1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright (c) 2014, Neel Natu (neel@freebsd.org) 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice unmodified, this list of conditions, and the following 12 * disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 /* 30 * Copyright 2018 Joyent, Inc. 31 * Copyright 2023 Oxide Computer Company 32 */ 33 34 #include <sys/cdefs.h> 35 __FBSDID("$FreeBSD$"); 36 37 #include <sys/param.h> 38 #include <sys/systm.h> 39 #include <sys/queue.h> 40 #include <sys/kernel.h> 41 #include <sys/kmem.h> 42 #include <sys/mutex.h> 43 #include <sys/clock.h> 44 #include <sys/sysctl.h> 45 46 #include <machine/vmm.h> 47 48 #include <isa/rtc.h> 49 50 #include "vatpic.h" 51 #include "vioapic.h" 52 #include "vrtc.h" 53 54 /* 55 * Virtual RTC: Fashioned after the MC146818 56 * 57 * Current limitations: 58 * - Clock divider will only run at 32768Hz (not 1.x or 4.x MHz) 59 * - Date-times prior to 1970-01-01 are not supported 60 * - If date-time held in CMOS is not valid (such as a nonsensical month/day) 61 * then updates to the time (hours/minutes/seconds) will not occur, even if 62 * they are enabled through the divider and flags. 63 */ 64 65 /* Register layout of the RTC */ 66 struct rtcdev { 67 uint8_t sec; 68 uint8_t alarm_sec; 69 uint8_t min; 70 uint8_t alarm_min; 71 uint8_t hour; 72 uint8_t alarm_hour; 73 uint8_t day_of_week; 74 uint8_t day_of_month; 75 uint8_t month; 76 uint8_t year; 77 uint8_t reg_a; 78 uint8_t reg_b; 79 uint8_t reg_c; 80 uint8_t reg_d; 81 uint8_t nvram[36]; 82 uint8_t century; 83 uint8_t nvram2[128 - 51]; 84 } __packed; 85 CTASSERT(sizeof (struct rtcdev) == 128); 86 CTASSERT(offsetof(struct rtcdev, century) == RTC_CENTURY); 87 88 struct vrtc { 89 struct vm *vm; 90 kmutex_t lock; 91 struct callout callout; 92 93 /* 94 * Address within the RTC to access when reading/writing from the data 95 * IO port. 96 */ 97 uint8_t addr; 98 99 /* 100 * Time base for RTC functionality driven from the output of the 101 * (emulated) divider. Holds the hrtime at the edge of the last update 102 * to seconds, be that an "official" update of the running RTC, the 103 * divider being enabled by the guest (and thus implying a start 500ms 104 * earlier), or the time being set by a userspace consumer. 105 */ 106 hrtime_t base_clock; 107 108 /* 109 * Time for most recent periodic-timer-driven event. Should be kept in 110 * phase with base_clock as it relates to edge boundaries of seconds. 111 */ 112 hrtime_t last_period; 113 114 /* 115 * (UNIX) Time at the last base_clock reading. 116 * 117 * If an invalid date/time is specified in the RTC fields, this will 118 * hold VRTC_BROKEN_TIME to indicate to the rest of the vRTC logic that 119 * further updates will not occur on divider ticks (until the RTC fields 120 * are updated to hold a valid date/time). 121 */ 122 time_t base_rtctime; 123 124 struct rtcdev rtcdev; 125 }; 126 127 #define VRTC_LOCK(vrtc) mutex_enter(&((vrtc)->lock)) 128 #define VRTC_UNLOCK(vrtc) mutex_exit(&((vrtc)->lock)) 129 #define VRTC_LOCKED(vrtc) MUTEX_HELD(&((vrtc)->lock)) 130 131 /* 132 * RTC time is considered "broken" if: 133 * - RTC updates are halted by the guest 134 * - RTC date/time fields have invalid values 135 */ 136 #define VRTC_BROKEN_TIME ((time_t)-1) 137 138 #define RTC_IRQ 8 139 140 #define RTCSA_DIVIDER_MASK 0x70 141 #define RTCSA_DIVIDER_32K 0x20 142 #define RTCSA_PERIOD_MASK 0x0f 143 #define RTCSB_BIN 0x04 144 #define RTCSB_INTR_MASK (RTCSB_UINTR | RTCSB_AINTR | RTCSB_PINTR) 145 #define RTCSC_MASK (RTCIR_UPDATE | RTCIR_ALARM | RTCIR_PERIOD | RTCIR_INT) 146 147 /* 148 * Setting the two high bits in the alarm fields indicates a "don't care" 149 * condition, where that alarm field is to match against any value residing in 150 * its associated time field. 151 */ 152 #define ALARM_DONT_CARE(x) (((x) & 0xc0) == 0xc0) 153 154 /* The high bit of the hour field indicates PM when in 12-hour mode */ 155 #define HOUR_IS_PM 0x80 156 157 #define SEC_PER_DAY (24 * 60 * 60) 158 159 #define ROUNDDOWN(x, y) (((x)/(y))*(y)) 160 161 static void vrtc_regc_update(struct vrtc *, uint8_t); 162 static void vrtc_callout_reschedule(struct vrtc *); 163 164 static __inline bool 165 rtc_field_datetime(uint8_t off) 166 { 167 switch (off) { 168 case RTC_SEC: 169 case RTC_MIN: 170 case RTC_HRS: 171 case RTC_WDAY: 172 case RTC_DAY: 173 case RTC_MONTH: 174 case RTC_YEAR: 175 case RTC_CENTURY: 176 return (true); 177 default: 178 return (false); 179 } 180 } 181 182 static __inline bool 183 rtc_field_ondemand(uint8_t off) 184 { 185 switch (off) { 186 case RTC_STATUSA: 187 case RTC_STATUSB: 188 case RTC_INTR: 189 case RTC_STATUSD: 190 return (true); 191 default: 192 return (rtc_field_datetime(off)); 193 } 194 } 195 196 static __inline bool 197 rtc_halted(const struct vrtc *vrtc) 198 { 199 return ((vrtc->rtcdev.reg_b & RTCSB_HALT) != 0); 200 } 201 202 static __inline bool 203 rega_divider_en(uint8_t rega) 204 { 205 /* 206 * The RTC is counting only when dividers are not held in reset. 