cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

aspeed_scu.c (23657B)


      1/*
      2 * ASPEED System Control Unit
      3 *
      4 * Andrew Jeffery <andrew@aj.id.au>
      5 *
      6 * Copyright 2016 IBM Corp.
      7 *
      8 * This code is licensed under the GPL version 2 or later.  See
      9 * the COPYING file in the top-level directory.
     10 */
     11
     12#include "qemu/osdep.h"
     13#include "hw/misc/aspeed_scu.h"
     14#include "hw/qdev-properties.h"
     15#include "migration/vmstate.h"
     16#include "qapi/error.h"
     17#include "qapi/visitor.h"
     18#include "qemu/bitops.h"
     19#include "qemu/log.h"
     20#include "qemu/guest-random.h"
     21#include "qemu/module.h"
     22#include "trace.h"
     23
     24#define TO_REG(offset) ((offset) >> 2)
     25
     26#define PROT_KEY             TO_REG(0x00)
     27#define SYS_RST_CTRL         TO_REG(0x04)
     28#define CLK_SEL              TO_REG(0x08)
     29#define CLK_STOP_CTRL        TO_REG(0x0C)
     30#define FREQ_CNTR_CTRL       TO_REG(0x10)
     31#define FREQ_CNTR_EVAL       TO_REG(0x14)
     32#define IRQ_CTRL             TO_REG(0x18)
     33#define D2PLL_PARAM          TO_REG(0x1C)
     34#define MPLL_PARAM           TO_REG(0x20)
     35#define HPLL_PARAM           TO_REG(0x24)
     36#define FREQ_CNTR_RANGE      TO_REG(0x28)
     37#define MISC_CTRL1           TO_REG(0x2C)
     38#define PCI_CTRL1            TO_REG(0x30)
     39#define PCI_CTRL2            TO_REG(0x34)
     40#define PCI_CTRL3            TO_REG(0x38)
     41#define SYS_RST_STATUS       TO_REG(0x3C)
     42#define SOC_SCRATCH1         TO_REG(0x40)
     43#define SOC_SCRATCH2         TO_REG(0x44)
     44#define MAC_CLK_DELAY        TO_REG(0x48)
     45#define MISC_CTRL2           TO_REG(0x4C)
     46#define VGA_SCRATCH1         TO_REG(0x50)
     47#define VGA_SCRATCH2         TO_REG(0x54)
     48#define VGA_SCRATCH3         TO_REG(0x58)
     49#define VGA_SCRATCH4         TO_REG(0x5C)
     50#define VGA_SCRATCH5         TO_REG(0x60)
     51#define VGA_SCRATCH6         TO_REG(0x64)
     52#define VGA_SCRATCH7         TO_REG(0x68)
     53#define VGA_SCRATCH8         TO_REG(0x6C)
     54#define HW_STRAP1            TO_REG(0x70)
     55#define RNG_CTRL             TO_REG(0x74)
     56#define RNG_DATA             TO_REG(0x78)
     57#define SILICON_REV          TO_REG(0x7C)
     58#define PINMUX_CTRL1         TO_REG(0x80)
     59#define PINMUX_CTRL2         TO_REG(0x84)
     60#define PINMUX_CTRL3         TO_REG(0x88)
     61#define PINMUX_CTRL4         TO_REG(0x8C)
     62#define PINMUX_CTRL5         TO_REG(0x90)
     63#define PINMUX_CTRL6         TO_REG(0x94)
     64#define WDT_RST_CTRL         TO_REG(0x9C)
     65#define PINMUX_CTRL7         TO_REG(0xA0)
     66#define PINMUX_CTRL8         TO_REG(0xA4)
     67#define PINMUX_CTRL9         TO_REG(0xA8)
     68#define WAKEUP_EN            TO_REG(0xC0)
     69#define WAKEUP_CTRL          TO_REG(0xC4)
     70#define HW_STRAP2            TO_REG(0xD0)
     71#define FREE_CNTR4           TO_REG(0xE0)
     72#define FREE_CNTR4_EXT       TO_REG(0xE4)
     73#define CPU2_CTRL            TO_REG(0x100)
     74#define CPU2_BASE_SEG1       TO_REG(0x104)
     75#define CPU2_BASE_SEG2       TO_REG(0x108)
     76#define CPU2_BASE_SEG3       TO_REG(0x10C)
     77#define CPU2_BASE_SEG4       TO_REG(0x110)
     78#define CPU2_BASE_SEG5       TO_REG(0x114)
     79#define CPU2_CACHE_CTRL      TO_REG(0x118)
     80#define CHIP_ID0             TO_REG(0x150)
     81#define CHIP_ID1             TO_REG(0x154)
     82#define UART_HPLL_CLK        TO_REG(0x160)
