xref: /openbmc/qemu/hw/misc/mps2-scc.c (revision 2a5ee4e1)
1 /*
2  * ARM MPS2 SCC emulation
3  *
4  * Copyright (c) 2017 Linaro Limited
5  * Written by Peter Maydell
6  *
7  *  This program is free software; you can redistribute it and/or modify
8  *  it under the terms of the GNU General Public License version 2 or
9  *  (at your option) any later version.
10  */
11 
12 /* This is a model of the SCC (Serial Communication Controller)
13  * found in the FPGA images of MPS2 development boards.
14  *
15  * Documentation of it can be found in the MPS2 TRM:
16  * https://developer.arm.com/documentation/100112/latest/
17  * and also in the Application Notes documenting individual FPGA images.
18  */
19 
20 #include "qemu/osdep.h"
21 #include "qemu/log.h"
22 #include "qemu/module.h"
23 #include "qemu/bitops.h"
24 #include "trace.h"
25 #include "hw/sysbus.h"
26 #include "hw/irq.h"
27 #include "migration/vmstate.h"
28 #include "hw/registerfields.h"
29 #include "hw/misc/mps2-scc.h"
30 #include "hw/misc/led.h"
31 #include "hw/qdev-properties.h"
32 
33 REG32(CFG0, 0)
34 REG32(CFG1, 4)
35 REG32(CFG2, 8)
36 REG32(CFG3, 0xc)
37 REG32(CFG4, 0x10)
38 REG32(CFG5, 0x14)
39 REG32(CFG6, 0x18)
40 REG32(CFG7, 0x1c)
41 REG32(CFGDATA_RTN, 0xa0)
42 REG32(CFGDATA_OUT, 0xa4)
43 REG32(CFGCTRL, 0xa8)
44     FIELD(CFGCTRL, DEVICE, 0, 12)
45     FIELD(CFGCTRL, RES1, 12, 8)
46     FIELD(CFGCTRL, FUNCTION, 20, 6)
47     FIELD(CFGCTRL, RES2, 26, 4)
48     FIELD(CFGCTRL, WRITE, 30, 1)
49     FIELD(CFGCTRL, START, 31, 1)
50 REG32(CFGSTAT, 0xac)
51     FIELD(CFGSTAT, DONE, 0, 1)
52     FIELD(CFGSTAT, ERROR, 1, 1)
53 REG32(DLL, 0x100)
54 REG32(AID, 0xFF8)
55 REG32(ID, 0xFFC)
56 
scc_partno(MPS2SCC * s)57 static int scc_partno(MPS2SCC *s)
58 {
59     /* Return the partno field of the SCC_ID (0x524, 0x511, etc) */
60     return extract32(s->id, 4, 8);
61 }
62 
63 /* Is CFG_REG2 present? */
have_cfg2(MPS2SCC * s)64 static bool have_cfg2(MPS2SCC *s)
65 {
66     return scc_partno(s) == 0x524 || scc_partno(s) == 0x547 ||
67         scc_partno(s) == 0x536;
68 }
69 
70 /* Is CFG_REG3 present? */
have_cfg3(MPS2SCC * s)71 static bool have_cfg3(MPS2SCC *s)
72 {
73     return scc_partno(s) != 0x524 && scc_partno(s) != 0x547 &&
74         scc_partno(s) != 0x536;
75 }
76 
77 /* Is CFG_REG5 present? */
have_cfg5(MPS2SCC * s)78 static bool have_cfg5(MPS2SCC *s)
79 {
80     return scc_partno(s) == 0x524 || scc_partno(s) == 0x547 ||
81         scc_partno(s) == 0x536;
82 }
83 
84 /* Is CFG_REG6 present? */
have_cfg6(MPS2SCC * s)85 static bool have_cfg6(MPS2SCC *s)
86 {
87     return scc_partno(s) == 0x524 || scc_partno(s) == 0x536;
88 }
89 
90 /* Is CFG_REG7 present? */
have_cfg7(MPS2SCC * s)91 static bool have_cfg7(MPS2SCC *s)
92 {
93     return scc_partno(s) == 0x536;
94 }
95 
96 /* Does CFG_REG0 drive the 'remap' GPIO output? */
cfg0_is_remap(MPS2SCC * s)97 static bool cfg0_is_remap(MPS2SCC *s)
98 {
99     return scc_partno(s) != 0x536;
100 }
101 
102 /* Is CFG_REG1 driving a set of LEDs? */
cfg1_is_leds(MPS2SCC * s)103 static bool cfg1_is_leds(MPS2SCC *s)
104 {
105     return scc_partno(s) != 0x536;
106 }
107 
108 /* Handle a write via the SYS_CFG channel to the specified function/device.
