1 /* 2 * ARM MPS2 SCC emulation 3 * 4 * Copyright (c) 2017 Linaro Limited 5 * Written by Peter Maydell 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 or 9 * (at your option) any later version. 10 */ 11 12 /* This is a model of the SCC (Serial Communication Controller) 13 * found in the FPGA images of MPS2 development boards. 14 * 15 * Documentation of it can be found in the MPS2 TRM: 16 * https://developer.arm.com/documentation/100112/latest/ 17 * and also in the Application Notes documenting individual FPGA images. 18 */ 19 20 #include "qemu/osdep.h" 21 #include "qemu/log.h" 22 #include "qemu/module.h" 23 #include "qemu/bitops.h" 24 #include "trace.h" 25 #include "hw/sysbus.h" 26 #include "hw/irq.h" 27 #include "migration/vmstate.h" 28 #include "hw/registerfields.h" 29 #include "hw/misc/mps2-scc.h" 30 #include "hw/misc/led.h" 31 #include "hw/qdev-properties.h" 32 33 REG32(CFG0, 0) 34 REG32(CFG1, 4) 35 REG32(CFG2, 8) 36 REG32(CFG3, 0xc) 37 REG32(CFG4, 0x10) 38 REG32(CFG5, 0x14) 39 REG32(CFG6, 0x18) 40 REG32(CFGDATA_RTN, 0xa0) 41 REG32(CFGDATA_OUT, 0xa4) 42 REG32(CFGCTRL, 0xa8) 43 FIELD(CFGCTRL, DEVICE, 0, 12) 44 FIELD(CFGCTRL, RES1, 12, 8) 45 FIELD(CFGCTRL, FUNCTION, 20, 6) 46 FIELD(CFGCTRL, RES2, 26, 4) 47 FIELD(CFGCTRL, WRITE, 30, 1) 48 FIELD(CFGCTRL, START, 31, 1) 49 REG32(CFGSTAT, 0xac) 50 FIELD(CFGSTAT, DONE, 0, 1) 51 FIELD(CFGSTAT, ERROR, 1, 1) 52 REG32(DLL, 0x100) 53 REG32(AID, 0xFF8) 54 REG32(ID, 0xFFC) 55 56 static int scc_partno(MPS2SCC *s) 57 { 58 /* Return the partno field of the SCC_ID (0x524, 0x511, etc) */ 59 return extract32(s->id, 4, 8); 60 } 61 62 /* Handle a write via the SYS_CFG channel to the specified function/device. 63 * Return false on error (reported to guest via SYS_CFGCTRL ERROR bit). 64 */ 65 static bool scc_cfg_write(MPS2SCC *s, unsigned function, 66 unsigned device, uint32_t value) 67 { 68 trace_mps2_scc_cfg_write(function, device, value); 69 70 if (function != 1 || device >= s->num_oscclk) { 71 qemu_log_mask(LOG_GUEST_ERROR, 72 "MPS2 SCC config write: bad function %d device %d\n", 73 function, device); 74 return false; 75 } 76 77 s->oscclk[device] = value; 78 return true; 79 } 80 81 /* Handle a read via the SYS_CFG channel to the specified function/device. 82 * Return false on error (reported to guest via SYS_CFGCTRL ERROR bit), 83 * or set *value on success. 84 */ 85 static bool scc_cfg_read(MPS2SCC *s, unsigned function, 86 unsigned device, uint32_t *value) 87 { 88 if (function != 1 || device >= s->num_oscclk) { 89 qemu_log_mask(LOG_GUEST_ERROR, 90 "MPS2 SCC config read: bad function %d device %d\n", 91 function, device); 92 return false; 93 } 94 95 *value = s->oscclk[device]; 96 97 trace_mps2_scc_cfg_read(function, device, *value); 98 return true; 99 } 100 101 static