     83#define PCIE_CTRL            TO_REG(0x180)
     84#define BMC_MMIO_CTRL        TO_REG(0x184)
     85#define RELOC_DECODE_BASE1   TO_REG(0x188)
     86#define RELOC_DECODE_BASE2   TO_REG(0x18C)
     87#define MAILBOX_DECODE_BASE  TO_REG(0x190)
     88#define SRAM_DECODE_BASE1    TO_REG(0x194)
     89#define SRAM_DECODE_BASE2    TO_REG(0x198)
     90#define BMC_REV              TO_REG(0x19C)
     91#define BMC_DEV_ID           TO_REG(0x1A4)
     92
     93#define AST2600_PROT_KEY          TO_REG(0x00)
     94#define AST2600_SILICON_REV       TO_REG(0x04)
     95#define AST2600_SILICON_REV2      TO_REG(0x14)
     96#define AST2600_SYS_RST_CTRL      TO_REG(0x40)
     97#define AST2600_SYS_RST_CTRL_CLR  TO_REG(0x44)
     98#define AST2600_SYS_RST_CTRL2     TO_REG(0x50)
     99#define AST2600_SYS_RST_CTRL2_CLR TO_REG(0x54)
    100#define AST2600_CLK_STOP_CTRL     TO_REG(0x80)
    101#define AST2600_CLK_STOP_CTRL_CLR TO_REG(0x84)
    102#define AST2600_CLK_STOP_CTRL2     TO_REG(0x90)
    103#define AST2600_CLK_STOP_CTRL2_CLR TO_REG(0x94)
    104#define AST2600_DEBUG_CTRL        TO_REG(0xC8)
    105#define AST2600_DEBUG_CTRL2       TO_REG(0xD8)
    106#define AST2600_SDRAM_HANDSHAKE   TO_REG(0x100)
    107#define AST2600_HPLL_PARAM        TO_REG(0x200)
    108#define AST2600_HPLL_EXT          TO_REG(0x204)
    109#define AST2600_APLL_PARAM        TO_REG(0x210)
    110#define AST2600_APLL_EXT          TO_REG(0x214)
    111#define AST2600_MPLL_PARAM        TO_REG(0x220)
    112#define AST2600_MPLL_EXT          TO_REG(0x224)
    113#define AST2600_EPLL_PARAM        TO_REG(0x240)
    114#define AST2600_EPLL_EXT          TO_REG(0x244)
    115#define AST2600_DPLL_PARAM        TO_REG(0x260)
    116#define AST2600_DPLL_EXT          TO_REG(0x264)
    117#define AST2600_CLK_SEL           TO_REG(0x300)
    118#define AST2600_CLK_SEL2          TO_REG(0x304)
    119#define AST2600_CLK_SEL3          TO_REG(0x308)
    120#define AST2600_CLK_SEL4          TO_REG(0x310)
    121#define AST2600_CLK_SEL5          TO_REG(0x314)
    122#define AST2600_UARTCLK           TO_REG(0x338)
    123#define AST2600_HUARTCLK          TO_REG(0x33C)
    124#define AST2600_HW_STRAP1         TO_REG(0x500)
    125#define AST2600_HW_STRAP1_CLR     TO_REG(0x504)
    126#define AST2600_HW_STRAP1_PROT    TO_REG(0x508)
    127#define AST2600_HW_STRAP2         TO_REG(0x510)
    128#define AST2600_HW_STRAP2_CLR     TO_REG(0x514)
    129#define AST2600_HW_STRAP2_PROT    TO_REG(0x518)
    130#define AST2600_RNG_CTRL          TO_REG(0x524)
    131#define AST2600_RNG_DATA          TO_REG(0x540)
    132#define AST2600_CHIP_ID0          TO_REG(0x5B0)
    133#define AST2600_CHIP_ID1          TO_REG(0x5B4)
    134
    135#define AST2600_CLK TO_REG(0x40)
    136
    137#define SCU_IO_REGION_SIZE 0x1000
    138
    139static const uint32_t ast2400_a0_resets[ASPEED_SCU_NR_REGS] = {
    140     [SYS_RST_CTRL]    = 0xFFCFFEDCU,
    141     [CLK_SEL]         = 0xF3F40000U,
    142     [CLK_STOP_CTRL]   = 0x19FC3E8BU,
    143     [D2PLL_PARAM]     = 0x00026108U,
    144     [MPLL_PARAM]      = 0x00030291U,
    145     [HPLL_PARAM]      = 0x00000291U,
    146     [MISC_CTRL1]      = 0x00000010U,
    147     [PCI_CTRL1]       = 0x20001A03U,
    148     [PCI_CTRL2]       = 0x20001A03U,
    149     [PCI_CTRL3]       = 0x04000030U,
    150     [SYS_RST_STATUS]  = 0x00000001U,
    151     [SOC_SCRATCH1]    = 0x000000C0U, /* SoC completed DRAM init */
    152     [MISC_CTRL2]      = 0x00000023U,
    153     [RNG_CTRL]        = 0x0000000EU,
    154     [PINMUX_CTRL2]    = 0x0000F000U,
    155     [PINMUX_CTRL3]    = 0x01000000U,