207 */ 208 return ((rega & RTCSA_DIVIDER_MASK) == RTCSA_DIVIDER_32K); 209 } 210 211 static __inline hrtime_t 212 rega_period(uint8_t rega) 213 { 214 const uint_t sel = rega & RTCSA_PERIOD_MASK; 215 const hrtime_t rate_period[16] = { 216 0, 217 NANOSEC / 256, 218 NANOSEC / 128, 219 NANOSEC / 8192, 220 NANOSEC / 4096, 221 NANOSEC / 2048, 222 NANOSEC / 1024, 223 NANOSEC / 512, 224 NANOSEC / 256, 225 NANOSEC / 128, 226 NANOSEC / 64, 227 NANOSEC / 32, 228 NANOSEC / 16, 229 NANOSEC / 8, 230 NANOSEC / 4, 231 NANOSEC / 2, 232 }; 233 234 return (rate_period[sel]); 235 } 236 237 static __inline bool 238 vrtc_update_enabled(const struct vrtc *vrtc) 239 { 240 /* 241 * RTC date/time can be updated only if: 242 * - divider is not held in reset 243 * - guest has not disabled updates 244 * - the date/time fields have valid contents 245 */ 246 if (!rega_divider_en(vrtc->rtcdev.reg_a)) 247 return (false); 248 249 if (rtc_halted(vrtc)) 250 return (false); 251 252 if (vrtc->base_rtctime == VRTC_BROKEN_TIME) 253 return (false); 254 255 return (true); 256 } 257 258 /* 259 * Calculate the current time held by the RTC. If the RTC is running (divider 260 * enabled, and updates not halted) then this will account for any time has 261 * passed since the last update. 262 */ 263 static time_t 264 vrtc_curtime(struct vrtc *vrtc, hrtime_t *basep, hrtime_t *phasep) 265 { 266 time_t t = vrtc->base_rtctime; 267 hrtime_t base = vrtc->base_clock; 268 hrtime_t phase = 0; 269 270 ASSERT(VRTC_LOCKED(vrtc)); 271 272 if (vrtc_update_enabled(vrtc)) { 273 const hrtime_t delta = gethrtime() - vrtc->base_clock; 274 const time_t sec = delta / NANOSEC; 275 276 ASSERT3S(delta, >=, 0); 277 278 t += sec; 279 base += sec * NANOSEC; 280 phase = delta % NANOSEC; 281 } 282 if (basep != NULL) { 283 *basep = base; 284 } 285 if (phasep != NULL) { 286 *phasep = phase; 287 } 288 return (t); 289 } 290 291 /* Encode an RTC CMOS value, converting to BCD if necessary */ 292 static __inline uint8_t 293 rtc_enc(const struct rtcdev *rtc, uint8_t val) 294 { 295 const uint8_t bin2bcd_data[] = { 296 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 297 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 298 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28, 0x29, 299 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 300 0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 301 0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 302 0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 303 0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79, 304 0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 305 0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99 306 }; 307 308 ASSERT3U(val, <, 100); 309 310 return ((rtc->reg_b & RTCSB_BIN) ? val : bin2bcd_data[val]); 311 } 312 313 /* 314 * Write the date/time fields in the CMOS with the date represented by the 315 * internal RTC time (base_rtctime). If the time is not valid, or updates of 316 * the RTC are disabled via register configuration (without force_update 317 * override), then the CMOS contents will not be changed. 318 */ 319 static void 320 vrtc_time_to_cmos(struct vrtc *vrtc, bool force_update) 321 { 322 struct rtcdev *rtc = &vrtc->rtcdev; 323 struct timespec ts = { 324 .tv_sec = vrtc->base_rtctime, 325 .tv_nsec = 0, 326 }; 327 328 ASSERT(VRTC_LOCKED(vrtc)); 329 330 if (vrtc->base_rtctime < 0) { 331 ASSERT3S(vrtc->base_rtctime, ==, VRTC_BROKEN_TIME); 332 return; 333 } 334 335 /* 336 * If the RTC is halted then the guest has "ownership" of the 337 * date/time fields. Don't update the RTC date/time fields in 338 * this case (unless forced). 339 */ 340 if (rtc_halted(vrtc) && !force_update) { 341 return; 342 } 343 344 struct clocktime ct; 345 clock_ts_to_ct(&ts, &ct); 346 347 /* 348 * Check that output from clock_ts_to_ct() matches expectations. 349 * Although it closely resembles the requirements for the RTC CMOS 350 * fields, there are a few notable parts (day-of-week) which are 351 * different, and are thus subsequently adjusted for the CMOS output. 352 */ 353 ASSERT(ct.sec >= 0 && ct.sec <= 59); 354 ASSERT(ct.min >= 0 && ct.min <= 59); 355 ASSERT(ct.hour >= 0 && ct.hour <= 23); 356 ASSERT(ct.dow >= 0 && ct.dow <= 6); 357 ASSERT(ct.day >= 1 && ct.day <= 31); 358 ASSERT(ct.mon >= 1 && ct.mon <= 12); 359 ASSERT(ct.year >= POSIX_BASE_YEAR); 360 361 rtc->sec = rtc_enc(rtc, ct.sec); 362 rtc->min = rtc_enc(rtc, ct.min); 363 364 int hour; 365 if (rtc->reg_b & RTCSB_24HR) { 366 hour = ct.hour; 367 } else { 368 /* 369 * Convert to the 12-hour format. 