define ROUNDDOWN(x, y) (((x)/(y))*(y)) 160 161 static void vrtc_regc_update(struct vrtc *, uint8_t); 162 static void vrtc_callout_reschedule(struct vrtc *); 163 164 static __inline bool 165 rtc_field_datetime(uint8_t off) 166 { 167 switch (off) { 168 case RTC_SEC: 169 case RTC_MIN: 170 case RTC_HRS: 171 case RTC_WDAY: 172 case RTC_DAY: 173 case RTC_MONTH: 174 case RTC_YEAR: 175 case RTC_CENTURY: 176 return (true); 177 default: 178 return (false); 179 } 180 } 181 182 static __inline bool 183 rtc_field_ondemand(uint8_t off) 184 { 185 switch (off) { 186 case RTC_STATUSA: 187 case RTC_STATUSB: 188 case RTC_INTR: 189 case RTC_STATUSD: 190 return (true); 191 default: 192 return (rtc_field_datetime(off)); 193 } 194 } 195 196 static __inline bool 197 rtc_halted(const struct vrtc *vrtc) 198 { 199 return ((vrtc->rtcdev.reg_b & RTCSB_HALT) != 0); 200 } 201 202 static __inline bool 203 rega_divider_en(uint8_t rega) 204 { 205 /* 206 * The RTC is counting only when dividers are not held in reset. 207 */ 208 return ((rega & RTCSA_DIVIDER_MASK) == RTCSA_DIVIDER_32K); 209 } 210 211 static __inline hrtime_t 212 rega_period(uint8_t rega) 213 { 214 const uint_t sel = rega & RTCSA_PERIOD_MASK; 215 const hrtime_t rate_period[16] = { 216 0, 217 NANOSEC / 256, 218 NANOSEC / 128, 219 NANOSEC / 8192, 220 NANOSEC / 4096, 221 NANOSEC / 2048, 222 NANOSEC / 1024, 223 NANOSEC / 512, 224 NANOSEC / 256, 225 NANOSEC / 128, 226 NANOSEC / 64, 227 NANOSEC / 32, 228 NANOSEC / 16, 229 NANOSEC / 8, 230 NANOSEC / 4, 231 NANOSEC / 2, 232 }; 233 234 return (rate_period[sel]); 235 } 236 237 static __inline bool 238 vrtc_update_enabled(const struct vrtc *vrtc) 239 { 240 /* 241 * RTC date/time can be updated only if: 242 * - divider is not held in reset 243 * - guest has not disabled updates 244 * - the date/time fields have valid contents 245 */ 246 if (!rega_divider_en(vrtc->rtcdev.reg_a)) 247 return (false); 248 249 if (rtc_halted(vrtc)) 250 return (false); 251 252 if (vrtc->base_rtctime == VRTC_BROKEN_TIME) 253 return (false); 254 255 return (true); 256 } 257 258 /* 259 * Calculate the current time held by the RTC. If the RTC is running (divider 260 * enabled, and updates not halted) then this will account for any time has 261 * passed since the last update. 262 */ 263 static time_t 264 vrtc_curtime(struct vrtc *vrtc, hrtime_t *basep, hrtime_t *phasep) 265 { 266 time_t t = vrtc->base_rtctime; 267 hrtime_t base = vrtc->base_clock; 268 hrtime_t phase = 0; 269 270 ASSERT(VRTC_LOCKED(vrtc)); 271 272 if (vrtc_update_enabled(vrtc)) { 273 const hrtime_t delta = gethrtime() - vrtc->base_clock; 274 const time_t sec = delta / NANOSEC; 275 276 ASSERT3S(delta, >=, 0); 277 278 t += sec; 279 base += sec * NANOSEC; 280 phase = delta % NANOSEC; 281 } 282 if (basep != NULL) { 283 *basep = base; 284 } 285 if (phasep != NULL) { 286 *phasep = phase; 287 } 288 return (t); 289 } 290 291 /* Encode an RTC CMOS value, converting to BCD if necessary */ 292 static __inline uint8_t 293 rtc_enc(const struct rtcdev *rtc, uint8_t val) 294 { 295 const uint8_t bin2bcd_data[] = { 296 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 297 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 298 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 299 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 300 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 301 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 302 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 303 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 304 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 305 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99 306 }; 307 308 ASSERT3U(val, <, 100); 309 310 return ((rtc->reg_b & RTCSB_BIN) ? val : bin2bcd_data[val]); 311 } 312 313 /* 314 * Write the date/time fields in the CMOS with the date represented by the 315 * internal RTC time (base_rtctime). If the time is not valid, or updates of 316 * the RTC are disabled via register configuration (without force_update 317 * override), then the CMOS contents will not be changed. 