    156     [PINMUX_CTRL4]    = 0x000000FFU,
    157     [PINMUX_CTRL5]    = 0x0000A000U,
    158     [WDT_RST_CTRL]    = 0x003FFFF3U,
    159     [PINMUX_CTRL8]    = 0xFFFF0000U,
    160     [PINMUX_CTRL9]    = 0x000FFFFFU,
    161     [FREE_CNTR4]      = 0x000000FFU,
    162     [FREE_CNTR4_EXT]  = 0x000000FFU,
    163     [CPU2_BASE_SEG1]  = 0x80000000U,
    164     [CPU2_BASE_SEG4]  = 0x1E600000U,
    165     [CPU2_BASE_SEG5]  = 0xC0000000U,
    166     [UART_HPLL_CLK]   = 0x00001903U,
    167     [PCIE_CTRL]       = 0x0000007BU,
    168     [BMC_DEV_ID]      = 0x00002402U
    169};
    170
    171/* SCU70 bit 23: 0 24Mhz. bit 11:9: 0b001 AXI:ABH ratio 2:1 */
    172/* AST2500 revision A1 */
    173
    174static const uint32_t ast2500_a1_resets[ASPEED_SCU_NR_REGS] = {
    175     [SYS_RST_CTRL]    = 0xFFCFFEDCU,
    176     [CLK_SEL]         = 0xF3F40000U,
    177     [CLK_STOP_CTRL]   = 0x19FC3E8BU,
    178     [D2PLL_PARAM]     = 0x00026108U,
    179     [MPLL_PARAM]      = 0x00030291U,
    180     [HPLL_PARAM]      = 0x93000400U,
    181     [MISC_CTRL1]      = 0x00000010U,
    182     [PCI_CTRL1]       = 0x20001A03U,
    183     [PCI_CTRL2]       = 0x20001A03U,
    184     [PCI_CTRL3]       = 0x04000030U,
    185     [SYS_RST_STATUS]  = 0x00000001U,
    186     [SOC_SCRATCH1]    = 0x000000C0U, /* SoC completed DRAM init */
    187     [MISC_CTRL2]      = 0x00000023U,
    188     [RNG_CTRL]        = 0x0000000EU,
    189     [PINMUX_CTRL2]    = 0x0000F000U,
    190     [PINMUX_CTRL3]    = 0x03000000U,
    191     [PINMUX_CTRL4]    = 0x00000000U,
    192     [PINMUX_CTRL5]    = 0x0000A000U,
    193     [WDT_RST_CTRL]    = 0x023FFFF3U,
    194     [PINMUX_CTRL8]    = 0xFFFF0000U,
    195     [PINMUX_CTRL9]    = 0x000FFFFFU,
    196     [FREE_CNTR4]      = 0x000000FFU,
    197     [FREE_CNTR4_EXT]  = 0x000000FFU,
    198     [CPU2_BASE_SEG1]  = 0x80000000U,
    199     [CPU2_BASE_SEG4]  = 0x1E600000U,
    200     [CPU2_BASE_SEG5]  = 0xC0000000U,
    201     [CHIP_ID0]        = 0x1234ABCDU,
    202     [CHIP_ID1]        = 0x88884444U,
    203     [UART_HPLL_CLK]   = 0x00001903U,
    204     [PCIE_CTRL]       = 0x0000007BU,
    205     [BMC_DEV_ID]      = 0x00002402U
    206};
    207
    208static uint32_t aspeed_scu_get_random(void)
    209{
    210    uint32_t num;
    211    qemu_guest_getrandom_nofail(&num, sizeof(num));
    212    return num;
    213}
    214
    215uint32_t aspeed_scu_get_apb_freq(AspeedSCUState *s)
    216{
    217    AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(s);
    218    uint32_t hpll = asc->calc_hpll(s, s->regs[HPLL_PARAM]);
    219
    220    return hpll / (SCU_CLK_GET_PCLK_DIV(s->regs[CLK_SEL]) + 1)
    221        / asc->apb_divider;
    222}
    223
    224static uint64_t aspeed_scu_read(void *opaque, hwaddr offset, unsigned size)
    225{
    226    AspeedSCUState *s = ASPEED_SCU(opaque);
    227    int reg = TO_REG(offset);
    228
    229    if (reg >= ASPEED_SCU_NR_REGS) {
    230        qemu_log_mask(LOG_GUEST_ERROR,
    231                      "%s: Out-of-bounds read at offset 0x%" HWADDR_PRIx "\n",
    232                      __func__, offset);
    233        return 0;
    234    }
    235
    236    switch (reg) {
    237    case RNG_DATA:
    238        /* On hardware, RNG_DATA works regardless of
    239         * the state of the enable bit in RNG_CTRL
    240         */
    241        s->regs[RNG_DATA] = aspeed_scu_get_random();
    242        break;
    243    case WAKEUP_EN:
    244        qemu_log_mask(LOG_GUEST_ERROR,
    245                      "%s: Read of write-only offset 0x%" HWADDR_PRIx "\n",