109  * Return false on error (reported to guest via SYS_CFGCTRL ERROR bit).
110  */
scc_cfg_write(MPS2SCC * s,unsigned function,unsigned device,uint32_t value)111 static bool scc_cfg_write(MPS2SCC *s, unsigned function,
112                           unsigned device, uint32_t value)
113 {
114     trace_mps2_scc_cfg_write(function, device, value);
115 
116     if (function != 1 || device >= s->num_oscclk) {
117         qemu_log_mask(LOG_GUEST_ERROR,
118                       "MPS2 SCC config write: bad function %d device %d\n",
119                       function, device);
120         return false;
121     }
122 
123     s->oscclk[device] = value;
124     return true;
125 }
126 
127 /* Handle a read via the SYS_CFG channel to the specified function/device.
128  * Return false on error (reported to guest via SYS_CFGCTRL ERROR bit),
129  * or set *value on success.
130  */
scc_cfg_read(MPS2SCC * s,unsigned function,unsigned device,uint32_t * value)131 static bool scc_cfg_read(MPS2SCC *s, unsigned function,
132                          unsigned device, uint32_t *value)
133 {
134     if (function != 1 || device >= s->num_oscclk) {
135         qemu_log_mask(LOG_GUEST_ERROR,
136                       "MPS2 SCC config read: bad function %d device %d\n",
137                       function, device);
138         return false;
139     }
140 
141     *value = s->oscclk[device];
142 
143     trace_mps2_scc_cfg_read(function, device, *value);
144     return true;
145 }
146 
mps2_scc_read(void * opaque,hwaddr offset,unsigned size)147 static uint64_t mps2_scc_read(void *opaque, hwaddr offset, unsigned size)
148 {
149     MPS2SCC *s = MPS2_SCC(opaque);
150     uint64_t r;
151 
152     switch (offset) {
153     case A_CFG0:
154         r = s->cfg0;
155         break;
156     case A_CFG1:
157         r = s->cfg1;
158         break;
159     case A_CFG2:
160         if (!have_cfg2(s)) {
161             goto bad_offset;
162         }
163         r = s->cfg2;
164         break;
165     case A_CFG3:
166         if (!have_cfg3(s)) {
167             goto bad_offset;
168         }
169         /*
170          * These are user-settable DIP switches on the board. We don't
171          * model that, so just return zeroes.
172          *
173          * TODO: for AN536 this is MCC_MSB_ADDR "additional MCC addressing
174          * bits". These change which part of the DDR4 the motherboard
175          * configuration controller can see in its memory map (see the
176          * appnote section 2.4). QEMU doesn't model the MCC at all, so these
177          * bits are not interesting to us; read-as-zero is as good as anything
178          * else.