318 */ 319 static void 320 vrtc_time_to_cmos(struct vrtc *vrtc, bool force_update) 321 { 322 struct rtcdev *rtc = &vrtc->rtcdev; 323 struct timespec ts = { 324 .tv_sec = vrtc->base_rtctime, 325 .tv_nsec = 0, 326 }; 327 328 ASSERT(VRTC_LOCKED(vrtc)); 329 330 if (vrtc->base_rtctime < 0) { 331 ASSERT3S(vrtc->base_rtctime, ==, VRTC_BROKEN_TIME); 332 return; 333 } 334 335 /* 336 * If the RTC is halted then the guest has "ownership" of the 337 * date/time fields. Don't update the RTC date/time fields in 338 * this case (unless forced). 339 */ 340 if (rtc_halted(vrtc) && !force_update) { 341 return; 342 } 343 344 struct clocktime ct; 345 clock_ts_to_ct(&ts, &ct); 346 347 /* 348 * Check that output from clock_ts_to_ct() matches expectations. 349 * Although it closely resembles the requirements for the RTC CMOS 350 * fields, there are a few notable parts (day-of-week) which are 351 * different, and are thus subsequently adjusted for the CMOS output. 352 */ 353 ASSERT(ct.sec >= 0 && ct.sec <= 59); 354 ASSERT(ct.min >= 0 && ct.min <= 59); 355 ASSERT(ct.hour >= 0 && ct.hour <= 23); 356 ASSERT(ct.dow >= 0 && ct.dow <= 6); 357 ASSERT(ct.day >= 1 && ct.day <= 31); 358 ASSERT(ct.mon >= 1 && ct.mon <= 12); 359 ASSERT(ct.year >= POSIX_BASE_YEAR); 360 361 rtc->sec = rtc_enc(rtc, ct.sec); 362 rtc->min = rtc_enc(rtc, ct.min); 363 364 int hour; 365 if (rtc->reg_b & RTCSB_24HR) { 366 hour = ct.hour; 367 } else { 368 /* 369 * Convert to the 12-hour format. 370 */ 371 switch (ct.hour) { 372 case 0: /* 12 AM */ 373 case 12: /* 12 PM */ 374 hour = 12; 375 break; 376 default: 377 /* 378 * The remaining 'ct.hour' values are interpreted as: 379 * [1 - 11] -> 1 - 11 AM 380 * [13 - 23] -> 1 - 11 PM 381 */ 382 hour = ct.hour % 12; 383 break; 384 } 385 } 386 387 rtc->hour = rtc_enc(rtc, hour); 388 389 if ((rtc->reg_b & RTCSB_24HR) == 0 && ct.hour >= 12) { 390 /* set MSB to indicate PM */ 391 rtc->hour |= HOUR_IS_PM; 392 } 393 394 rtc->day_of_week = rtc_enc(rtc, ct.dow + 1); 395 rtc->day_of_month = rtc_enc(rtc, ct.day); 396 rtc->month = rtc_enc(rtc, ct.mon); 397 rtc->year = rtc_enc(rtc, ct.year % 100); 398 rtc->century = rtc_enc(rtc, ct.year / 100); 399 } 400 401 /* Decode an RTC CMOS value, converting from BCD if necessary */ 402 static uint8_t 403 rtc_dec(const struct rtcdev *rtc, uint8_t val, bool *errp) 404 { 405 if ((rtc->reg_b & RTCSB_BIN) == 0) { 406 const uint8_t lower = val & 0xf; 407 const uint8_t upper = val >> 4; 408 409 *errp = (lower > 9 || upper > 9); 410 411 /* 412 * Output will be bogus if value is out of range, so it is on 413 * the caller to properly check `errp`. 414 */ 415 return ((upper * 10) + lower); 416 } else { 417 *errp = false; 418 return (val); 419 } 420 } 421 422 /* Parse hour format from CMOS, accounting for any BCD and 12/24hr encoding */ 423 static uint8_t 424 rtc_parse_hour(const struct rtcdev *rtc, uint8_t hour, bool *errp) 425 { 426 bool pm = false; 427 428 if ((rtc->reg_b & RTCSB_24HR) == 0) { 429 if ((hour & HOUR_IS_PM) != 0) { 430 hour &= ~HOUR_IS_PM; 431 pm = true; 432 } 433 } 434 hour = rtc_dec(rtc, hour, errp); 435 436 if ((rtc->reg_b & RTCSB_24HR) == 0) { 437 if (hour >= 1 && hour <= 12) { 438 /* 439 * Convert from 12-hour format to internal 24-hour 440 * representation as follows: 441 * 442 * 12-hour format ct.hour 443 * 12 AM 0 444 * 1 - 11 AM 1 - 11 445 * 12 PM 12 446 * 1 - 11 PM 13 - 23 447 */ 448 if (hour == 12) { 449 hour = 0; 450 } 451 if (pm) { 452 hour += 12; 453 } 454 } else { 455 /* invalid RTC 12-hour format */ 456 *errp = true; 457 } 458 } 459 460 if (hour > 23) { 461 *errp = true; 462 } 463 464 return (hour); 465 } 466 467 /* Check if alarm fields in CMOS are valid. */ 468 static bool 469 vrtc_alarm_valid(const struct vrtc *vrtc) 470 { 471 const struct rtcdev *rtc = &vrtc->rtcdev; 472 bool err; 473 uint8_t val; 474 475 ASSERT(VRTC_LOCKED(vrtc)); 476 477 /* 478 * For seconds, minutes, and hours fields of the alarm configuration, 479 * check that they can match against valid times, either by matching any 480 * value via the "don't care" mode, or holding a valid time component. 