qemu/hw/misc/aspeed_sdmc.c

307 lines
9.2 KiB
C
Raw Normal View History

/*
* ASPEED SDRAM Memory Controller
*
* Copyright (C) 2016 IBM Corp.
*
* This code is licensed under the GPL version 2 or later. See
* the COPYING file in the top-level directory.
*/
#include "qemu/osdep.h"
#include "qemu/log.h"
#include "qemu/error-report.h"
#include "hw/misc/aspeed_sdmc.h"
#include "hw/misc/aspeed_scu.h"
#include "hw/qdev-properties.h"
#include "qapi/error.h"
#include "trace.h"
/* Protection Key Register */
#define R_PROT (0x00 / 4)
#define PROT_KEY_UNLOCK 0xFC600309
/* Configuration Register */
#define R_CONF (0x04 / 4)
/* Control/Status Register #1 (ast2500) */
#define R_STATUS1 (0x60 / 4)
#define PHY_BUSY_STATE BIT(0)
#define R_ECC_TEST_CTRL (0x70 / 4)
#define ECC_TEST_FINISHED BIT(12)
#define ECC_TEST_FAIL BIT(13)
/*
* Configuration register Ox4 (for Aspeed AST2400 SOC)
*
* These are for the record and future use. ASPEED_SDMC_DRAM_SIZE is
* what we care about right now as it is checked by U-Boot to
* determine the RAM size.
*/
#define ASPEED_SDMC_RESERVED 0xFFFFF800 /* 31:11 reserved */
#define ASPEED_SDMC_AST2300_COMPAT (1 << 10)
#define ASPEED_SDMC_SCRAMBLE_PATTERN (1 << 9)
#define ASPEED_SDMC_DATA_SCRAMBLE (1 << 8)
#define ASPEED_SDMC_ECC_ENABLE (1 << 7)
#define ASPEED_SDMC_VGA_COMPAT (1 << 6) /* readonly */
#define ASPEED_SDMC_DRAM_BANK (1 << 5)
#define ASPEED_SDMC_DRAM_BURST (1 << 4)
#define ASPEED_SDMC_VGA_APERTURE(x) ((x & 0x3) << 2) /* readonly */
#define ASPEED_SDMC_VGA_8MB 0x0
#define ASPEED_SDMC_VGA_16MB 0x1
#define ASPEED_SDMC_VGA_32MB 0x2
#define ASPEED_SDMC_VGA_64MB 0x3
#define ASPEED_SDMC_DRAM_SIZE(x) (x & 0x3)
#define ASPEED_SDMC_DRAM_64MB 0x0
#define ASPEED_SDMC_DRAM_128MB 0x1
#define ASPEED_SDMC_DRAM_256MB 0x2
#define ASPEED_SDMC_DRAM_512MB 0x3
#define ASPEED_SDMC_READONLY_MASK \
(ASPEED_SDMC_RESERVED | ASPEED_SDMC_VGA_COMPAT | \
ASPEED_SDMC_VGA_APERTURE(ASPEED_SDMC_VGA_64MB))
/*
* Configuration register Ox4 (for Aspeed AST2500 SOC and higher)
*
* Incompatibilities are annotated in the list. ASPEED_SDMC_HW_VERSION
* should be set to 1 for the AST2500 SOC.