    246                      __func__, offset);
    247        break;
    248    }
    249
    250    return s->regs[reg];
    251}
    252
    253static void aspeed_ast2400_scu_write(void *opaque, hwaddr offset,
    254                                     uint64_t data, unsigned size)
    255{
    256    AspeedSCUState *s = ASPEED_SCU(opaque);
    257    int reg = TO_REG(offset);
    258
    259    if (reg >= ASPEED_SCU_NR_REGS) {
    260        qemu_log_mask(LOG_GUEST_ERROR,
    261                      "%s: Out-of-bounds write at offset 0x%" HWADDR_PRIx "\n",
    262                      __func__, offset);
    263        return;
    264    }
    265
    266    if (reg > PROT_KEY && reg < CPU2_BASE_SEG1 &&
    267            !s->regs[PROT_KEY]) {
    268        qemu_log_mask(LOG_GUEST_ERROR, "%s: SCU is locked!\n", __func__);
    269    }
    270
    271    trace_aspeed_scu_write(offset, size, data);
    272
    273    switch (reg) {
    274    case PROT_KEY:
    275        s->regs[reg] = (data == ASPEED_SCU_PROT_KEY) ? 1 : 0;
    276        return;
    277    case SILICON_REV:
    278    case FREQ_CNTR_EVAL:
    279    case VGA_SCRATCH1 ... VGA_SCRATCH8:
    280    case RNG_DATA:
    281    case FREE_CNTR4:
    282    case FREE_CNTR4_EXT:
    283        qemu_log_mask(LOG_GUEST_ERROR,
    284                      "%s: Write to read-only offset 0x%" HWADDR_PRIx "\n",
    285                      __func__, offset);
    286        return;
    287    }
    288
    289    s->regs[reg] = data;
    290}
    291
    292static void aspeed_ast2500_scu_write(void *opaque, hwaddr offset,
    293                                     uint64_t data, unsigned size)
    294{
    295    AspeedSCUState *s = ASPEED_SCU(opaque);
    296    int reg = TO_REG(offset);
    297
    298    if (reg >= ASPEED_SCU_NR_REGS) {
    299        qemu_log_mask(LOG_GUEST_ERROR,
    300                      "%s: Out-of-bounds write at offset 0x%" HWADDR_PRIx "\n",
    301                      __func__, offset);
    302        return;
    303    }
    304
    305    if (reg > PROT_KEY && reg < CPU2_BASE_SEG1 &&
    306            !s->regs[PROT_KEY]) {
    307        qemu_log_mask(LOG_GUEST_ERROR, "%s: SCU is locked!\n", __func__);
    308        return;
    309    }
    310
    311    trace_aspeed_scu_write(offset, size, data);
    312
    313    switch (reg) {
    314    case PROT_KEY:
    315        s->regs[reg] = (data == ASPEED_SCU_PROT_KEY) ? 1 : 0;
    316        return;
    317    case HW_STRAP1:
    318        s->regs[HW_STRAP1] |= data;
    319        return;
    320    case SILICON_REV:
    321        s->regs[HW_STRAP1] &= ~data;
    322        return;
    323    case FREQ_CNTR_EVAL:
    324    case VGA_SCRATCH1 ... VGA_SCRATCH8:
    325    case RNG_DATA:
    326    case FREE_CNTR4:
    327    case FREE_CNTR4_EXT:
    328    case CHIP_ID0:
    329    case CHIP_ID1:
    330        qemu_log_mask(LOG_GUEST_ERROR,
    331                      "%s: Write to read-only offset 0x%" HWADDR_PRIx "\n",
    332                      __func__, offset);
    333        return;
    334    }
    335
    336    s->regs[reg] = data;
    337}
    338
    339static const MemoryRegionOps aspeed_ast2400_scu_ops = {
    340    .read = aspeed_scu_read,
    341    .write = aspeed_ast2400_scu_write,
    342    .endianness = DEVICE_LITTLE_ENDIAN,
    343    .valid = {
    344        .min_access_size = 1,
    345        .max_access_size = 4,
    346    },
    347};
    348
    349static const MemoryRegionOps aspeed_ast2500_scu_ops = {
    350    .read = aspeed_scu_read,
    351    .write = aspeed_ast2500_scu_write,