481 */ 482 483 val = rtc->sec; 484 if (!ALARM_DONT_CARE(val)) { 485 val = rtc_dec(rtc, val, &err); 486 if (err || val > 59) { 487 return (false); 488 } 489 } 490 491 val = rtc->min; 492 if (!ALARM_DONT_CARE(val)) { 493 val = rtc_dec(rtc, val, &err); 494 if (err || val > 59) { 495 return (false); 496 } 497 } 498 499 val = rtc->hour; 500 if (!ALARM_DONT_CARE(val)) { 501 (void) rtc_parse_hour(rtc, val, &err); 502 if (err) { 503 return (false); 504 } 505 } 506 507 /* 508 * The alarm fields hold a valid time representation, taking into 509 * consideration any potential "don't care" directives. 510 */ 511 return (true); 512 } 513 514 /* 515 * Read the date/time fields from the CMOS and attempt to convert it to a valid 516 * UNIX timestamp. VRTC_BROKEN_TIME will be emitted if those fields represent 517 * an invalid date. 518 * 519 * The day-of-week field is ignored for the purposes of validation since certain 520 * guests do not make use of it. 521 */ 522 static time_t 523 vrtc_cmos_to_secs(struct vrtc *vrtc) 524 { 525 struct rtcdev *rtc = &vrtc->rtcdev; 526 struct clocktime ct = { 0 }; 527 bool err; 528 529 ASSERT(VRTC_LOCKED(vrtc)); 530 531 ct.sec = rtc_dec(rtc, rtc->sec, &err); 532 if (err || ct.sec > 59) { 533 /* invalid RTC seconds */ 534 goto fail; 535 } 536 537 ct.min = rtc_dec(rtc, rtc->min, &err); 538 if (err || ct.min > 59) { 539 /* invalid RTC minutes */ 540 goto fail; 541 } 542 543 ct.hour = rtc_parse_hour(rtc, rtc->hour, &err); 544 if (err) { 545 /* invalid RTC hour */ 546 goto fail; 547 } 548 549 /* 550 * Ignore 'rtc->dow' because some guests like Linux don't bother 551 * setting it at all while others like OpenBSD/i386 set it incorrectly. 552 * 553 * clock_ct_to_ts() does not depend on 'ct.dow' anyways so ignore it. 554 */ 555 ct.dow = -1; 556 557 ct.day = rtc_dec(rtc, rtc->day_of_month, &err); 558 if (err || ct.day < 1 || ct.day > 31) { 559 /* invalid RTC day-of-month */ 560 goto fail; 561 } 562 563 ct.mon = rtc_dec(rtc, rtc->month, &err); 564 if (err || ct.mon < 1 || ct.mon > 12) { 565 /* invalid RTC month */ 566 goto fail; 567 } 568 569 const uint_t year = rtc_dec(rtc, rtc->year, &err); 570 if (err || year > 99) { 571 /* invalid RTC year */ 572 goto fail; 573 } 574 575 const uint_t century = rtc_dec(rtc, rtc->century, &err); 576 ct.year = century * 100 + year; 577 if (err || ct.year < POSIX_BASE_YEAR) { 578 /* invalid RTC century */ 579 goto fail; 580 } 581 582 struct timespec ts; 583 if (clock_ct_to_ts(&ct, &ts) != 0 || ts.tv_sec < 0) { 584 /* invalid RTC clocktime */ 585 goto fail; 586 } 587 return (ts.tv_sec); /* success */ 588 589 fail: 590 /* 591 * Stop updating the RTC if the date/time fields programmed by 592 * the guest are invalid. 593 */ 594 return (VRTC_BROKEN_TIME); 595 } 596 597 /* 598 * If the periodic timer is enabled, check if enough time has passed for it to 599 * generate an event. 600 */ 601 static void 602 vrtc_periodic_update(struct vrtc *vrtc) 603 { 604 struct rtcdev *rtc = &vrtc->rtcdev; 605 606 ASSERT(VRTC_LOCKED(vrtc)); 607 608 /* 609 * If the divider is disabled, or periodic interrupts are not 610 * configured, then no further work is required. 611 */ 612 const hrtime_t period = rega_period(rtc->reg_a); 613 if (!rega_divider_en(rtc->reg_a) || period == 0) { 614 return; 615 } 616 617 /* 618 * Have we crossed the edge of a period-sized time interval since the 619 * last periodic event? 620 */ 621 hrtime_t since_last = gethrtime() - vrtc->last_period; 622 if (since_last > period) { 623 vrtc_regc_update(vrtc, RTCIR_PERIOD); 624 vrtc->last_period = ROUNDDOWN(since_last, period); 625 } 626 } 627 628 /* 629 * Update the internal contents of the RTC. This processes any events which may 630 * have been generated by the passage of time (update/periodic/alarm), resulting 631 * in updates to register-C. As part of that, it updates the internal time 632 * representation of the RTC, but is not required to render those changes (if 633 * any) to the CMOS memory. A seperate call to vrtc_time_to_cmos() is needed if 634 * those fields are about to be accessed. 