370 */ 371 switch (ct.hour) { 372 case 0: /* 12 AM */ 373 case 12: /* 12 PM */ 374 hour = 12; 375 break; 376 default: 377 /* 378 * The remaining 'ct.hour' values are interpreted as: 379 * [1 - 11] -> 1 - 11 AM 380 * [13 - 23] -> 1 - 11 PM 381 */ 382 hour = ct.hour % 12; 383 break; 384 } 385 } 386 387 rtc->hour = rtc_enc(rtc, hour); 388 389 if ((rtc->reg_b & RTCSB_24HR) == 0 && ct.hour >= 12) { 390 /* set MSB to indicate PM */ 391 rtc->hour |= HOUR_IS_PM; 392 } 393 394 rtc->day_of_week = rtc_enc(rtc, ct.dow + 1); 395 rtc->day_of_month = rtc_enc(rtc, ct.day); 396 rtc->month = rtc_enc(rtc, ct.mon); 397 rtc->year = rtc_enc(rtc, ct.year % 100); 398 rtc->century = rtc_enc(rtc, ct.year / 100); 399 } 400 401 /* Decode an RTC CMOS value, converting from BCD if necessary */ 402 static uint8_t 403 rtc_dec(const struct rtcdev *rtc, uint8_t val, bool *errp) 404 { 405 if ((rtc->reg_b & RTCSB_BIN) == 0) { 406 const uint8_t lower = val & 0xf; 407 const uint8_t upper = val >> 4; 408 409 *errp = (lower > 9 || upper > 9); 410 411 /* 412 * Output will be bogus if value is out of range, so it is on 413 * the caller to properly check `errp`. 414 */ 415 return ((upper * 10) + lower); 416 } else { 417 *errp = false; 418 return (val); 419 } 420 } 421 422 /* Parse hour format from CMOS, accounting for any BCD and 12/24hr encoding */ 423 static uint8_t 424 rtc_parse_hour(const struct rtcdev *rtc, uint8_t hour, bool *errp) 425 { 426 bool pm = false; 427 428 if ((rtc->reg_b & RTCSB_24HR) == 0) { 429 if ((hour & HOUR_IS_PM) != 0) { 430 hour &= ~HOUR_IS_PM; 431 pm = true; 432 } 433 } 434 hour = rtc_dec(rtc, hour, errp); 435 436 if ((rtc->reg_b & RTCSB_24HR) == 0) { 437 if (hour >= 1 && hour <= 12) { 438 /* 439 * Convert from 12-hour format to internal 24-hour 440 * representation as follows: 441 * 442 * 12-hour format ct.hour 443 * 12 AM 0 444 * 1 - 11 AM 1 - 11 445 * 12 PM 12 446 * 1 - 11 PM 13 - 23 447 */ 448 if (hour == 12) { 449 hour = 0; 450 } 451 if (pm) { 452 hour += 12; 453 } 454 } else { 455 /* invalid RTC 12-hour format */ 456 *errp = true; 457 } 458 } 459 460 if (hour > 23) { 461 *errp = true; 462 } 463 464 return (hour); 465 } 466 467 /* Check if alarm fields in CMOS are valid. */ 468 static bool 469 vrtc_alarm_valid(const struct vrtc *vrtc) 470 { 471 const struct rtcdev *rtc = &vrtc->rtcdev; 472 bool err; 473 uint8_t val; 474 475 ASSERT(VRTC_LOCKED(vrtc)); 476 477 /* 478 * For seconds, minutes, and hours fields of the alarm configuration, 479 * check that they can match against valid times, either by matching any 480 * value via the "don't care" mode, or holding a valid time component. 481 */ 482 483 val = rtc->sec; 484 if (!ALARM_DONT_CARE(val)) { 485 val = rtc_dec(rtc, val, &err); 486 if (err || val > 59) { 487 return (false); 488 } 489 } 490 491 val = rtc->min; 492 if (!ALARM_DONT_CARE(val)) { 493 val = rtc_dec(rtc, val, &err); 494 if (err || val > 59) { 495 return (false); 496 } 497 } 498 499 val = rtc->hour; 500 if (!ALARM_DONT_CARE(val)) { 501 (void) rtc_parse_hour(rtc, val, &err); 502 if (err) { 503 return (false); 504 } 505 } 506 507 /* 508 * The alarm fields hold a valid time representation, taking into 509 * consideration any potential "don't care" directives. 510 */ 511 return (true); 512 } 513 514 /* 515 * Read the date/time fields from the CMOS and attempt to convert it to a valid 516 * UNIX timestamp. VRTC_BROKEN_TIME will be emitted if those fields represent 517 * an invalid date. 518 * 519 * The day-of-week field is ignored for the purposes of validation since certain 520 * guests do not make use of it. 521 */ 522 static time_t 523 vrtc_cmos_to_secs(struct vrtc *vrtc) 524 { 525 struct rtcdev *rtc = &vrtc->rtcdev; 526 struct clocktime ct = { 0 }; 527 bool err; 528 529 ASSERT(VRTC_LOCKED(vrtc)); 530 531 ct.sec = rtc_dec(rtc, rtc->sec, &err); 532 if (err || ct.sec > 59) { 533 /* invalid RTC seconds */ 534 goto fail; 535 } 536 537 ct.min = rtc_dec(rtc, rtc->min, &err); 538 if (err || ct.min > 59) { 539 /* invalid RTC minutes */ 540 goto fail; 541 } 542 543 ct.hour = rtc_parse_hour(rtc, rtc->hour, &err); 544 if (err) { 545 /* invalid RTC hour */ 546 goto fail; 547 } 548 549 /* 550 * Ignore 'rtc->dow' because some guests like Linux don't bother 551 * setting it at all while others like OpenBSD/i386 set it incorrectly. 