*/
#define ASPEED_SDMC_HW_VERSION(x) ((x & 0xf) << 28) /* readonly */
#define ASPEED_SDMC_SW_VERSION ((x & 0xff) << 20)
#define ASPEED_SDMC_CACHE_INITIAL_DONE (1 << 19) /* readonly */
#define ASPEED_SDMC_AST2500_RESERVED 0x7C000 /* 18:14 reserved */
#define ASPEED_SDMC_CACHE_DDR4_CONF (1 << 13)
#define ASPEED_SDMC_CACHE_INITIAL (1 << 12)
#define ASPEED_SDMC_CACHE_RANGE_CTRL (1 << 11)
#define ASPEED_SDMC_CACHE_ENABLE (1 << 10) /* differs from AST2400 */
#define ASPEED_SDMC_DRAM_TYPE (1 << 4) /* differs from AST2400 */
/* DRAM size definitions differs */
#define ASPEED_SDMC_AST2500_128MB 0x0
#define ASPEED_SDMC_AST2500_256MB 0x1
#define ASPEED_SDMC_AST2500_512MB 0x2
#define ASPEED_SDMC_AST2500_1024MB 0x3
#define ASPEED_SDMC_AST2500_READONLY_MASK \
(ASPEED_SDMC_HW_VERSION(0xf) | ASPEED_SDMC_CACHE_INITIAL_DONE | \
ASPEED_SDMC_AST2500_RESERVED | ASPEED_SDMC_VGA_COMPAT | \
ASPEED_SDMC_VGA_APERTURE(ASPEED_SDMC_VGA_64MB))
static uint64_t aspeed_sdmc_read(void *opaque, hwaddr addr, unsigned size)
{
AspeedSDMCState *s = ASPEED_SDMC(opaque);
addr >>= 2;
if (addr >= ARRAY_SIZE(s->regs)) {
qemu_log_mask(LOG_GUEST_ERROR,
"%s: Out-of-bounds read at offset 0x%" HWADDR_PRIx "\n",
__func__, addr);
return 0;
}
return s->regs[addr];
}
static void aspeed_sdmc_write(void *opaque, hwaddr addr, uint64_t data,
unsigned int size)
{
AspeedSDMCState *s = ASPEED_SDMC(opaque);
addr >>= 2;
if (addr >= ARRAY_SIZE(s->regs)) {
qemu_log_mask(LOG_GUEST_ERROR,
"%s: Out-of-bounds write at offset 0x%" HWADDR_PRIx "\n",
__func__, addr);
return;
}
Fix ast2500 protection register emulation Some register blocks of the ast2500 are protected by protection key registers which require the right magic value to be written to those registers to allow those registers to be mutated. Register manuals indicate that writing the correct magic value to these registers should cause subsequent reads from those values to return 1, and writing any other value should cause subsequent reads to return 0. Previously, qemu implemented these registers incorrectly: the registers were handled as simple memory, meaning that writing some value x to a protection key register would result in subsequent reads from that register returning the same value x. The protection was implemented by ensuring that the current value of that register equaled the magic value. This modifies qemu to have the correct behaviour: attempts to write to a ast2500 protection register results in a transition to 1 or 0 depending on whether the written value is the correct magic. The protection logic is updated to ensure that the value of the register is nonzero. This bug caused deadlocks with u-boot HEAD: when u-boot is done with a protectable register block, it attempts to lock it by writing the bitwise inverse of the correct magic value, and then spinning forever until the register reads as zero. Since qemu implemented writes to these registers as ordinary memory writes, writing the inverse of the magic value resulted in subsequent reads returning that value, leading to u-boot spinning forever. Signed-off-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Cédric Le Goater <clg@kaod.org> Acked-by: Andrew Jeffery <andrew@aj.id.au> Message-id: 20180220132627.4163-1-hlandau@devever.net [PMM: fixed incorrect code indentation] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-02-22 18:12:51 +03:00
if (addr == R_PROT) {
s->regs[addr] = (data == PROT_KEY_UNLOCK) ? 1 : 0;
return;
}
if (!s->regs[R_PROT]) {