635 */ 636 static void 637 vrtc_update(struct vrtc *vrtc, uint8_t off) 638 { 639 struct rtcdev *rtc = &vrtc->rtcdev; 640 641 ASSERT(VRTC_LOCKED(vrtc)); 642 643 /* 644 * If CMOS offset of interest is not one which is updated on-demand, 645 * then no update processing is required. 646 */ 647 if (!rtc_field_ondemand(off)) { 648 return; 649 } 650 651 /* 652 * If the divider output is disabled, no events will be generated, and 653 * the time will not be updated. 654 */ 655 if (!rega_divider_en(rtc->reg_a)) { 656 return; 657 } 658 659 /* Check for any periodic timer events requiring injection. */ 660 vrtc_periodic_update(vrtc); 661 662 if (vrtc->base_rtctime == VRTC_BROKEN_TIME) { 663 /* 664 * If the RTC is halted, or the time stored in CMOS is invalid, 665 * then neither alarm checks nor updates to the time stored in 666 * CMOS are performed. 667 */ 668 return; 669 } 670 671 /* 672 * Calculate the new time and its corresponding second-granularity clock 673 * edge from the divider for base_clock. 674 */ 675 hrtime_t base_clock; 676 const time_t newtime = vrtc_curtime(vrtc, &base_clock, NULL); 677 if (vrtc->base_rtctime >= newtime) { 678 /* Nothing more to do if the actual time is unchanged */ 679 return; 680 } 681 vrtc->base_clock = base_clock; 682 683 if (!vrtc_alarm_valid(vrtc) || (rtc->reg_c & RTCIR_ALARM) != 0) { 684 /* 685 * If no valid alarm is configured, or the alarm event is 686 * already pending, there is no need to match the RTC time 687 * against it, since any additional assertion will be redundant 688 * until the flag is read/cleared. 689 */ 690 vrtc->base_rtctime = newtime; 691 } else if ((newtime - vrtc->base_rtctime) >= SEC_PER_DAY) { 692 /* 693 * If 24 hours (or more) has elapsed since the last update, the 694 * configured alarm is certain to fire. Rather than spending 695 * considerable effort in the full matching logic in order to 696 * determine this certainty, just apply it now as a shortcut. 697 */ 698 vrtc_regc_update(vrtc, RTCIR_ALARM); 699 vrtc->base_rtctime = newtime; 700 } else { 701 /* 702 * Check if any of the times (down to the second) between the 703 * old time and the new match against a configured alarm 704 * condition. 705 * 706 * This is not insignificant effort and could stand to be 707 * optimized at some point in the future. 708 */ 709 const uint8_t a_sec = rtc->alarm_sec; 710 const uint8_t a_min = rtc->alarm_min; 711 const uint8_t a_hour = rtc->alarm_hour; 712 do { 713 vrtc->base_rtctime++; 714 vrtc_time_to_cmos(vrtc, false); 715 716 if ((ALARM_DONT_CARE(a_sec) || a_sec == rtc->sec) && 717 (ALARM_DONT_CARE(a_min) || a_min == rtc->min) && 718 (ALARM_DONT_CARE(a_hour) || a_hour == rtc->hour)) { 719 vrtc_regc_update(vrtc, RTCIR_ALARM); 720 /* 721 * Once the alarm triggers during this check, we 722 * can skip to the end, since subsequent firings 723 * would be redundant until the guest can 724 * read/clear the event in register-C. 725 */ 726 vrtc->base_rtctime = newtime; 727 } 728 } while (vrtc->base_rtctime != newtime); 729 } 730 731 /* Reflect that the time underwent an update */ 732 vrtc_regc_update(vrtc, RTCIR_UPDATE); 733 } 734 735 static void 736 vrtc_callout_handler(void *arg) 737 { 738 struct vrtc *vrtc = arg; 739 740 VRTC_LOCK(vrtc); 741 if (callout_pending(&vrtc->callout)) { 742 /* callout was reset */ 743 } else if (!callout_active(&vrtc->callout)) { 744 /* callout was stopped */ 745 } else { 746 callout_deactivate(&vrtc->callout); 747 748 /* Perform the actual update and reschedule (if needed) */ 749 vrtc_update(vrtc, RTC_INTR); 750 vrtc_callout_reschedule(vrtc); 751 } 752 VRTC_UNLOCK(vrtc); 753 } 754 755 static void 756 vrtc_callout_reschedule(struct vrtc *vrtc) 757 { 758 struct rtcdev *rtc = &vrtc->rtcdev; 759 760 ASSERT(VRTC_LOCKED(vrtc)); 761 762 hrtime_t period = 0; 763 if ((rtc->reg_b & RTCSB_PINTR) != 0) { 764 /* 765 * Calculate the next event edge using the periodic timer, since 766 * it will be more granular (2Hz or faster) than the 1Hz used by 767 * the alarm and update interrupts, and still in phase. 