    352    .endianness = DEVICE_LITTLE_ENDIAN,
    353    .valid.min_access_size = 4,
    354    .valid.max_access_size = 4,
    355    .valid.unaligned = false,
    356};
    357
    358static uint32_t aspeed_scu_get_clkin(AspeedSCUState *s)
    359{
    360    if (s->hw_strap1 & SCU_HW_STRAP_CLK_25M_IN) {
    361        return 25000000;
    362    } else if (s->hw_strap1 & SCU_HW_STRAP_CLK_48M_IN) {
    363        return 48000000;
    364    } else {
    365        return 24000000;
    366    }
    367}
    368
    369/*
    370 * Strapped frequencies for the AST2400 in MHz. They depend on the
    371 * clkin frequency.
    372 */
    373static const uint32_t hpll_ast2400_freqs[][4] = {
    374    { 384, 360, 336, 408 }, /* 24MHz or 48MHz */
    375    { 400, 375, 350, 425 }, /* 25MHz */
    376};
    377
    378static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s, uint32_t hpll_reg)
    379{
    380    uint8_t freq_select;
    381    bool clk_25m_in;
    382    uint32_t clkin = aspeed_scu_get_clkin(s);
    383
    384    if (hpll_reg & SCU_AST2400_H_PLL_OFF) {
    385        return 0;
    386    }
    387
    388    if (hpll_reg & SCU_AST2400_H_PLL_PROGRAMMED) {
    389        uint32_t multiplier = 1;
    390
    391        if (!(hpll_reg & SCU_AST2400_H_PLL_BYPASS_EN)) {
    392            uint32_t n  = (hpll_reg >> 5) & 0x3f;
    393            uint32_t od = (hpll_reg >> 4) & 0x1;
    394            uint32_t d  = hpll_reg & 0xf;
    395
    396            multiplier = (2 - od) * ((n + 2) / (d + 1));
    397        }
    398
    399        return clkin * multiplier;
    400    }
    401
    402    /* HW strapping */
    403    clk_25m_in = !!(s->hw_strap1 & SCU_HW_STRAP_CLK_25M_IN);
    404    freq_select = SCU_AST2400_HW_STRAP_GET_H_PLL_CLK(s->hw_strap1);
    405
    406    return hpll_ast2400_freqs[clk_25m_in][freq_select] * 1000000;
    407}
    408
    409static uint32_t aspeed_2500_scu_calc_hpll(AspeedSCUState *s, uint32_t hpll_reg)
    410{
    411    uint32_t multiplier = 1;
    412    uint32_t clkin = aspeed_scu_get_clkin(s);
    413
    414    if (hpll_reg & SCU_H_PLL_OFF) {
    415        return 0;
    416    }
    417
    418    if (!(hpll_reg & SCU_H_PLL_BYPASS_EN)) {
    419        uint32_t p = (hpll_reg >> 13) & 0x3f;
    420        uint32_t m = (hpll_reg >> 5) & 0xff;
    421        uint32_t n = hpll_reg & 0x1f;
    422
    423        multiplier = ((m + 1) / (n + 1)) / (p + 1);
    424    }
    425
    426    return clkin * multiplier;
    427}
    428
    429static void aspeed_scu_reset(DeviceState *dev)
    430{
    431    AspeedSCUState *s = ASPEED_SCU(dev);
    432    AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(dev);
    433
    434    memcpy(s->regs, asc->resets, asc->nr_regs * 4);
    435    s->regs[SILICON_REV] = s->silicon_rev;
    436    s->regs[HW_STRAP1] = s->hw_strap1;
    437    s->regs[HW_STRAP2] = s->hw_strap2;
    438    s->regs[PROT_KEY] = s->hw_prot_key;
    439}
    440
    441static uint32_t aspeed_silicon_revs[] = {
    442    AST2400_A0_SILICON_REV,
    443    AST2400_A1_SILICON_REV,
    444    AST2500_A0_SILICON_REV,
    445    AST2500_A1_SILICON_REV,
    446    AST2600_A0_SILICON_REV,
    447    AST2600_A1_SILICON_REV,
    448    AST2600_A2_SILICON_REV,
    449    AST2600_A3_SILICON_REV,
    450};
    451
    452bool is_supported_silicon_rev(uint32_t silicon_rev)
    453{
    454    int i;
    455
    456    for (i = 0; i < ARRAY_SIZE(aspeed_silicon_revs); i++) {
    457        if (silicon_rev == aspeed_silicon_revs[i]) {
    458            return true;
    459        }
    460    }
    461
    462    return false;