qemu_log_mask(LOG_GUEST_ERROR, "%s: SDMC is locked!\n", __func__);
return;
}
if (addr == R_CONF) {
/* Make sure readonly bits are kept */
switch (s->silicon_rev) {
case AST2400_A0_SILICON_REV:
case AST2400_A1_SILICON_REV:
data &= ~ASPEED_SDMC_READONLY_MASK;
data |= s->fixed_conf;
break;
case AST2500_A0_SILICON_REV:
Fix ast2500 protection register emulation Some register blocks of the ast2500 are protected by protection key registers which require the right magic value to be written to those registers to allow those registers to be mutated. Register manuals indicate that writing the correct magic value to these registers should cause subsequent reads from those values to return 1, and writing any other value should cause subsequent reads to return 0. Previously, qemu implemented these registers incorrectly: the registers were handled as simple memory, meaning that writing some value x to a protection key register would result in subsequent reads from that register returning the same value x. The protection was implemented by ensuring that the current value of that register equaled the magic value. This modifies qemu to have the correct behaviour: attempts to write to a ast2500 protection register results in a transition to 1 or 0 depending on whether the written value is the correct magic. The protection logic is updated to ensure that the value of the register is nonzero. This bug caused deadlocks with u-boot HEAD: when u-boot is done with a protectable register block, it attempts to lock it by writing the bitwise inverse of the correct magic value, and then spinning forever until the register reads as zero. Since qemu implemented writes to these registers as ordinary memory writes, writing the inverse of the magic value resulted in subsequent reads returning that value, leading to u-boot spinning forever. Signed-off-by: Hugo Landau <hlandau@devever.net> Reviewed-by: Cédric Le Goater <clg@kaod.org> Acked-by: Andrew Jeffery <andrew@aj.id.au> Message-id: 20180220132627.4163-1-hlandau@devever.net [PMM: fixed incorrect code indentation] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2018-02-22 18:12:51 +03:00
case AST2500_A1_SILICON_REV:
data &= ~ASPEED_SDMC_AST2500_READONLY_MASK;
data |= s->fixed_conf;
break;
default:
g_assert_not_reached();
}
}
if (s->silicon_rev == AST2500_A0_SILICON_REV ||
s->silicon_rev == AST2500_A1_SILICON_REV) {
switch (addr) {
case R_STATUS1:
/* Will never return 'busy' */
data &= ~PHY_BUSY_STATE;
break;
case R_ECC_TEST_CTRL:
/* Always done, always happy */
data |= ECC_TEST_FINISHED;
data &= ~ECC_TEST_FAIL;
break;
default:
break;
}
}
s->regs[addr] = data;
}
static const MemoryRegionOps aspeed_sdmc_ops = {
.read = aspeed_sdmc_read,
.write = aspeed_sdmc_write,
.endianness = DEVICE_LITTLE_ENDIAN,
.valid.min_access_size = 4,
.valid.max_access_size = 4,
};
static int ast2400_rambits(AspeedSDMCState *s)
{
switch (s->ram_size >> 20) {
case 64:
return ASPEED_SDMC_DRAM_64MB;
case 128:
return ASPEED_SDMC_DRAM_128MB;
case 256:
return ASPEED_SDMC_DRAM_256MB;
case 512:
return ASPEED_SDMC_DRAM_512MB;
default:
break;
}
/* use a common default */