768 */ 769 period = rega_period(rtc->reg_a); 770 } 771 if (period == 0 && vrtc_update_enabled(vrtc)) { 772 /* 773 * If RTC updates are enabled, there is potential for update or 774 * alarm interrupts on 1Hz intervals. 775 */ 776 period = NANOSEC; 777 } 778 779 /* 780 * RTC callouts are only required if interrupts are enabled, since all 781 * other side effects of time moving forward (such as setting of the 782 * event bits in register-C) can be conjured on-demand when those fields 783 * are read by the guest. The same is true when an interrupt has been 784 * asserted and not yet handled. 785 */ 786 const bool intr_enabled = (rtc->reg_b & RTCSB_INTR_MASK) != 0; 787 const bool intr_asserted = (rtc->reg_c & RTCIR_INT) != 0; 788 if (period != 0 && intr_enabled && !intr_asserted) { 789 /* 790 * Find the next edge of the specified period interval, 791 * referenced against the phase of base_clock. 792 */ 793 const hrtime_t delta = gethrtime() + period - vrtc->base_clock; 794 const hrtime_t next = 795 ROUNDDOWN(delta, period) + vrtc->base_clock; 796 797 callout_reset_hrtime(&vrtc->callout, next, vrtc_callout_handler, 798 vrtc, C_ABSOLUTE); 799 } else { 800 if (callout_active(&vrtc->callout)) { 801 callout_stop(&vrtc->callout); 802 } 803 } 804 } 805 806 /* 807 * We can take some shortcuts in the register-B/register-C math since the 808 * interrupt-enable bits match their corresponding interrupt-present bits. 809 */ 810 CTASSERT(RTCIR_UPDATE == RTCSB_UINTR); 811 CTASSERT(RTCIR_ALARM == RTCSB_AINTR); 812 CTASSERT(RTCIR_PERIOD == RTCSB_PINTR); 813 814 /* 815 * Update the contents of register-C either due to newly asserted events, or 816 * altered interrupt-enable flags. 817 */ 818 static void 819 vrtc_regc_update(struct vrtc *vrtc, uint8_t events) 820 { 821 struct rtcdev *rtc = &vrtc->rtcdev; 822 823 ASSERT(VRTC_LOCKED(vrtc)); 824 ASSERT0(events & ~(RTCSB_INTR_MASK)); 825 826 /* 827 * Regardless of which interrupt enable flags are set in register-B, the 828 * corresponding event flags are always set in register-C. 829 */ 830 rtc->reg_c |= events; 831 832 const bool oldirq = (rtc->reg_c & RTCIR_INT) != 0; 833 if ((rtc->reg_b & RTCSB_INTR_MASK & rtc->reg_c) != 0) { 834 rtc->reg_c |= RTCIR_INT; 835 } 836 const bool newirq = (rtc->reg_c & RTCIR_INT) != 0; 837 838 /* 839 * Although this should probably be asserting level-triggered interrupt, 840 * the original logic from bhyve is event-triggered. This may warrant 841 * additional consideration at some point. 842 */ 843 if (!oldirq && newirq) { 844 /* IRQ asserted */ 845 (void) vatpic_pulse_irq(vrtc->vm, RTC_IRQ); 846 (void) vioapic_pulse_irq(vrtc->vm, RTC_IRQ); 847 } else if (oldirq && !newirq) { 848 /* IRQ de-asserted */ 849 } 850 } 851 852 /* 853 * Emulate a read of register-C, emitting the contained value and clearing its 854 * contents for subsequent actions. 855 */ 856 static uint8_t 857 vrtc_regc_read(struct vrtc *vrtc) 858 { 859 struct rtcdev *rtc = &vrtc->rtcdev; 860 861 ASSERT(VRTC_LOCKED(vrtc)); 862 863 /* Clear the IRQ flag, and any asserted events */ 864 const uint8_t val = rtc->reg_c; 865 rtc->reg_c = 0; 866 867 return (val); 868 } 869 870 static void 871 vrtc_regb_write(struct vrtc *vrtc, uint8_t newval) 872 { 873 struct rtcdev *rtc = &vrtc->rtcdev; 874 875 ASSERT(VRTC_LOCKED(vrtc)); 876 877 uint8_t changed = rtc->reg_b ^ newval; 878 rtc->reg_b = newval; 879 880 if (changed & RTCSB_HALT) { 881 if ((newval & RTCSB_HALT) == 0) { 882 /* 883 * RTC is coming out of a halted state. 884 * 885 * Push the base time (the clock from the divider) 886 * forward to the nearest second boundary so it may 887 * resume updates from the value set in the CMOS. 888 */ 889 vrtc->base_rtctime = vrtc_cmos_to_secs(vrtc); 890 891 /* 892 * Account for any time which has passed if the divider 893 * was left running while the RTC was in the halted 894 * state. Any whole seconds which elapsed while the 895 * device was in such a state must be discarded. 