    463}
    464
    465static void aspeed_scu_realize(DeviceState *dev, Error **errp)
    466{
    467    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
    468    AspeedSCUState *s = ASPEED_SCU(dev);
    469    AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(dev);
    470
    471    if (!is_supported_silicon_rev(s->silicon_rev)) {
    472        error_setg(errp, "Unknown silicon revision: 0x%" PRIx32,
    473                s->silicon_rev);
    474        return;
    475    }
    476
    477    memory_region_init_io(&s->iomem, OBJECT(s), asc->ops, s,
    478                          TYPE_ASPEED_SCU, SCU_IO_REGION_SIZE);
    479
    480    sysbus_init_mmio(sbd, &s->iomem);
    481}
    482
    483static const VMStateDescription vmstate_aspeed_scu = {
    484    .name = "aspeed.scu",
    485    .version_id = 2,
    486    .minimum_version_id = 2,
    487    .fields = (VMStateField[]) {
    488        VMSTATE_UINT32_ARRAY(regs, AspeedSCUState, ASPEED_AST2600_SCU_NR_REGS),
    489        VMSTATE_END_OF_LIST()
    490    }
    491};
    492
    493static Property aspeed_scu_properties[] = {
    494    DEFINE_PROP_UINT32("silicon-rev", AspeedSCUState, silicon_rev, 0),
    495    DEFINE_PROP_UINT32("hw-strap1", AspeedSCUState, hw_strap1, 0),
    496    DEFINE_PROP_UINT32("hw-strap2", AspeedSCUState, hw_strap2, 0),
    497    DEFINE_PROP_UINT32("hw-prot-key", AspeedSCUState, hw_prot_key, 0),
    498    DEFINE_PROP_END_OF_LIST(),
    499};
    500
    501static void aspeed_scu_class_init(ObjectClass *klass, void *data)
    502{
    503    DeviceClass *dc = DEVICE_CLASS(klass);
    504    dc->realize = aspeed_scu_realize;
    505    dc->reset = aspeed_scu_reset;
    506    dc->desc = "ASPEED System Control Unit";
    507    dc->vmsd = &vmstate_aspeed_scu;
    508    device_class_set_props(dc, aspeed_scu_properties);
    509}
    510
    511static const TypeInfo aspeed_scu_info = {
    512    .name = TYPE_ASPEED_SCU,
    513    .parent = TYPE_SYS_BUS_DEVICE,
    514    .instance_size = sizeof(AspeedSCUState),
    515    .class_init = aspeed_scu_class_init,
    516    .class_size    = sizeof(AspeedSCUClass),
    517    .abstract      = true,
    518};
    519
    520static void aspeed_2400_scu_class_init(ObjectClass *klass, void *data)
    521{
    522    DeviceClass *dc = DEVICE_CLASS(klass);
    523    AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
    524
    525    dc->desc = "ASPEED 2400 System Control Unit";
    526    asc->resets = ast2400_a0_resets;
    527    asc->calc_hpll = aspeed_2400_scu_calc_hpll;
    528    asc->apb_divider = 2;
    529    asc->nr_regs = ASPEED_SCU_NR_REGS;
    530    asc->ops = &aspeed_ast2400_scu_ops;
    531}
    532
    533static const TypeInfo aspeed_2400_scu_info = {
    534    .name = TYPE_ASPEED_2400_SCU,
    535    .parent = TYPE_ASPEED_SCU,
    536    .instance_size = sizeof(AspeedSCUState),
    537    .class_init = aspeed_2400_scu_class_init,
    538};
    539
    540static void aspeed_2500_scu_class_init(ObjectClass *klass, void *data)
    541{
    542    DeviceClass *dc = DEVICE_CLASS(klass);
    543    AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
    544
    545    dc->desc = "ASPEED 2500 System Control Unit";
    546    asc->resets = ast2500_a1_resets;
    547    asc->calc_hpll = aspeed_2500_scu_calc_hpll;
    548    asc->apb_divider = 4;
    549    asc->nr_regs = ASPEED_SCU_NR_REGS;
    550    asc->ops = &aspeed_ast2500_scu_ops;
    551}
    552
    553static const TypeInfo aspeed_2500_scu_info = {
    554    .name = TYPE_ASPEED_2500_SCU,
    555    .parent = TYPE_ASPEED_SCU,