uint64_t mps2_scc_read(void *opaque, hwaddr offset, unsigned size) 102 { 103 MPS2SCC *s = MPS2_SCC(opaque); 104 uint64_t r; 105 106 switch (offset) { 107 case A_CFG0: 108 r = s->cfg0; 109 break; 110 case A_CFG1: 111 r = s->cfg1; 112 break; 113 case A_CFG2: 114 if (scc_partno(s) != 0x524 && scc_partno(s) != 0x547) { 115 /* CFG2 reserved on other boards */ 116 goto bad_offset; 117 } 118 r = s->cfg2; 119 break; 120 case A_CFG3: 121 if (scc_partno(s) == 0x524 && scc_partno(s) == 0x547) { 122 /* CFG3 reserved on AN524 */ 123 goto bad_offset; 124 } 125 /* These are user-settable DIP switches on the board. We don't 126 * model that, so just return zeroes. 127 */ 128 r = 0; 129 break; 130 case A_CFG4: 131 r = s->cfg4; 132 break; 133 case A_CFG5: 134 if (scc_partno(s) != 0x524 && scc_partno(s) != 0x547) { 135 /* CFG5 reserved on other boards */ 136 goto bad_offset; 137 } 138 r = s->cfg5; 139 break; 140 case A_CFG6: 141 if (scc_partno(s) != 0x524) { 142 /* CFG6 reserved on other boards */ 143 goto bad_offset; 144 } 145 r = s->cfg6; 146 break; 147 case A_CFGDATA_RTN: 148 r = s->cfgdata_rtn; 149 break; 150 case A_CFGDATA_OUT: 151 r = s->cfgdata_out; 152 break; 153 case A_CFGCTRL: 154 r = s->cfgctrl; 155 break; 156 case A_CFGSTAT: 157 r = s->cfgstat; 158 break; 159 case A_DLL: 160 r = s->dll; 161 break; 162 case A_AID: 163 r = s->aid; 164 break; 165 case A_ID: 166 r = s->id; 167 break; 168 default: 169 bad_offset: 170 qemu_log_mask(LOG_GUEST_ERROR, 171 "MPS2 SCC read: bad offset %x\n", (int) offset); 172 r = 0; 173 break; 174 } 175 176 trace_mps2_scc_read(offset, r, size); 177 return r; 178 } 179 180 static void mps2_scc_write(void *opaque, hwaddr offset, uint64_t value, 181 unsigned size) 182 { 183 MPS2SCC *s = MPS2_SCC(opaque); 184 185 trace_mps2_scc_write(offset, value, size); 186 187 switch (offset) { 188 case A_CFG0: 189 /* 190 * On some boards bit 0 controls board-specific remapping; 191 * we always reflect bit 0 in the 'remap' GPIO output line, 192 * and let the board wire it up or not as it chooses. 193 * TODO on some boards bit 1 is CPU_WAIT. 194 */ 195 s->cfg0 = value; 196 qemu_set_irq(s->remap, s->cfg0 & 1); 197 break; 198 case A_CFG1: 199 s->cfg1 = value; 200 for (size_t i = 0; i < ARRAY_SIZE(s->led); i++) { 201 led_set_state(s->led[i], extract32(value, i, 1)); 202 } 203 break; 204 case A_CFG2: 205 if (scc_partno(s) != 0x524 && scc_partno(s) != 0x547) { 206 /* CFG2 reserved on other boards */ 207 goto bad_offset; 208 } 209 /* AN524: QSPI Select signal */ 210 s->cfg2 = value; 211 break; 212 case A_CFG5: 213 if (scc_partno(s) != 0x524 && scc_partno(s) != 0x547) { 214 /* CFG5 reserved on other boards */ 215 goto bad_offset; 216 } 217 /* AN524: ACLK frequency in Hz */ 218 s->cfg5 = value; 219 break; 220 case