896 * 897 * If this was not done, the RTC would play "catch-up" 898 * since the last update as recorded in `base_clock`. 899 * The phase of that clock is preserved, even if the 900 * time itself is discarded. 901 */ 902 if (rega_divider_en(vrtc->rtcdev.reg_a)) { 903 const hrtime_t delta = 904 gethrtime() - vrtc->base_clock; 905 906 if (delta > NANOSEC) { 907 vrtc->base_clock += delta / NANOSEC; 908 } 909 } else { 910 /* 911 * If the divider is not running, then all of 912 * this will be taken care of if/when it is 913 * re-enabled by the guest. 914 */ 915 } 916 } else { 917 /* 918 * Force a refresh of the RTC date/time fields so 919 * they reflect the time right before the guest set 920 * the HALT bit. 921 */ 922 vrtc_update(vrtc, RTC_STATUSB); 923 vrtc_time_to_cmos(vrtc, true); 924 925 /* 926 * Updates are halted so mark 'base_rtctime' to denote 927 * that the RTC date/time is in flux. 928 * 929 * Since the HALT/RUN flag does not effect the actual 930 * phase of the clock emitted from the emulated divider, 931 * the base time will remain unchanged 932 */ 933 vrtc->base_rtctime = VRTC_BROKEN_TIME; 934 935 /* 936 * Per the specification, the UINTR bit must be cleared 937 * if the HALT bit is set. 938 */ 939 if ((rtc->reg_b & RTCSB_UINTR) != 0) { 940 rtc->reg_b &= ~RTCSB_UINTR; 941 changed |= RTCSB_UINTR; 942 } 943 } 944 } 945 946 /* Side effect of changes to the interrupt enable bits. */ 947 if (changed & RTCSB_INTR_MASK) { 948 vrtc_regc_update(vrtc, 0); 949 } 950 951 vrtc_callout_reschedule(vrtc); 952 953 /* 954 * The side effect of bits that control the RTC date/time format 955 * is handled lazily when those fields are actually read. 956 */ 957 } 958 959 static void 960 vrtc_rega_write(struct vrtc *vrtc, uint8_t newval) 961 { 962 ASSERT(VRTC_LOCKED(vrtc)); 963 964 const uint8_t oldval = vrtc->rtcdev.reg_a; 965 if (rega_divider_en(oldval) && !rega_divider_en(newval)) { 966 /* RTC divider held in reset */ 967 } else if (!rega_divider_en(oldval) && rega_divider_en(newval)) { 968 /* 969 * Divider is coming out of reset. Updates of the reported time 970 * (if enabled) are expected to begin 500ms from now. 971 */ 972 vrtc->base_rtctime = vrtc_cmos_to_secs(vrtc); 973 vrtc->base_clock = gethrtime() - (NANOSEC / 2); 974 vrtc->last_period = vrtc->base_clock; 975 } 976 977 /* 978 * We never present the time-update bit as a device, nor is the consumer 979 * allowed to set it during a write. 980 */ 981 vrtc->rtcdev.reg_a = newval & ~RTCSA_TUP; 982 983 vrtc_callout_reschedule(vrtc); 984 } 985 986 int 987 vrtc_set_time(struct vm *vm, const timespec_t *ts) 988 { 989 struct vrtc *vrtc = vm_rtc(vm); 990 991 if (ts->tv_sec < 0 || ts->tv_nsec >= NANOSEC) { 992 /* 993 * Times before the 1970 epoch, or with nonsensical nanosecond 994 * counts are not supported 995 */ 996 return (EINVAL); 997 } 998 999 VRTC_LOCK(vrtc); 1000 vrtc->base_rtctime = ts->tv_sec; 1001 vrtc->base_clock = gethrtime() - ts->tv_nsec; 1002 vrtc->last_period = vrtc->base_clock; 1003 if (!vm_is_paused(vrtc->vm)) { 1004 vrtc_callout_reschedule(vrtc); 1005 } 1006 VRTC_UNLOCK(vrtc); 1007 1008 return (0); 1009 } 1010 1011 void 1012 vrtc_get_time(struct vm *vm, timespec_t *ts) 1013 { 1014 struct vrtc *vrtc = vm_rtc(vm); 1015 hrtime_t phase; 1016 1017 VRTC_LOCK(vrtc); 1018 ts->tv_sec = vrtc_curtime(vrtc, NULL, &phase); 1019 ts->tv_nsec = phase; 1020 VRTC_UNLOCK(vrtc); 1021 } 1022 1023 int 1024 vrtc_nvram_write(struct vm *vm, int offset, uint8_t value) 1025 { 1026 struct vrtc *vrtc = vm_rtc(vm); 1027 uint8_t *rtc_raw = (uint8_t *)&vrtc->rtcdev; 1028 1029 /* Write offset must be valid */ 1030 if (offset < 0 || offset >= sizeof (struct rtcdev)) { 1031 return (EINVAL); 1032 } 1033 1034 /* Disallow writes to RTC control registers or the date/time fields */ 1035 if (rtc_field_ondemand(offset)) { 1036 return (EINVAL); 1037 } 1038 1039 VRTC_LOCK(vrtc); 1040 rtc_raw[offset] = value; 1041 VRTC_UNLOCK(vrtc); 1042 1043 return (0); 1044 } 1045 1046 int 1047 