179          */
180         r = 0;
181         break;
182     case A_CFG4:
183         r = s->cfg4;
184         break;
185     case A_CFG5:
186         if (!have_cfg5(s)) {
187             goto bad_offset;
188         }
189         r = s->cfg5;
190         break;
191     case A_CFG6:
192         if (!have_cfg6(s)) {
193             goto bad_offset;
194         }
195         r = s->cfg6;
196         break;
197     case A_CFG7:
198         if (!have_cfg7(s)) {
199             goto bad_offset;
200         }
201         r = s->cfg7;
202         break;
203     case A_CFGDATA_RTN:
204         r = s->cfgdata_rtn;
205         break;
206     case A_CFGDATA_OUT:
207         r = s->cfgdata_out;
208         break;
209     case A_CFGCTRL:
210         r = s->cfgctrl;
211         break;
212     case A_CFGSTAT:
213         r = s->cfgstat;
214         break;
215     case A_DLL:
216         r = s->dll;
217         break;
218     case A_AID:
219         r = s->aid;
220         break;
221     case A_ID:
222         r = s->id;
223         break;
224     default:
225     bad_offset:
226         qemu_log_mask(LOG_GUEST_ERROR,
227                       "MPS2 SCC read: bad offset %x\n", (int) offset);
228         r = 0;
229         break;
230     }
231 
232     trace_mps2_scc_read(offset, r, size);
233     return r;
234 }
235 
mps2_scc_write(void * opaque,hwaddr offset,uint64_t value,unsigned size)236 static void mps2_scc_write(void *opaque, hwaddr offset, uint64_t value,
237                            unsigned size)
238 {
239     MPS2SCC *s = MPS2_SCC(opaque);
240 
241     trace_mps2_scc_write(offset, value, size);
242 
243     switch (offset) {
244     case A_CFG0:
245         /*
246          * On some boards bit 0 controls board-specific remapping;
247          * we always reflect bit 0 in the 'remap' GPIO output line,
248          * and let the board wire it up or not as it chooses.
249          * TODO on some boards bit 1 is CPU_WAIT.
250          *
251          * TODO: on the AN536 this register controls reset and halt
252          * for both CPUs. For the moment we don't implement this, so the
253          * register just reads as written.
254          */
255         s->cfg0 = value;
256         if (cfg0_is_remap(s)) {
257             qemu_set_irq(s->remap, s->cfg0 & 1);
258         }
259         break;
260     case A_CFG1:
261         s->cfg1 = value;
262         /*
263          * On most boards this register drives LEDs.
264          *
265          * TODO: for AN536 this controls whether flash and ATCM are
266          * enabled or disabled on reset. QEMU doesn't model this, and
267          * always wires up RAM in the ATCM area and ROM in the flash area.
268          */
269         if (cfg1_is_leds(s)) {
270             for (size_t i = 0; i < ARRAY_SIZE(s->led); i++) {
271                 led_set_state(s->led[i], extract32(value, i, 1));
272             }
273         }
274         break;
275     case A_CFG2:
276         if (!have_cfg2(s)) {
277             goto bad_offset;
278         }
279         /* AN524, AN536: QSPI Select signal */
280         s->cfg2 = value;
281         break;
282     case A_CFG5:
283         if (!have_cfg5(s)) {
284             goto bad_offset;
285         }
286         /* AN524, AN536: ACLK frequency in Hz */
287         s->cfg5 = value;
288         break;
289     case A_CFG6:
290         if (!have_cfg6(s)) {
291             goto bad_offset;
292         }
293         /* AN524: Clock divider for BRAM */
294         /* AN536: Core 0 vector table base address */
295         s->cfg6 = value;
296         break;
297     case A_CFG7:
298         if (!have_cfg7(s)) {
299             goto bad_offset;
300         }
301         /* AN536: Core 1 vector table base address */
302         s->cfg6 = value;
303         break;
304     case A_CFGDATA_OUT:
305         s->cfgdata_out = value;
306         break;
307     case A_CFGCTRL:
308         /* Writing to CFGCTRL clears SYS_CFGSTAT */
309         s->cfgstat = 0;
310         s->cfgctrl = value & ~(R_CFGCTRL_RES1_MASK |
311                                R_CFGCTRL_RES2_MASK |
312                                R_CFGCTRL_START_MASK);
313 
314         if (value & R_CFGCTRL_START_MASK) {
315             /* Start bit set -- do a read or write (instantaneously) */
316             int device = extract32(s->cfgctrl, R_CFGCTRL_DEVICE_SHIFT,
317                                    R_CFGCTRL_DEVICE_LENGTH);
318             int function = extract32(s->cfgctrl, R_CFGCTRL_FUNCTION_SHIFT,
319                                      R_CFGCTRL_FUNCTION_LENGTH);
320 
321             s->cfgstat = R_CFGSTAT_DONE_MASK;
322             if (s->cfgctrl & R_CFGCTRL_WRITE_MASK) {
323                 if (!scc_cfg_write(s, function, device, s->cfgdata_out)) {
324                     s->cfgstat |= R_CFGSTAT_ERROR_MASK;
325                 }
326             } else {
327                 uint32_t result;
328                 if (!scc_cfg_read(s, function, device, &result)) {
329                     s->cfgstat |= R_CFGSTAT_ERROR_MASK;
330                 } else {
331                     s->cfgdata_rtn = result;
332                 }
333             }
334         }
335         break;
336     case A_DLL:
337         /* DLL stands for Digital Locked Loop.