Convert error_report() to warn_report() Convert all uses of error_report("warning:"... to use warn_report() instead. This helps standardise on a single method of printing warnings to the user. All of the warnings were changed using these two commands: find ./* -type f -exec sed -i \ 's|error_report(".*warning[,:] |warn_report("|Ig' {} + Indentation fixed up manually afterwards. The test-qdev-global-props test case was manually updated to ensure that this patch passes make check (as the test cases are case sensitive). Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Suggested-by: Thomas Huth <thuth@redhat.com> Cc: Jeff Cody <jcody@redhat.com> Cc: Kevin Wolf <kwolf@redhat.com> Cc: Max Reitz <mreitz@redhat.com> Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Peter Lieven <pl@kamp.de> Cc: Josh Durgin <jdurgin@redhat.com> Cc: "Richard W.M. Jones" <rjones@redhat.com> Cc: Markus Armbruster <armbru@redhat.com> Cc: Peter Crosthwaite <crosthwaite.peter@gmail.com> Cc: Richard Henderson <rth@twiddle.net> Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com> Cc: Greg Kurz <groug@kaod.org> Cc: Rob Herring <robh@kernel.org> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Peter Chubb <peter.chubb@nicta.com.au> Cc: Eduardo Habkost <ehabkost@redhat.com> Cc: Marcel Apfelbaum <marcel@redhat.com> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Cc: David Gibson <david@gibson.dropbear.id.au> Cc: Alexander Graf <agraf@suse.de> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jason Wang <jasowang@redhat.com> Cc: Marcelo Tosatti <mtosatti@redhat.com> Cc: Christian Borntraeger <borntraeger@de.ibm.com> Cc: Cornelia Huck <cohuck@redhat.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Acked-by: Greg Kurz <groug@kaod.org> Acked-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed by: Peter Chubb <peter.chubb@data61.csiro.au> Acked-by: Max Reitz <mreitz@redhat.com> Acked-by: Marcel Apfelbaum <marcel@redhat.com> Message-Id: <e1cfa2cd47087c248dd24caca9c33d9af0c499b0.1499866456.git.alistair.francis@xilinx.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-07-12 16:57:41 +03:00
warn_report("Invalid RAM size 0x%" PRIx64 ". Using default 256M",
s->ram_size);
s->ram_size = 256 << 20;
return ASPEED_SDMC_DRAM_256MB;
}
static int ast2500_rambits(AspeedSDMCState *s)
{
switch (s->ram_size >> 20) {
case 128:
return ASPEED_SDMC_AST2500_128MB;
case 256:
return ASPEED_SDMC_AST2500_256MB;
case 512:
return ASPEED_SDMC_AST2500_512MB;
case 1024:
return ASPEED_SDMC_AST2500_1024MB;
default:
break;
}
/* use a common default */
Convert error_report() to warn_report() Convert all uses of error_report("warning:"... to use warn_report() instead. This helps standardise on a single method of printing warnings to the user. All of the warnings were changed using these two commands: find ./* -type f -exec sed -i \ 's|error_report(".*warning[,:] |warn_report("|Ig' {} + Indentation fixed up manually afterwards. The test-qdev-global-props test case was manually updated to ensure that this patch passes make check (as the test cases are case sensitive). Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Suggested-by: Thomas Huth <thuth@redhat.com> Cc: Jeff Cody <jcody@redhat.com> Cc: Kevin Wolf <kwolf@redhat.com> Cc: Max Reitz <mreitz@redhat.com> Cc: Ronnie Sahlberg <ronniesahlberg@gmail.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Peter Lieven <pl@kamp.de> Cc: Josh Durgin <jdurgin@redhat.com> Cc: "Richard W.M. Jones" <rjones@redhat.com> Cc: Markus Armbruster <armbru@redhat.com> Cc: Peter Crosthwaite <crosthwaite.peter@gmail.com> Cc: Richard Henderson <rth@twiddle.net> Cc: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com> Cc: Greg Kurz <groug@kaod.org> Cc: Rob Herring <robh@kernel.org> Cc: Peter Maydell <peter.maydell@linaro.org> Cc: Peter Chubb <peter.chubb@nicta.com.au> Cc: Eduardo Habkost <ehabkost@redhat.com> Cc: Marcel Apfelbaum <marcel@redhat.com> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Igor Mammedov <imammedo@redhat.com> Cc: David Gibson <david@gibson.dropbear.id.au> Cc: Alexander Graf <agraf@suse.de> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jason Wang <jasowang@redhat.com> Cc: Marcelo Tosatti <mtosatti@redhat.com> Cc: Christian Borntraeger <borntraeger@de.ibm.com> Cc: Cornelia Huck <cohuck@redhat.com> Cc: Stefan Hajnoczi <stefanha@redhat.com> Acked-by: David Gibson <david@gibson.dropbear.id.au> Acked-by: Greg Kurz <groug@kaod.org> Acked-by: Cornelia Huck <cohuck@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Reviewed by: Peter Chubb <peter.chubb@data61.csiro.au> Acked-by: Max Reitz <mreitz@redhat.com> Acked-by: Marcel Apfelbaum <marcel@redhat.com> Message-Id: <e1cfa2cd47087c248dd24caca9c33d9af0c499b0.1499866456.git.alistair.francis@xilinx.com> Reviewed-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Markus Armbruster <armbru@redhat.com>
2017-07-12 16:57:41 +03:00
warn_report("Invalid RAM size 0x%" PRIx64 ". Using default 512M",
s->ram_size);
s->ram_size = 512 << 20;
return ASPEED_SDMC_AST2500_512MB;
}
static void aspeed_sdmc_reset(DeviceState *dev)
{
AspeedSDMCState *s = ASPEED_SDMC(dev);
memset(s->regs, 0, sizeof(s->regs));
/* Set ram size bit and defaults values */
s->regs[R_CONF] = s->fixed_conf;
}
static void aspeed_sdmc_realize(DeviceState *dev, Error **errp)
{
SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
AspeedSDMCState *s = ASPEED_SDMC(dev);
if (!is_supported_silicon_rev(s->silicon_rev)) {
error_setg(errp, "Unknown silicon revision: 0x%" PRIx32,
s->silicon_rev);
return;
}
switch (s->silicon_rev) {
case AST2400_A0_SILICON_REV:
case AST2400_A1_SILICON_REV:
s->ram_bits = ast2400_rambits(s);
s->max_ram_size = 512 << 20;
s->fixed_conf = ASPEED_SDMC_VGA_COMPAT |
ASPEED_SDMC_DRAM_SIZE(s->ram_bits);
break;
case AST2500_A0_SILICON_REV:
case AST2500_A1_SILICON_REV:
s->ram_bits = ast2500_rambits(s);
s->max_ram_size = 1024 << 20;
s->fixed_conf = ASPEED_SDMC_HW_VERSION(1) |
ASPEED_SDMC_VGA_APERTURE(ASPEED_SDMC_VGA_64MB) |
ASPEED_SDMC_CACHE_INITIAL_DONE |
ASPEED_SDMC_DRAM_SIZE(s->ram_bits);
break;
default:
g_assert_not_reached();
}
memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_sdmc_ops, s,
TYPE_ASPEED_SDMC, 0x1000);
sysbus_init_mmio(sbd, &s->iomem);
}
static const VMStateDescription vmstate_aspeed_sdmc = {
.name = "aspeed.sdmc",
.version_id = 1,
.minimum_version_id = 1,
.fields = (VMStateField[]) {
VMSTATE_UINT32_ARRAY(regs, AspeedSDMCState, ASPEED_SDMC_NR_REGS),
VMSTATE_END_OF_LIST()
}
};
static Property aspeed_sdmc_properties[] = {
DEFINE_PROP_UINT32("silicon-rev", AspeedSDMCState, silicon_rev, 0),
DEFINE_PROP_UINT64("ram-size", AspeedSDMCState, ram_size, 0),
DEFINE_PROP_UINT64("max-ram-size", AspeedSDMCState, max_ram_size, 0),
DEFINE_PROP_END_OF_LIST(),
};
static void aspeed_sdmc_class_init(ObjectClass *klass, void *data)
{
DeviceClass *dc = DEVICE_CLASS(klass);
dc->realize = aspeed_sdmc_realize;
dc->reset = aspeed_sdmc_reset;
dc->desc = "ASPEED SDRAM Memory Controller";
dc->vmsd = &vmstate_aspeed_sdmc;
dc->props = aspeed_sdmc_properties;
}
static const TypeInfo aspeed_sdmc_info = {
.name = TYPE_ASPEED_SDMC,
.parent = TYPE_SYS_BUS_DEVICE,
.instance_size = sizeof(AspeedSDMCState),
.class_init = aspeed_sdmc_class_init,
};
static void aspeed_sdmc_register_types(void)
{
type_register_static(&aspeed_sdmc_info);
}
type_init(aspeed_sdmc_register_types);