vrtc_nvram_read(struct vm *vm, int offset, uint8_t *retval) 1048 { 1049 struct vrtc *vrtc = vm_rtc(vm); 1050 const uint8_t *rtc_raw = (uint8_t *)&vrtc->rtcdev; 1051 1052 /* Read offset must be valid */ 1053 if (offset < 0 || offset >= sizeof (struct rtcdev)) { 1054 return (EINVAL); 1055 } 1056 1057 VRTC_LOCK(vrtc); 1058 1059 vrtc_update(vrtc, offset); 1060 /* Render out the updated date/time if it is being accessed */ 1061 if (rtc_field_datetime(offset)) { 1062 vrtc_time_to_cmos(vrtc, false); 1063 } 1064 *retval = rtc_raw[offset]; 1065 1066 VRTC_UNLOCK(vrtc); 1067 1068 return (0); 1069 } 1070 1071 int 1072 vrtc_addr_handler(void *arg, bool in, uint16_t port, uint8_t bytes, 1073 uint32_t *val) 1074 { 1075 struct vrtc *vrtc = arg; 1076 1077 if (bytes != 1) { 1078 return (-1); 1079 } 1080 1081 if (in) { 1082 *val = 0xff; 1083 return (0); 1084 } 1085 1086 VRTC_LOCK(vrtc); 1087 vrtc->addr = *val & 0x7f; 1088 VRTC_UNLOCK(vrtc); 1089 1090 return (0); 1091 } 1092 1093 static uint8_t 1094 vrtc_read(struct vrtc *vrtc, uint8_t offset) 1095 { 1096 const uint8_t *rtc_raw = (uint8_t *)&vrtc->rtcdev; 1097 1098 ASSERT(VRTC_LOCKED(vrtc)); 1099 ASSERT(offset < sizeof (struct rtcdev)); 1100 1101 switch (offset) { 1102 case RTC_INTR: 1103 return (vrtc_regc_read(vrtc)); 1104 default: 1105 /* 1106 * Everything else can be read from the updated-on-demand data 1107 * stored in the emulated CMOS space. 1108 */ 1109 return (rtc_raw[offset]); 1110 } 1111 } 1112 1113 static void 1114 vrtc_write(struct vrtc *vrtc, uint8_t offset, uint8_t val) 1115 { 1116 uint8_t *rtc_raw = (uint8_t *)&vrtc->rtcdev; 1117 1118 ASSERT(VRTC_LOCKED(vrtc)); 1119 ASSERT(offset < sizeof (struct rtcdev)); 1120 1121 switch (offset) { 1122 case RTC_STATUSA: 1123 vrtc_rega_write(vrtc, val); 1124 break; 1125 case RTC_STATUSB: 1126 vrtc_regb_write(vrtc, val); 1127 break; 1128 case RTC_INTR: 1129 /* Ignored write to register-C */ 1130 break; 1131 case RTC_STATUSD: 1132 /* Ignored write to register-D */ 1133 break; 1134 case RTC_SEC: 1135 /* High order bit of 'seconds' is read-only. */ 1136 rtc_raw[offset] = val & 0x7f; 1137 break; 1138 default: 1139 rtc_raw[offset] = val; 1140 break; 1141 } 1142 1143 /* 1144 * Some guests may write to date/time fields (such as OpenBSD writing 1145 * the century byte) without first pausing updates with RTCSB_HALT. 1146 * 1147 * Keep our internal representation of the time updated should such 1148 * writes occur. 1149 */ 1150 if (rtc_field_datetime(offset) && !rtc_halted(vrtc)) { 1151 vrtc->base_rtctime = vrtc_cmos_to_secs(vrtc); 1152 } 1153 1154 } 1155 1156 int 1157 vrtc_data_handler(void *arg, bool in, uint16_t port, uint8_t bytes, 1158 uint32_t *val) 1159 { 1160 struct vrtc *vrtc = arg; 1161 1162 if (bytes != 1) { 1163 return (-1); 1164 } 1165 1166 VRTC_LOCK(vrtc); 1167 const uint8_t offset = vrtc->addr; 1168 if (offset >= sizeof (struct rtcdev)) { 1169 VRTC_UNLOCK(vrtc); 1170 return (-1); 1171 } 1172 1173 /* Ensure internal state of RTC is updated */ 1174 vrtc_update(vrtc, offset); 1175 1176 /* 1177 * Update RTC date/time CMOS fields, if necessary. 1178 * 1179 * While the necessity for reads is obvious, the need for it during 1180 * writes is slightly more subtle: A write to one of the date/time 1181 * fields will requiring (re)parsing them all in order to determine the 1182 * new working date/time for the RTC. 1183 */ 1184 if (rtc_field_datetime(offset)) { 1185 vrtc_time_to_cmos(vrtc, false); 1186 } 1187 1188 if (in) { 1189 *val = vrtc_read(vrtc, offset); 1190 } else { 1191 vrtc_write(vrtc, offset, *val); 1192 } 1193 VRTC_UNLOCK(vrtc); 1194 return (0); 1195 } 1196 1197 void 1198 vrtc_reset(struct vrtc *vrtc) 1199 { 1200 struct rtcdev *rtc = &vrtc->rtcdev; 1201 1202 VRTC_LOCK(vrtc); 1203 1204 vrtc_regb_write(vrtc, rtc->reg_b & ~(RTCSB_INTR_MASK | RTCSB_SQWE)); 1205 rtc->reg_c = 0; 1206 ASSERT(!callout_active(&vrtc->callout)); 1207 1208 VRTC_UNLOCK(vrtc); 1209 } 1210 1211 struct vrtc * 1212 vrtc_init(struct vm *vm) 1213 { 1214 struct vrtc *vrtc; 1215 struct rtcdev *rtc; 1216 1217 