552 * 553 * clock_ct_to_ts() does not depend on 'ct.dow' anyways so ignore it. 554 */ 555 ct.dow = -1; 556 557 ct.day = rtc_dec(rtc, rtc->day_of_month, &err); 558 if (err || ct.day < 1 || ct.day > 31) { 559 /* invalid RTC day-of-month */ 560 goto fail; 561 } 562 563 ct.mon = rtc_dec(rtc, rtc->month, &err); 564 if (err || ct.mon < 1 || ct.mon > 12) { 565 /* invalid RTC month */ 566 goto fail; 567 } 568 569 const uint_t year = rtc_dec(rtc, rtc->year, &err); 570 if (err || year > 99) { 571 /* invalid RTC year */ 572 goto fail; 573 } 574 575 const uint_t century = rtc_dec(rtc, rtc->century, &err); 576 ct.year = century * 100 + year; 577 if (err || ct.year < POSIX_BASE_YEAR) { 578 /* invalid RTC century */ 579 goto fail; 580 } 581 582 struct timespec ts; 583 if (clock_ct_to_ts(&ct, &ts) != 0 || ts.tv_sec < 0) { 584 /* invalid RTC clocktime */ 585 goto fail; 586 } 587 return (ts.tv_sec); /* success */ 588 589 fail: 590 /* 591 * Stop updating the RTC if the date/time fields programmed by 592 * the guest are invalid. 593 */ 594 return (VRTC_BROKEN_TIME); 595 } 596 597 /* 598 * If the periodic timer is enabled, check if enough time has passed for it to 599 * generate an event. 600 */ 601 static void 602 vrtc_periodic_update(struct vrtc *vrtc) 603 { 604 struct rtcdev *rtc = &vrtc->rtcdev; 605 606 ASSERT(VRTC_LOCKED(vrtc)); 607 608 /* 609 * If the divider is disabled, or periodic interrupts are not 610 * configured, then no further work is required. 611 */ 612 const hrtime_t period = rega_period(rtc->reg_a); 613 if (!rega_divider_en(rtc->reg_a) || period == 0) { 614 return; 615 } 616 617 /* 618 * Have we crossed the edge of a period-sized time interval since the 619 * last periodic event? 620 */ 621 hrtime_t since_last = gethrtime() - vrtc->last_period; 622 if (since_last > period) { 623 vrtc_regc_update(vrtc, RTCIR_PERIOD); 624 vrtc->last_period += ROUNDDOWN(since_last, period); 625 } 626 } 627 628 /* 629 * Update the internal contents of the RTC. This processes any events which may 630 * have been generated by the passage of time (update/periodic/alarm), resulting 631 * in updates to register-C. As part of that, it updates the internal time 632 * representation of the RTC, but is not required to render those changes (if 633 * any) to the CMOS memory. A separate call to vrtc_time_to_cmos() is needed if 634 * those fields are about to be accessed. 635 */ 636 static void 637 vrtc_update(struct vrtc *vrtc, uint8_t off) 638 { 639 struct rtcdev *rtc = &vrtc->rtcdev; 640 641 ASSERT(VRTC_LOCKED(vrtc)); 642 643 /* 644 * If CMOS offset of interest is not one which is updated on-demand, 645 * then no update processing is required. 646 */ 647 if (!rtc_field_ondemand(off)) { 648 return; 649 } 650 651 /* 652 * If the divider output is disabled, no events will be generated, and 653 * the time will not be updated. 654 */ 655 if (!rega_divider_en(rtc->reg_a)) { 656 return; 657 } 658 659 /* Check for any periodic timer events requiring injection. */ 660 vrtc_periodic_update(vrtc); 661 662 if (vrtc->base_rtctime == VRTC_BROKEN_TIME) { 663 /* 664 * If the RTC is halted, or the time stored in CMOS is invalid, 665 * then neither alarm checks nor updates to the time stored in 666 * CMOS are performed. 667 */ 668 return; 669 } 670 671 /* 672 * Calculate the new time and its corresponding second-granularity clock 673 * edge from the divider for base_clock. 674 */ 675 hrtime_t base_clock; 676 const time_t newtime = vrtc_curtime(vrtc, &base_clock, NULL); 677 if (vrtc->base_rtctime >= newtime) { 678 /* Nothing more to do if the actual time is unchanged */ 679 return; 680 } 681 vrtc->base_clock = base_clock; 682 683 if (!vrtc_alarm_valid(vrtc) || (rtc->reg_c & RTCIR_ALARM) != 0) { 684 /* 685 * If no valid alarm is configured, or the alarm event is 686 * already pending, there is no need to match the RTC time 687 * against it, since any additional assertion will be redundant 688 * until the flag is read/cleared. 689 */ 690 vrtc->base_rtctime = newtime; 691 } else if ((newtime - vrtc->base_rtctime) >= SEC_PER_DAY) { 692 /* 693 * If 24 hours (or more) has elapsed since the last update, the 694 * configured alarm is certain to fire. Rather than spending 695 * considerable effort in the full matching logic in order to 696 * determine this certainty, just apply it now as a shortcut. 697 */ 698 vrtc_regc_update(vrtc, RTCIR_ALARM); 699 vrtc->base_rtctime = newtime; 700 } else { 701 /* 702 * Check if any of the times (down to the second) between the 703 * old time and the new match against a configured alarm 704 * condition. 705 * 706 * This is not insignificant effort and could stand to be 707 * optimized at some point in the future. 