A_CFG6: 221 if (scc_partno(s) != 0x524) { 222 /* CFG6 reserved on other boards */ 223 goto bad_offset; 224 } 225 /* AN524: Clock divider for BRAM */ 226 s->cfg6 = value; 227 break; 228 case A_CFGDATA_OUT: 229 s->cfgdata_out = value; 230 break; 231 case A_CFGCTRL: 232 /* Writing to CFGCTRL clears SYS_CFGSTAT */ 233 s->cfgstat = 0; 234 s->cfgctrl = value & ~(R_CFGCTRL_RES1_MASK | 235 R_CFGCTRL_RES2_MASK | 236 R_CFGCTRL_START_MASK); 237 238 if (value & R_CFGCTRL_START_MASK) { 239 /* Start bit set -- do a read or write (instantaneously) */ 240 int device = extract32(s->cfgctrl, R_CFGCTRL_DEVICE_SHIFT, 241 R_CFGCTRL_DEVICE_LENGTH); 242 int function = extract32(s->cfgctrl, R_CFGCTRL_FUNCTION_SHIFT, 243 R_CFGCTRL_FUNCTION_LENGTH); 244 245 s->cfgstat = R_CFGSTAT_DONE_MASK; 246 if (s->cfgctrl & R_CFGCTRL_WRITE_MASK) { 247 if (!scc_cfg_write(s, function, device, s->cfgdata_out)) { 248 s->cfgstat |= R_CFGSTAT_ERROR_MASK; 249 } 250 } else { 251 uint32_t result; 252 if (!scc_cfg_read(s, function, device, &result)) { 253 s->cfgstat |= R_CFGSTAT_ERROR_MASK; 254 } else { 255 s->cfgdata_rtn = result; 256 } 257 } 258 } 259 break; 260 case A_DLL: 261 /* DLL stands for Digital Locked Loop. 262 * Bits [31:24] (DLL_LOCK_MASK) are writable, and indicate a 263 * mask of which of the DLL_LOCKED bits [16:23] should be ORed 264 * together to determine the ALL_UNMASKED_DLLS_LOCKED bit [0]. 265 * For QEMU, our DLLs are always locked, so we can leave bit 0 266 * as 1 always and don't need to recalculate it. 267 */ 268 s->dll = deposit32(s->dll, 24, 8, extract32(value, 24, 8)); 269 break; 270 default: 271 bad_offset: 272 qemu_log_mask(LOG_GUEST_ERROR, 273 "MPS2 SCC write: bad offset 0x%x\n", (int) offset); 274 break; 275 } 276 } 277 278 static const MemoryRegionOps mps2_scc_ops = { 279 .read = mps2_scc_read, 280 .write = mps2_scc_write, 281 .endianness = DEVICE_LITTLE_ENDIAN, 282 }; 283 284 static void mps2_scc_reset(DeviceState *dev) 285 { 286 MPS2SCC *s = MPS2_SCC(dev); 287 int i; 288 289 trace_mps2_scc_reset(); 290 s->cfg0 = s->cfg0_reset; 291 s->cfg1 = 0; 292 s->cfg2 = 0; 293 s->cfg5 = 0; 294 s->cfg6 = 0; 295 s->cfgdata_rtn = 0; 296 s->cfgdata_out = 0; 297 s->cfgctrl = 0x100000; 298 s->cfgstat = 0; 299 s->dll = 0xffff0001; 300 for (i = 0; i < s->num_oscclk; i++) { 301 s->oscclk[i] = s->oscclk_reset[i]; 302 } 303 for (i = 0; i < ARRAY_SIZE(s->led); i++) { 304 device_cold_reset(DEVICE(s->led[i])); 305 } 306 } 307 308 static void mps2_scc_init(Object *obj) 309 { 310 SysBusDevice *sbd = SYS_BUS_DEVICE(obj); 311 MPS2SCC *s = MPS2_SCC(obj); 312 313 memory_region_init_io(&s->iomem, obj, &mps2_scc_ops, s, "mps2-scc", 0x1000); 314 sysbus_init_mmio(sbd, &s->iomem); 315 qdev_init_gpio_out_named(DEVICE(obj), &s->remap, "remap", 1); 316 } 317 