vrtc = kmem_zalloc(sizeof (struct vrtc), KM_SLEEP); 1218 vrtc->vm = vm; 1219 mutex_init(&vrtc->lock, NULL, MUTEX_ADAPTIVE, NULL); 1220 callout_init(&vrtc->callout, 1); 1221 1222 /* Allow dividers to keep time but disable everything else */ 1223 rtc = &vrtc->rtcdev; 1224 rtc->reg_a = RTCSA_DIVIDER_32K; 1225 rtc->reg_b = RTCSB_24HR; 1226 rtc->reg_c = 0; 1227 rtc->reg_d = RTCSD_PWR; 1228 1229 /* Reset the index register to a safe value. */ 1230 vrtc->addr = RTC_STATUSD; 1231 1232 VRTC_LOCK(vrtc); 1233 /* Initialize RTC time to 00:00:00 1 January, 1970. */ 1234 vrtc->base_rtctime = 0; 1235 vrtc->base_clock = gethrtime(); 1236 vrtc->last_period = vrtc->base_clock; 1237 vrtc_time_to_cmos(vrtc, false); 1238 VRTC_UNLOCK(vrtc); 1239 1240 return (vrtc); 1241 } 1242 1243 void 1244 vrtc_cleanup(struct vrtc *vrtc) 1245 { 1246 callout_drain(&vrtc->callout); 1247 mutex_destroy(&vrtc->lock); 1248 kmem_free(vrtc, sizeof (*vrtc)); 1249 } 1250 1251 void 1252 vrtc_localize_resources(struct vrtc *vrtc) 1253 { 1254 vmm_glue_callout_localize(&vrtc->callout); 1255 } 1256 1257 void 1258 vrtc_pause(struct vrtc *vrtc) 1259 { 1260 VRTC_LOCK(vrtc); 1261 callout_stop(&vrtc->callout); 1262 VRTC_UNLOCK(vrtc); 1263 } 1264 1265 void 1266 vrtc_resume(struct vrtc *vrtc) 1267 { 1268 VRTC_LOCK(vrtc); 1269 ASSERT(!callout_active(&vrtc->callout)); 1270 vrtc_callout_reschedule(vrtc); 1271 VRTC_UNLOCK(vrtc); 1272 } 1273 1274 static int 1275 vrtc_data_read(void *datap, const vmm_data_req_t *req) 1276 { 1277 VERIFY3U(req->vdr_class, ==, VDC_RTC); 1278 VERIFY3U(req->vdr_version, ==, 2); 1279 VERIFY3U(req->vdr_len, >=, sizeof (struct vdi_rtc_v2)); 1280 1281 struct vrtc *vrtc = datap; 1282 struct vdi_rtc_v2 *out = req->vdr_data; 1283 1284 VRTC_LOCK(vrtc); 1285 1286 out->vr_addr = vrtc->addr; 1287 out->vr_base_clock = vm_normalize_hrtime(vrtc->vm, vrtc->base_clock); 1288 out->vr_last_period = vm_normalize_hrtime(vrtc->vm, vrtc->last_period); 1289 bcopy(&vrtc->rtcdev, out->vr_content, sizeof (out->vr_content)); 1290 1291 VRTC_UNLOCK(vrtc); 1292 1293 return (0); 1294 } 1295 1296 static int 1297 vrtc_data_write(void *datap, const vmm_data_req_t *req) 1298 { 1299 VERIFY3U(req->vdr_class, ==, VDC_RTC); 1300 VERIFY3U(req->vdr_version, ==, 2); 1301 VERIFY3U(req->vdr_len, >=, sizeof (struct vdi_rtc_v2)); 1302 1303 struct vrtc *vrtc = datap; 1304 const struct vdi_rtc_v2 *src = req->vdr_data; 1305 1306 const hrtime_t base_clock = 1307 vm_denormalize_hrtime(vrtc->vm, src->vr_base_clock); 1308 const hrtime_t last_period = 1309 vm_denormalize_hrtime(vrtc->vm, src->vr_last_period); 1310 1311 const hrtime_t now = gethrtime(); 1312 if (base_clock > now || last_period > now) { 1313 /* 1314 * Neither the base clock nor the last periodic event edge 1315 * should be in the future, since they should trail (or at most 1316 * equal) the current time. 1317 */ 1318 return (EINVAL); 1319 } 1320 1321 /* 1322 * The phase of last_period could be checked against that of base_clock, 1323 * but for now, any shenanigans there will go unhandled. 1324 */ 1325 1326 VRTC_LOCK(vrtc); 1327 1328 vrtc->base_clock = base_clock; 1329 bcopy(src->vr_content, &vrtc->rtcdev, sizeof (vrtc->rtcdev)); 1330 vrtc->addr = src->vr_addr; 1331 1332 vrtc->rtcdev.reg_a &= ~RTCSA_TUP; 1333 /* register B needs requires no masking */ 1334 vrtc->rtcdev.reg_c &= RTCSC_MASK; 1335 vrtc->rtcdev.reg_d = RTCSD_PWR; 1336 1337 /* Set internal time based on what is stored in CMOS */ 1338 vrtc->base_rtctime = vrtc_cmos_to_secs(vrtc); 1339 /* Using the specified divider edge timing */ 1340 vrtc->base_clock = base_clock; 1341 vrtc->last_period = last_period; 1342 1343 if (!vm_is_paused(vrtc->vm)) { 1344 vrtc_callout_reschedule(vrtc); 1345 } 1346 1347 VRTC_UNLOCK(vrtc); 1348 return (0); 1349 } 1350 1351 static const vmm_data_version_entry_t rtc_v2 = { 1352 .vdve_class = VDC_RTC, 1353 .vdve_version = 2, 1354 .vdve_len_expect = sizeof (struct vdi_rtc_v2), 1355 .vdve_readf = vrtc_data_read, 1356 .vdve_writef = vrtc_data_write, 1357 }; 1358 VMM_DATA_VERSION(rtc_v2); 1359