338          * Bits [31:24] (DLL_LOCK_MASK) are writable, and indicate a
339          * mask of which of the DLL_LOCKED bits [16:23] should be ORed
340          * together to determine the ALL_UNMASKED_DLLS_LOCKED bit [0].
341          * For QEMU, our DLLs are always locked, so we can leave bit 0
342          * as 1 always and don't need to recalculate it.
343          */
344         s->dll = deposit32(s->dll, 24, 8, extract32(value, 24, 8));
345         break;
346     default:
347     bad_offset:
348         qemu_log_mask(LOG_GUEST_ERROR,
349                       "MPS2 SCC write: bad offset 0x%x\n", (int) offset);
350         break;
351     }
352 }
353 
354 static const MemoryRegionOps mps2_scc_ops = {
355     .read = mps2_scc_read,
356     .write = mps2_scc_write,
357     .endianness = DEVICE_LITTLE_ENDIAN,
358 };
359 
mps2_scc_reset(DeviceState * dev)360 static void mps2_scc_reset(DeviceState *dev)
361 {
362     MPS2SCC *s = MPS2_SCC(dev);
363     int i;
364 
365     trace_mps2_scc_reset();
366     s->cfg0 = s->cfg0_reset;
367     s->cfg1 = 0;
368     s->cfg2 = 0;
369     s->cfg5 = 0;
370     s->cfg6 = 0;
371     s->cfgdata_rtn = 0;
372     s->cfgdata_out = 0;
373     s->cfgctrl = 0x100000;
374     s->cfgstat = 0;
375     s->dll = 0xffff0001;
376     for (i = 0; i < s->num_oscclk; i++) {
377         s->oscclk[i] = s->oscclk_reset[i];
378     }
379     for (i = 0; i < ARRAY_SIZE(s->led); i++) {
380         device_cold_reset(DEVICE(s->led[i]));
381     }
382 }
383 
mps2_scc_init(Object * obj)384 static void mps2_scc_init(Object *obj)
385 {
386     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
387     MPS2SCC *s = MPS2_SCC(obj);
388 
389     memory_region_init_io(&s->iomem, obj, &mps2_scc_ops, s, "mps2-scc", 0x1000);
390     sysbus_init_mmio(sbd, &s->iomem);
391     qdev_init_gpio_out_named(DEVICE(obj), &s->remap, "remap", 1);
392 }
393 
mps2_scc_realize(DeviceState * dev,Error ** errp)394 static void mps2_scc_realize(DeviceState *dev, Error **errp)
395 {
396     MPS2SCC *s = MPS2_SCC(dev);
397 
398     for (size_t i = 0; i < ARRAY_SIZE(s->led); i++) {
399         char *name = g_strdup_printf("SCC LED%zu", i);
400         s->led[i] = led_create_simple(OBJECT(dev), GPIO_POLARITY_ACTIVE_HIGH,
401                                       LED_COLOR_GREEN, name);
402         g_free(name);
403     }
404 
405     s->oscclk = g_new0(uint32_t, s->num_oscclk);
406 }
407 
mps2_scc_finalize(Object * obj)408 static void mps2_scc_finalize(Object *obj)
409 {
410     MPS2SCC *s = MPS2_SCC(obj);
411 
412     g_free(s->oscclk_reset);
413 }
414 
cfg7_needed(void * opaque)415 static bool cfg7_needed(void *opaque)
416 {
417     MPS2SCC *s = opaque;
418 
419     return have_cfg7(s);
420 }
421 
422 static const VMStateDescription vmstate_cfg7 = {
423     .name = "mps2-scc/cfg7",
424     .version_id = 1,
425     .minimum_version_id = 1,