708 */ 709 const uint8_t a_sec = rtc->alarm_sec; 710 const uint8_t a_min = rtc->alarm_min; 711 const uint8_t a_hour = rtc->alarm_hour; 712 do { 713 vrtc->base_rtctime++; 714 vrtc_time_to_cmos(vrtc, false); 715 716 if ((ALARM_DONT_CARE(a_sec) || a_sec == rtc->sec) && 717 (ALARM_DONT_CARE(a_min) || a_min == rtc->min) && 718 (ALARM_DONT_CARE(a_hour) || a_hour == rtc->hour)) { 719 vrtc_regc_update(vrtc, RTCIR_ALARM); 720 /* 721 * Once the alarm triggers during this check, we 722 * can skip to the end, since subsequent firings 723 * would be redundant until the guest can 724 * read/clear the event in register-C. 725 */ 726 vrtc->base_rtctime = newtime; 727 } 728 } while (vrtc->base_rtctime != newtime); 729 } 730 731 /* Reflect that the time underwent an update */ 732 vrtc_regc_update(vrtc, RTCIR_UPDATE); 733 } 734 735 static void 736 vrtc_callout_handler(void *arg) 737 { 738 struct vrtc *vrtc = arg; 739 740 VRTC_LOCK(vrtc); 741 if (callout_pending(&vrtc->callout)) { 742 /* callout was reset */ 743 } else if (!callout_active(&vrtc->callout)) { 744 /* callout was stopped */ 745 } else { 746 callout_deactivate(&vrtc->callout); 747 748 /* Perform the actual update and reschedule (if needed) */ 749 vrtc_update(vrtc, RTC_INTR); 750 vrtc_callout_reschedule(vrtc); 751 } 752 VRTC_UNLOCK(vrtc); 753 } 754 755 static void 756 vrtc_callout_reschedule(struct vrtc *vrtc) 757 { 758 struct rtcdev *rtc = &vrtc->rtcdev; 759 760 ASSERT(VRTC_LOCKED(vrtc)); 761 762 hrtime_t period = 0; 763 if ((rtc->reg_b & RTCSB_PINTR) != 0) { 764 /* 765 * Calculate the next event edge using the periodic timer, since 766 * it will be more granular (2Hz or faster) than the 1Hz used by 767 * the alarm and update interrupts, and still in phase. 768 */ 769 period = rega_period(rtc->reg_a); 770 } 771 if (period == 0 && vrtc_update_enabled(vrtc)) { 772 /* 773 * If RTC updates are enabled, there is potential for update or 774 * alarm interrupts on 1Hz intervals. 775 */ 776 period = NANOSEC; 777 } 778 779 /* 780 * RTC callouts are only required if interrupts are enabled, since all 781 * other side effects of time moving forward (such as setting of the 782 * event bits in register-C) can be conjured on-demand when those fields 783 * are read by the guest. The same is true when an interrupt has been 784 * asserted and not yet handled. 785 */ 786 const bool intr_enabled = (rtc->reg_b & RTCSB_INTR_MASK) != 0; 787 const bool intr_asserted = (rtc->reg_c & RTCIR_INT) != 0; 788 if (period != 0 && intr_enabled && !intr_asserted) { 789 /* 790 * Find the next edge of the specified period interval, 791 * referenced against the phase of base_clock. 792 */ 793 const hrtime_t delta = gethrtime() + period - vrtc->base_clock; 794 const hrtime_t next = 795 ROUNDDOWN(delta, period) + vrtc->base_clock; 796 797 callout_reset_hrtime(&vrtc->callout, next, vrtc_callout_handler, 798 vrtc, C_ABSOLUTE); 799 } else { 800 if (callout_active(&vrtc->callout)) { 801 callout_stop(&vrtc->callout); 802 } 803 } 804 } 805 806 /* 807 * We can take some shortcuts in the register-B/register-C math since the 808 * interrupt-enable bits match their corresponding interrupt-present bits. 809 */ 810 CTASSERT(RTCIR_UPDATE == RTCSB_UINTR); 811 CTASSERT(RTCIR_ALARM == RTCSB_AINTR); 812 CTASSERT(RTCIR_PERIOD == RTCSB_PINTR); 813 814 /* 815 * Update the contents of register-C either due to newly asserted events, or 816 * altered interrupt-enable flags. 817 */ 818 static void 819 vrtc_regc_update(struct vrtc *vrtc, uint8_t events) 820 { 821 struct rtcdev *rtc = &vrtc->rtcdev; 822 823 ASSERT(VRTC_LOCKED(vrtc)); 824 ASSERT0(events & ~(RTCSB_INTR_MASK)); 825 826 /* 827 * Regardless of which interrupt enable flags are set in register-B, the 828 * corresponding event flags are always set in register-C. 829 */ 830 rtc->reg_c |= events; 831 832 const bool oldirq = (rtc->reg_c & RTCIR_INT) != 0; 833 if ((rtc->reg_b & RTCSB_INTR_MASK & rtc->reg_c) != 0) { 834 rtc->reg_c |= RTCIR_INT; 835 } 836 const bool newirq = (rtc->reg_c & RTCIR_INT) != 0; 837 838 /* 839 * Although this should probably be asserting level-triggered interrupt, 840 * the original logic from bhyve is event-triggered. This may warrant 841 * additional consideration at some point. 842 */ 843 if (!oldirq && newirq) { 844 /* IRQ asserted */ 845 (void) vatpic_pulse_irq(vrtc->vm, RTC_IRQ); 846 (void) vioapic_pulse_irq(vrtc->vm, RTC_IRQ); 847 } else if (oldirq && !newirq) { 848 /* IRQ de-asserted */ 849 } 850 } 851 852 /* 853 * Emulate a read of register-C, emitting the contained value and clearing its 854 * contents for subsequent actions. 