    556    .instance_size = sizeof(AspeedSCUState),
    557    .class_init = aspeed_2500_scu_class_init,
    558};
    559
    560static uint64_t aspeed_ast2600_scu_read(void *opaque, hwaddr offset,
    561                                        unsigned size)
    562{
    563    AspeedSCUState *s = ASPEED_SCU(opaque);
    564    int reg = TO_REG(offset);
    565
    566    if (reg >= ASPEED_AST2600_SCU_NR_REGS) {
    567        qemu_log_mask(LOG_GUEST_ERROR,
    568                      "%s: Out-of-bounds read at offset 0x%" HWADDR_PRIx "\n",
    569                      __func__, offset);
    570        return 0;
    571    }
    572
    573    switch (reg) {
    574    case AST2600_HPLL_EXT:
    575    case AST2600_EPLL_EXT:
    576    case AST2600_MPLL_EXT:
    577        /* PLLs are always "locked" */
    578        return s->regs[reg] | BIT(31);
    579    case AST2600_RNG_DATA:
    580        /*
    581         * On hardware, RNG_DATA works regardless of the state of the
    582         * enable bit in RNG_CTRL
    583         *
    584         * TODO: Check this is true for ast2600
    585         */
    586        s->regs[AST2600_RNG_DATA] = aspeed_scu_get_random();
    587        break;
    588    }
    589
    590    return s->regs[reg];
    591}
    592
    593static void aspeed_ast2600_scu_write(void *opaque, hwaddr offset,
    594                                     uint64_t data64, unsigned size)
    595{
    596    AspeedSCUState *s = ASPEED_SCU(opaque);
    597    int reg = TO_REG(offset);
    598    /* Truncate here so bitwise operations below behave as expected */
    599    uint32_t data = data64;
    600
    601    if (reg >= ASPEED_AST2600_SCU_NR_REGS) {
    602        qemu_log_mask(LOG_GUEST_ERROR,
    603                      "%s: Out-of-bounds write at offset 0x%" HWADDR_PRIx "\n",
    604                      __func__, offset);
    605        return;
    606    }
    607
    608    if (reg > PROT_KEY && !s->regs[PROT_KEY]) {
    609        qemu_log_mask(LOG_GUEST_ERROR, "%s: SCU is locked!\n", __func__);
    610    }
    611
    612    trace_aspeed_scu_write(offset, size, data);
    613
    614    switch (reg) {
    615    case AST2600_PROT_KEY:
    616        s->regs[reg] = (data == ASPEED_SCU_PROT_KEY) ? 1 : 0;
    617        return;
    618    case AST2600_HW_STRAP1:
    619    case AST2600_HW_STRAP2:
    620        if (s->regs[reg + 2]) {
    621            return;
    622        }
    623        /* fall through */
    624    case AST2600_SYS_RST_CTRL:
    625    case AST2600_SYS_RST_CTRL2:
    626    case AST2600_CLK_STOP_CTRL:
    627    case AST2600_CLK_STOP_CTRL2:
    628        /* W1S (Write 1 to set) registers */
    629        s->regs[reg] |= data;
    630        return;
    631    case AST2600_SYS_RST_CTRL_CLR:
    632    case AST2600_SYS_RST_CTRL2_CLR:
    633    case AST2600_CLK_STOP_CTRL_CLR:
    634    case AST2600_CLK_STOP_CTRL2_CLR:
    635    case AST2600_HW_STRAP1_CLR:
    636    case AST2600_HW_STRAP2_CLR:
    637        /*
    638         * W1C (Write 1 to clear) registers are offset by one address from
    639         * the data register
    640         */
    641        s->regs[reg - 1] &= ~data;
    642        return;
    643
    644    case AST2600_RNG_DATA:
    645    case AST2600_SILICON_REV:
    646    case AST2600_SILICON_REV2:
    647    case AST2600_CHIP_ID0:
    648    case AST2600_CHIP_ID1:
    649        /* Add read only registers here */
    650        qemu_log_mask(LOG_GUEST_ERROR,
    651                      "%s: Write to read-only offset 0x%" HWADDR_PRIx "\n",
    652                      __func__, offset);