318 static void mps2_scc_realize(DeviceState *dev, Error **errp) 319 { 320 MPS2SCC *s = MPS2_SCC(dev); 321 322 for (size_t i = 0; i < ARRAY_SIZE(s->led); i++) { 323 char *name = g_strdup_printf("SCC LED%zu", i); 324 s->led[i] = led_create_simple(OBJECT(dev), GPIO_POLARITY_ACTIVE_HIGH, 325 LED_COLOR_GREEN, name); 326 g_free(name); 327 } 328 329 s->oscclk = g_new0(uint32_t, s->num_oscclk); 330 } 331 332 static void mps2_scc_finalize(Object *obj) 333 { 334 MPS2SCC *s = MPS2_SCC(obj); 335 336 g_free(s->oscclk_reset); 337 } 338 339 static const VMStateDescription mps2_scc_vmstate = { 340 .name = "mps2-scc", 341 .version_id = 3, 342 .minimum_version_id = 3, 343 .fields = (const VMStateField[]) { 344 VMSTATE_UINT32(cfg0, MPS2SCC), 345 VMSTATE_UINT32(cfg1, MPS2SCC), 346 VMSTATE_UINT32(cfg2, MPS2SCC), 347 /* cfg3, cfg4 are read-only so need not be migrated */ 348 VMSTATE_UINT32(cfg5, MPS2SCC), 349 VMSTATE_UINT32(cfg6, MPS2SCC), 350 VMSTATE_UINT32(cfgdata_rtn, MPS2SCC), 351 VMSTATE_UINT32(cfgdata_out, MPS2SCC), 352 VMSTATE_UINT32(cfgctrl, MPS2SCC), 353 VMSTATE_UINT32(cfgstat, MPS2SCC), 354 VMSTATE_UINT32(dll, MPS2SCC), 355 VMSTATE_VARRAY_UINT32(oscclk, MPS2SCC, num_oscclk, 356 0, vmstate_info_uint32, uint32_t), 357 VMSTATE_END_OF_LIST() 358 } 359 }; 360 361 static Property mps2_scc_properties[] = { 362 /* Values for various read-only ID registers (which are specific 363 * to the board model or FPGA image) 364 */ 365 DEFINE_PROP_UINT32("scc-cfg4", MPS2SCC, cfg4, 0), 366 DEFINE_PROP_UINT32("scc-aid", MPS2SCC, aid, 0), 367 DEFINE_PROP_UINT32("scc-id", MPS2SCC, id, 0), 368 /* Reset value for CFG0 register */ 369 DEFINE_PROP_UINT32("scc-cfg0", MPS2SCC, cfg0_reset, 0), 370 /* 371 * These are the initial settings for the source clocks on the board. 372 * In hardware they can be configured via a config file read by the 373 * motherboard configuration controller to suit the FPGA image. 374 */ 375 DEFINE_PROP_ARRAY("oscclk", MPS2SCC, num_oscclk, oscclk_reset, 376 qdev_prop_uint32, uint32_t), 377 DEFINE_PROP_END_OF_LIST(), 378 }; 379 380 static void mps2_scc_class_init(ObjectClass *klass, void *data) 381 { 382 DeviceClass *dc = DEVICE_CLASS(klass); 383 384 dc->realize = mps2_scc_realize; 385 dc->vmsd = &mps2_scc_vmstate; 386 dc->reset = mps2_scc_reset; 387 device_class_set_props(dc, mps2_scc_properties); 388 } 389 390 static const TypeInfo mps2_scc_info = { 391 .name = TYPE_MPS2_SCC, 392 .parent = TYPE_SYS_BUS_DEVICE, 393 .instance_size = sizeof(MPS2SCC), 394 .instance_init = mps2_scc_init, 395 .instance_finalize = mps2_scc_finalize, 396 .class_init = mps2_scc_class_init, 397 }; 398 399 static void mps2_scc_register_types(void) 400 { 401 type_register_static(&mps2_scc_info); 402 } 403 404 type_init(mps2_scc_register_types); 405