855 */ 856 static uint8_t 857 vrtc_regc_read(struct vrtc *vrtc) 858 { 859 struct rtcdev *rtc = &vrtc->rtcdev; 860 861 ASSERT(VRTC_LOCKED(vrtc)); 862 863 /* Clear the IRQ flag, and any asserted events */ 864 const uint8_t val = rtc->reg_c; 865 rtc->reg_c = 0; 866 867 return (val); 868 } 869 870 static void 871 vrtc_regb_write(struct vrtc *vrtc, uint8_t newval) 872 { 873 struct rtcdev *rtc = &vrtc->rtcdev; 874 875 ASSERT(VRTC_LOCKED(vrtc)); 876 877 uint8_t changed = rtc->reg_b ^ newval; 878 rtc->reg_b = newval; 879 880 if (changed & RTCSB_HALT) { 881 if ((newval & RTCSB_HALT) == 0) { 882 /* 883 * RTC is coming out of a halted state. 884 * 885 * Push the base time (the clock from the divider) 886 * forward to the nearest second boundary so it may 887 * resume updates from the value set in the CMOS. 888 */ 889 vrtc->base_rtctime = vrtc_cmos_to_secs(vrtc); 890 891 /* 892 * Account for any time which has passed if the divider 893 * was left running while the RTC was in the halted 894 * state. Any whole seconds which elapsed while the 895 * device was in such a state must be discarded. 896 * 897 * If this was not done, the RTC would play "catch-up" 898 * since the last update as recorded in `base_clock`. 899 * The phase of that clock is preserved, even if the 900 * time itself is discarded. 901 */ 902 if (rega_divider_en(vrtc->rtcdev.reg_a)) { 903 const hrtime_t delta = 904 gethrtime() - vrtc->base_clock; 905 906 if (delta > NANOSEC) { 907 vrtc->base_clock += delta / NANOSEC; 908 } 909 } else { 910 /* 911 * If the divider is not running, then all of 912 * this will be taken care of if/when it is 913 * re-enabled by the guest. 914 */ 915 } 916 } else { 917 /* 918 * Force a refresh of the RTC date/time fields so 919 * they reflect the time right before the guest set 920 * the HALT bit. 921 */ 922 vrtc_update(vrtc, RTC_STATUSB); 923 vrtc_time_to_cmos(vrtc, true); 924 925 /* 926 * Updates are halted so mark 'base_rtctime' to denote 927 * that the RTC date/time is in flux. 928 * 929 * Since the HALT/RUN flag does not effect the actual 930 * phase of the clock emitted from the emulated divider, 931 * the base time will remain unchanged 932 */ 933 vrtc->base_rtctime = VRTC_BROKEN_TIME; 934 935 /* 936 * Per the specification, the UINTR bit must be cleared 937 * if the HALT bit is set. 938 */ 939 if ((rtc->reg_b & RTCSB_UINTR) != 0) { 940 rtc->reg_b &= ~RTCSB_UINTR; 941 changed |= RTCSB_UINTR; 942 } 943 } 944 } 945 946 /* Side effect of changes to the interrupt enable bits. */ 947 if (changed & RTCSB_INTR_MASK) { 948 vrtc_regc_update(vrtc, 0); 949 } 950 951 vrtc_callout_reschedule(vrtc); 952 953 /* 954 * The side effect of bits that control the RTC date/time format 955 * is handled lazily when those fields are actually read. 956 */ 957 } 958 959 static void 960 vrtc_rega_write(struct vrtc *vrtc, uint8_t newval) 961 { 962 ASSERT(VRTC_LOCKED(vrtc)); 963 964 const hrtime_t now = gethrtime(); 965 const uint8_t oldval = vrtc->rtcdev.reg_a; 966 bool divider_restarted = false; 967 968 if (rega_divider_en(oldval) && !rega_divider_en(newval)) { 969 /* RTC divider held in reset */ 970 } else if (!rega_divider_en(oldval) && rega_divider_en(newval)) { 971 /* 972 * Divider is coming out of reset. Updates of the reported time 973 * (if enabled) are expected to begin 500ms from now. 974 */ 975 vrtc->base_rtctime = vrtc_cmos_to_secs(vrtc); 976 vrtc->base_clock = now - (NANOSEC / 2); 977 divider_restarted = true; 978 } 979 980 /* 981 * If the frequency of the periodic timer was altered, or the divider 982 * itself was just brought out of reset, we must re-calculate 983 * 'last_period' in order to determine the next edge when the periodic 984 * timer would fire. 985 */ 986 const hrtime_t period_old = rega_period(oldval); 987 const hrtime_t period_new = rega_period(newval); 988 if (period_old != period_new || divider_restarted) { 989 if (period_new != 0) { 990 /* 991 * Since the periodic timer is derived from additional 992 * division applied to the output of the main divider, 993 * we determine the last edge based on the most recent 994 * time update. 995 */ 996 const hrtime_t since_last = now - vrtc->base_clock; 997 vrtc->last_period = vrtc->base_clock; 998 vrtc->last_period += ROUNDDOWN(since_last, period_new); 999 } else { 1000 /* 1001 * The timing of the edge does not matter if the 1002 * periodic timer is disabled 1003 */ 1004 vrtc->last_period = now; 1005 } 1006 } 1007 1008 /* 1009 * We never present the time-update bit as a device, nor is the consumer 1010 * allowed to set it during a write. 