426     .needed = cfg7_needed,
427     .fields = (const VMStateField[]) {
428         VMSTATE_UINT32(cfg7, MPS2SCC),
429         VMSTATE_END_OF_LIST()
430     }
431 };
432 
433 static const VMStateDescription mps2_scc_vmstate = {
434     .name = "mps2-scc",
435     .version_id = 3,
436     .minimum_version_id = 3,
437     .fields = (const VMStateField[]) {
438         VMSTATE_UINT32(cfg0, MPS2SCC),
439         VMSTATE_UINT32(cfg1, MPS2SCC),
440         VMSTATE_UINT32(cfg2, MPS2SCC),
441         /* cfg3, cfg4 are read-only so need not be migrated */
442         VMSTATE_UINT32(cfg5, MPS2SCC),
443         VMSTATE_UINT32(cfg6, MPS2SCC),
444         VMSTATE_UINT32(cfgdata_rtn, MPS2SCC),
445         VMSTATE_UINT32(cfgdata_out, MPS2SCC),
446         VMSTATE_UINT32(cfgctrl, MPS2SCC),
447         VMSTATE_UINT32(cfgstat, MPS2SCC),
448         VMSTATE_UINT32(dll, MPS2SCC),
449         VMSTATE_VARRAY_UINT32(oscclk, MPS2SCC, num_oscclk,
450                               0, vmstate_info_uint32, uint32_t),
451         VMSTATE_END_OF_LIST()
452     },
453     .subsections = (const VMStateDescription * const []) {
454         &vmstate_cfg7,
455         NULL
456     }
457 };
458 
459 static Property mps2_scc_properties[] = {
460     /* Values for various read-only ID registers (which are specific
461      * to the board model or FPGA image)
462      */
463     DEFINE_PROP_UINT32("scc-cfg4", MPS2SCC, cfg4, 0),
464     DEFINE_PROP_UINT32("scc-aid", MPS2SCC, aid, 0),
465     DEFINE_PROP_UINT32("scc-id", MPS2SCC, id, 0),
466     /* Reset value for CFG0 register */
467     DEFINE_PROP_UINT32("scc-cfg0", MPS2SCC, cfg0_reset, 0),
468     /*
469      * These are the initial settings for the source clocks on the board.
470      * In hardware they can be configured via a config file read by the
471      * motherboard configuration controller to suit the FPGA image.
472      */
473     DEFINE_PROP_ARRAY("oscclk", MPS2SCC, num_oscclk, oscclk_reset,
474                       qdev_prop_uint32, uint32_t),
475     DEFINE_PROP_END_OF_LIST(),
476 };
477 
mps2_scc_class_init(ObjectClass * klass,void * data)478 static void mps2_scc_class_init(ObjectClass *klass, void *data)
479 {
480     DeviceClass *dc = DEVICE_CLASS(klass);
481 
482     dc->realize = mps2_scc_realize;
483     dc->vmsd = &mps2_scc_vmstate;
484     dc->reset = mps2_scc_reset;
485     device_class_set_props(dc, mps2_scc_properties);
486 }
487 
488 static const TypeInfo mps2_scc_info = {
489     .name = TYPE_MPS2_SCC,
490     .parent = TYPE_SYS_BUS_DEVICE,
491     .instance_size = sizeof(MPS2SCC),
492     .instance_init = mps2_scc_init,
493     .instance_finalize = mps2_scc_finalize,
494     .class_init = mps2_scc_class_init,
495 };
496 
mps2_scc_register_types(void)497 static void mps2_scc_register_types(void)
498 {
499     type_register_static(&mps2_scc_info);
500 }
501 
502 type_init(mps2_scc_register_types);
503