    653        return;
    654    }
    655
    656    s->regs[reg] = data;
    657}
    658
    659static const MemoryRegionOps aspeed_ast2600_scu_ops = {
    660    .read = aspeed_ast2600_scu_read,
    661    .write = aspeed_ast2600_scu_write,
    662    .endianness = DEVICE_LITTLE_ENDIAN,
    663    .valid.min_access_size = 4,
    664    .valid.max_access_size = 4,
    665    .valid.unaligned = false,
    666};
    667
    668static const uint32_t ast2600_a3_resets[ASPEED_AST2600_SCU_NR_REGS] = {
    669    [AST2600_SYS_RST_CTRL]      = 0xF7C3FED8,
    670    [AST2600_SYS_RST_CTRL2]     = 0x0DFFFFFC,
    671    [AST2600_CLK_STOP_CTRL]     = 0xFFFF7F8A,
    672    [AST2600_CLK_STOP_CTRL2]    = 0xFFF0FFF0,
    673    [AST2600_DEBUG_CTRL]        = 0x00000FFF,
    674    [AST2600_DEBUG_CTRL2]       = 0x000000FF,
    675    [AST2600_SDRAM_HANDSHAKE]   = 0x00000000,
    676    [AST2600_HPLL_PARAM]        = 0x1000408F,
    677    [AST2600_APLL_PARAM]        = 0x1000405F,
    678    [AST2600_MPLL_PARAM]        = 0x1008405F,
    679    [AST2600_EPLL_PARAM]        = 0x1004077F,
    680    [AST2600_DPLL_PARAM]        = 0x1078405F,
    681    [AST2600_CLK_SEL]           = 0xF3940000,
    682    [AST2600_CLK_SEL2]          = 0x00700000,
    683    [AST2600_CLK_SEL3]          = 0x00000000,
    684    [AST2600_CLK_SEL4]          = 0xF3F40000,
    685    [AST2600_CLK_SEL5]          = 0x30000000,
    686    [AST2600_UARTCLK]           = 0x00014506,
    687    [AST2600_HUARTCLK]          = 0x000145C0,
    688    [AST2600_CHIP_ID0]          = 0x1234ABCD,
    689    [AST2600_CHIP_ID1]          = 0x88884444,
    690};
    691
    692static void aspeed_ast2600_scu_reset(DeviceState *dev)
    693{
    694    AspeedSCUState *s = ASPEED_SCU(dev);
    695    AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(dev);
    696
    697    memcpy(s->regs, asc->resets, asc->nr_regs * 4);
    698
    699    /*
    700     * A0 reports A0 in _REV, but subsequent revisions report A1 regardless
    701     * of actual revision. QEMU and Linux only support A1 onwards so this is
    702     * sufficient.
    703     */
    704    s->regs[AST2600_SILICON_REV] = AST2600_A3_SILICON_REV;
    705    s->regs[AST2600_SILICON_REV2] = s->silicon_rev;
    706    s->regs[AST2600_HW_STRAP1] = s->hw_strap1;
    707    s->regs[AST2600_HW_STRAP2] = s->hw_strap2;
    708    s->regs[PROT_KEY] = s->hw_prot_key;
    709}
    710
    711static void aspeed_2600_scu_class_init(ObjectClass *klass, void *data)
    712{
    713    DeviceClass *dc = DEVICE_CLASS(klass);
    714    AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
    715
    716    dc->desc = "ASPEED 2600 System Control Unit";
    717    dc->reset = aspeed_ast2600_scu_reset;
    718    asc->resets = ast2600_a3_resets;
    719    asc->calc_hpll = aspeed_2500_scu_calc_hpll; /* No change since AST2500 */
    720    asc->apb_divider = 4;
    721    asc->nr_regs = ASPEED_AST2600_SCU_NR_REGS;
    722    asc->ops = &aspeed_ast2600_scu_ops;
    723}
    724
    725static const TypeInfo aspeed_2600_scu_info = {
    726    .name = TYPE_ASPEED_2600_SCU,
    727    .parent = TYPE_ASPEED_SCU,
    728    .instance_size = sizeof(AspeedSCUState),
    729    .class_init = aspeed_2600_scu_class_init,
    730};
    731
    732static void aspeed_scu_register_types(void)
    733{
    734    type_register_static(&aspeed_scu_info);
    735    type_register_static(&aspeed_2400_scu_info);
    736    type_register_static(&aspeed_2500_scu_info);
    737    type_register_static(&aspeed_2600_scu_info);
    738}
    739
    740type_init(aspeed_scu_register_types);