1011 */ 1012 vrtc->rtcdev.reg_a = newval & ~RTCSA_TUP; 1013 1014 vrtc_callout_reschedule(vrtc); 1015 } 1016 1017 int 1018 vrtc_set_time(struct vm *vm, const timespec_t *ts) 1019 { 1020 struct vrtc *vrtc = vm_rtc(vm); 1021 1022 if (ts->tv_sec < 0 || ts->tv_nsec >= NANOSEC) { 1023 /* 1024 * Times before the 1970 epoch, or with nonsensical nanosecond 1025 * counts are not supported 1026 */ 1027 return (EINVAL); 1028 } 1029 1030 VRTC_LOCK(vrtc); 1031 vrtc->base_rtctime = ts->tv_sec; 1032 vrtc->base_clock = gethrtime() - ts->tv_nsec; 1033 vrtc->last_period = vrtc->base_clock; 1034 if (!vm_is_paused(vrtc->vm)) { 1035 vrtc_callout_reschedule(vrtc); 1036 } 1037 VRTC_UNLOCK(vrtc); 1038 1039 return (0); 1040 } 1041 1042 void 1043 vrtc_get_time(struct vm *vm, timespec_t *ts) 1044 { 1045 struct vrtc *vrtc = vm_rtc(vm); 1046 hrtime_t phase; 1047 1048 VRTC_LOCK(vrtc); 1049 ts->tv_sec = vrtc_curtime(vrtc, NULL, &phase); 1050 ts->tv_nsec = phase; 1051 VRTC_UNLOCK(vrtc); 1052 } 1053 1054 int 1055 vrtc_nvram_write(struct vm *vm, int offset, uint8_t value) 1056 { 1057 struct vrtc *vrtc = vm_rtc(vm); 1058 uint8_t *rtc_raw = (uint8_t *)&vrtc->rtcdev; 1059 1060 /* Write offset must be valid */ 1061 if (offset < 0 || offset >= sizeof (struct rtcdev)) { 1062 return (EINVAL); 1063 } 1064 1065 /* Disallow writes to RTC control registers or the date/time fields */ 1066 if (rtc_field_ondemand(offset)) { 1067 return (EINVAL); 1068 } 1069 1070 VRTC_LOCK(vrtc); 1071 rtc_raw[offset] = value; 1072 VRTC_UNLOCK(vrtc); 1073 1074 return (0); 1075 } 1076 1077 int 1078 vrtc_nvram_read(struct vm *vm, int offset, uint8_t *retval) 1079 { 1080 struct vrtc *vrtc = vm_rtc(vm); 1081 const uint8_t *rtc_raw = (uint8_t *)&vrtc->rtcdev; 1082 1083 /* Read offset must be valid */ 1084 if (offset < 0 || offset >= sizeof (struct rtcdev)) { 1085 return (EINVAL); 1086 } 1087 1088 VRTC_LOCK(vrtc); 1089 1090 vrtc_update(vrtc, offset); 1091 /* Render out the updated date/time if it is being accessed */ 1092 if (rtc_field_datetime(offset)) { 1093 vrtc_time_to_cmos(vrtc, false); 1094 } 1095 *retval = rtc_raw[offset]; 1096 1097 VRTC_UNLOCK(vrtc); 1098 1099 return (0); 1100 } 1101 1102 int 1103 vrtc_addr_handler(void *arg, bool in, uint16_t port, uint8_t bytes, 1104 uint32_t *val) 1105 { 1106 struct vrtc *vrtc = arg; 1107 1108 if (bytes != 1) { 1109 return (-1); 1110 } 1111 1112 if (in) { 1113 *val = 0xff; 1114 return (0); 1115 } 1116 1117 VRTC_LOCK(vrtc); 1118 vrtc->addr = *val & 0x7f; 1119 VRTC_UNLOCK(vrtc); 1120 1121 return (0); 1122 } 1123 1124 static uint8_t 1125 vrtc_read(struct vrtc *vrtc, uint8_t offset) 1126 { 1127 const uint8_t *rtc_raw = (uint8_t *)&vrtc->rtcdev; 1128 1129 ASSERT(VRTC_LOCKED(vrtc)); 1130 ASSERT(offset < sizeof (struct rtcdev)); 1131 1132 switch (offset) { 1133 case RTC_INTR: 1134 return (vrtc_regc_read(vrtc)); 1135 default: 1136 /* 1137 * Everything else can be read from the updated-on-demand data 1138 * stored in the emulated CMOS space. 1139 */ 1140 return (rtc_raw[offset]); 1141 } 1142 } 1143 1144 static void 1145 vrtc_write(struct vrtc *vrtc, uint8_t offset, uint8_t val) 1146 { 1147 uint8_t *rtc_raw = (uint8_t *)&vrtc->rtcdev; 1148 1149 ASSERT(VRTC_LOCKED(vrtc)); 1150 ASSERT(offset < sizeof (struct rtcdev)); 1151 1152 switch (offset) { 1153 case RTC_STATUSA: 1154 vrtc_rega_write(vrtc, val); 1155 break; 1156 case RTC_STATUSB: 1157 vrtc_regb_write(vrtc, val); 1158 break; 1159 case RTC_INTR: 1160 /* Ignored write to register-C */ 1161 break; 1162 case RTC_STATUSD: 1163 /* Ignored write to register-D */ 1164 break; 1165 case RTC_SEC: 1166 /* High order bit of 'seconds' is read-only. */ 1167 rtc_raw[offset] = val & 0x7f; 1168 break; 1169 default: 1170 rtc_raw[offset] = val; 1171 break; 1172 } 1173 1174 /* 1175 * Some guests may write to date/time fields (such as OpenBSD writing 1176 * the century byte) without first pausing updates with RTCSB_HALT. 1177 * 1178 * Keep our internal representation of the time updated should such 1179 * writes occur. 1180 */ 1181 if (rtc_field_datetime(offset) && !rtc_halted(vrtc)) { 1182 vrtc->base_rtctime = vrtc_cmos_to_secs(vrtc); 1183 } 1184 1185 } 1186 1187 int 1188 vrtc_data_handler(void *arg, bool in, uint16_t port, uint8_t bytes, 1189 uint32_t *val) 1190 { 1191 struct vrtc *vrtc = arg; 1192 1193 if (bytes != 1) { 1194 return (-1); 1195 } 1196 1197 VRTC_LOCK(vrtc); 1198 const uint8_t offset = vrtc->addr; 1199 if (offset >= sizeof (struct rtcdev)) { 1200 VRTC_UNLOCK(vrtc); 1201 return (-1); 1202 } 1203 1204 /* Ensure internal state of RTC is updated */ 1205 vrtc_update(vrtc, offset); 1206 1207 /* 1208 * Update RTC date/time CMOS fields, if necessary. 1209 * 1210 * While the necessity for reads is obvious, the need for it during 1211 * writes is slightly more subtle: A write to one of the date/time 1212 * fields will requiring (re)parsing them all in order to determine the 1213 * new working date/time for the RTC. 1214 */ 1215 if (rtc_field_datetime(offset)) { 1216 vrtc_time_to_cmos(vrtc, false); 1217 } 1218 1219 if (in) { 1220 *val = vrtc_read(vrtc, offset); 1221 } else { 1222 vrtc_write(vrtc, offset, *val); 1223 } 1224 VRTC_UNLOCK(vrtc); 1225 return (0); 1226 } 1227 1228 void 1229 vrtc_reset(struct vrtc *vrtc) 1230 { 1231 struct rtcdev *rtc = &vrtc->rtcdev; 1232 1233 VRTC_LOCK(vrtc); 1234 1235 vrtc_regb_write(vrtc, rtc->reg_b & ~(RTCSB_INTR_MASK | RTCSB_SQWE)); 1236 rtc->reg_c = 0; 1237 ASSERT(!callout_active(&vrtc->callout)); 1238 1239 VRTC_UNLOCK(vrtc); 1240 } 1241 1242 struct vrtc * 1243 vrtc_init(struct vm *vm) 1244 { 1245 struct vrtc *vrtc; 1246 struct rtcdev *rtc; 1247 1248 vrtc = kmem_zalloc(sizeof (struct vrtc), KM_SLEEP); 1249 vrtc->vm = vm; 1250 mutex_init(&vrtc->lock, NULL, MUTEX_ADAPTIVE, NULL); 1251 callout_init(&vrtc->callout, 1); 1252 1253 /* Allow dividers to keep time but disable everything else */ 1254 rtc = &vrtc->rtcdev; 1255 rtc->reg_a = RTCSA_DIVIDER_32K; 1256 rtc->reg_b = RTCSB_24HR; 1257 rtc->reg_c = 0; 1258 rtc->reg_d = RTCSD_PWR; 1259 1260 /* Reset the index register to a safe value. */ 1261 vrtc->addr = RTC_STATUSD; 1262 1263 VRTC_LOCK(vrtc); 1264 /* Initialize RTC time to 00:00:00 1 January, 1970. */ 1265 vrtc->base_rtctime = 0; 1266 vrtc->base_clock = gethrtime(); 1267 vrtc->last_period = vrtc->base_clock; 1268 vrtc_time_to_cmos(vrtc, false); 1269 VRTC_UNLOCK(vrtc); 1270 1271 return (vrtc); 1272 } 1273 1274 void 1275 vrtc_cleanup(struct vrtc *vrtc) 1276 { 1277 callout_drain(&vrtc->callout); 1278 mutex_destroy(&vrtc->lock); 1279 kmem_free(vrtc, sizeof (*vrtc)); 1280 } 1281 1282 void 1283 vrtc_localize_resources(struct vrtc *vrtc) 1284 { 1285 vmm_glue_callout_localize(&vrtc->callout); 1286 } 1287 1288 void 1289 vrtc_pause(struct vrtc *vrtc) 1290 { 1291 VRTC_LOCK(vrtc); 1292 callout_stop(&vrtc->callout); 1293 VRTC_UNLOCK(vrtc); 1294 } 1295 1296 void 1297 vrtc_resume(struct vrtc *vrtc) 1298 { 1299 VRTC_LOCK(vrtc); 1300 ASSERT(!callout_active(&vrtc->callout)); 1301 vrtc_callout_reschedule(vrtc); 1302 VRTC_UNLOCK(vrtc); 1303 } 1304 1305 static int 1306 vrtc_data_read(void *datap, const vmm_data_req_t *req) 1307 { 1308 VERIFY3U(req->vdr_class, ==, VDC_RTC); 1309 VERIFY3U(req->vdr_version, ==, 2); 1310 VERIFY3U(req->vdr_len, >=, sizeof (struct vdi_rtc_v2)); 1311 1312 struct vrtc *vrtc = datap; 1313 struct vdi_rtc_v2 *out = req->vdr_data; 1314 1315 VRTC_LOCK(vrtc); 1316 1317 out->vr_addr = vrtc->addr; 1318 out->vr_base_clock = vm_normalize_hrtime(vrtc->vm, vrtc->base_clock); 1319 out->vr_last_period = vm_normalize_hrtime(vrtc->vm, vrtc->last_period); 1320 bcopy(&vrtc->rtcdev, out->vr_content, sizeof (out->vr_content)); 1321 1322 VRTC_UNLOCK(vrtc); 1323 1324 return (0); 1325 } 1326 1327 static int 1328 vrtc_data_write(void *datap, const vmm_data_req_t *req) 1329 { 1330 VERIFY3U(req->vdr_class, ==, VDC_RTC); 1331 VERIFY3U(req->vdr_version, ==, 2); 1332 VERIFY3U(req->vdr_len, >=, sizeof (struct vdi_rtc_v2)); 1333 1334 struct vrtc *vrtc = datap; 1335 const struct vdi_rtc_v2 *src = req->vdr_data; 1336 1337 const hrtime_t base_clock = 1338 vm_denormalize_hrtime(vrtc->vm, src->vr_base_clock); 1339 const hrtime_t last_period = 1340 vm_denormalize_hrtime(vrtc->vm, src->vr_last_period); 1341 1342 const hrtime_t now = gethrtime(); 1343 if (base_clock > now || last_period > now) { 1344 /* 1345 * Neither the base clock nor the last periodic event edge 1346 * should be in the future, since they should trail (or at most 1347 * equal) the current time. 1348 */ 1349 return (EINVAL); 1350 } 1351 1352 /* 1353 * The phase of last_period could be checked against that of base_clock, 1354 * but for now, any shenanigans there will go unhandled. 1355 */ 1356 1357 VRTC_LOCK(vrtc); 1358 1359 vrtc->base_clock = base_clock; 1360 bcopy(src->vr_content, &vrtc->rtcdev, sizeof (vrtc->rtcdev)); 1361 vrtc->addr = src->vr_addr; 1362 1363 vrtc->rtcdev.reg_a &= ~RTCSA_TUP; 1364 /* register B needs requires no masking */ 1365 vrtc->rtcdev.reg_c &= RTCSC_MASK; 1366 vrtc->rtcdev.reg_d = RTCSD_PWR; 1367 1368 /* Set internal time based on what is stored in CMOS */ 1369 vrtc->base_rtctime = vrtc_cmos_to_secs(vrtc); 1370 /* Using the specified divider edge timing */ 1371 vrtc->base_clock = base_clock; 1372 vrtc->last_period = last_period; 1373 1374 if (!vm_is_paused(vrtc->vm)) { 1375 vrtc_callout_reschedule(vrtc); 1376 } 1377 1378 VRTC_UNLOCK(vrtc); 1379 return (0); 1380 } 1381 1382 static const vmm_data_version_entry_t rtc_v2 = { 1383 .vdve_class = VDC_RTC, 1384 .vdve_version = 2, 1385 .vdve_len_expect = sizeof (struct vdi_rtc_v2), 1386 .vdve_readf = vrtc_data_read, 1387 .vdve_writef = vrtc_data_write, 1388 }; 1389 VMM_DATA_VERSION(rtc_v2); 1390