cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

aspeed_sdmc.c (15585B)


      1/*
      2 * ASPEED SDRAM Memory Controller
      3 *
      4 * Copyright (C) 2016 IBM Corp.
      5 *
      6 * This code is licensed under the GPL version 2 or later.  See
      7 * the COPYING file in the top-level directory.
      8 */
      9
     10#include "qemu/osdep.h"
     11#include "qemu/log.h"
     12#include "qemu/module.h"
     13#include "qemu/error-report.h"
     14#include "hw/misc/aspeed_sdmc.h"
     15#include "hw/misc/aspeed_scu.h"
     16#include "hw/qdev-properties.h"
     17#include "migration/vmstate.h"
     18#include "qapi/error.h"
     19#include "trace.h"
     20#include "qemu/units.h"
     21#include "qemu/cutils.h"
     22#include "qapi/visitor.h"
     23
     24/* Protection Key Register */
     25#define R_PROT            (0x00 / 4)
     26#define   PROT_UNLOCKED      0x01
     27#define   PROT_HARDLOCKED    0x10  /* AST2600 */
     28#define   PROT_SOFTLOCKED    0x00
     29
     30#define   PROT_KEY_UNLOCK     0xFC600309
     31#define   PROT_KEY_HARDLOCK   0xDEADDEAD /* AST2600 */
     32
     33/* Configuration Register */
     34#define R_CONF            (0x04 / 4)
     35
     36/* Interrupt control/status */
     37#define R_ISR             (0x50 / 4)
     38
     39/* Control/Status Register #1 (ast2500) */
     40#define R_STATUS1         (0x60 / 4)
     41#define   PHY_BUSY_STATE      BIT(0)
     42#define   PHY_PLL_LOCK_STATUS BIT(4)
     43
     44/* Reserved */
     45#define R_MCR6C           (0x6c / 4)
     46
     47#define R_ECC_TEST_CTRL   (0x70 / 4)
     48#define   ECC_TEST_FINISHED   BIT(12)
     49#define   ECC_TEST_FAIL       BIT(13)
     50
     51#define R_TEST_START_LEN  (0x74 / 4)
     52#define R_TEST_FAIL_DQ    (0x78 / 4)
     53#define R_TEST_INIT_VAL   (0x7c / 4)
     54#define R_DRAM_SW         (0x88 / 4)
     55#define R_DRAM_TIME       (0x8c / 4)
     56#define R_ECC_ERR_INJECT  (0xb4 / 4)
     57
     58/*
     59 * Configuration register Ox4 (for Aspeed AST2400 SOC)
     60 *
     61 * These are for the record and future use. ASPEED_SDMC_DRAM_SIZE is
     62 * what we care about right now as it is checked by U-Boot to
     63 * determine the RAM size.
     64 */
     65
     66#define ASPEED_SDMC_RESERVED            0xFFFFF800 /* 31:11 reserved */
     67#define ASPEED_SDMC_AST2300_COMPAT      (1 << 10)
     68#define ASPEED_SDMC_SCRAMBLE_PATTERN    (1 << 9)
     69#define ASPEED_SDMC_DATA_SCRAMBLE       (1 << 8)
     70#define ASPEED_SDMC_ECC_ENABLE          (1 << 7)
     71#define ASPEED_SDMC_VGA_COMPAT          (1 << 6) /* readonly */
     72#define ASPEED_SDMC_DRAM_BANK           (1 << 5)
     73#define ASPEED_SDMC_DRAM_BURST          (1 << 4)
     74#define ASPEED_SDMC_VGA_APERTURE(x)     ((x & 0x3) << 2) /* readonly */
     75#define     ASPEED_SDMC_VGA_8MB             0x0
     76#define     ASPEED_SDMC_VGA_16MB            0x1
     77#define     ASPEED_SDMC_VGA_32MB            0x2
     78#define     ASPEED_SDMC_VGA_64MB            0x3
     79#define ASPEED_SDMC_DRAM_SIZE(x)        (x & 0x3)
     80#define     ASPEED_SDMC_DRAM_64MB           0x0
     81#define     ASPEED_SDMC_DRAM_128MB          0x1
     82#define     ASPEED_SDMC_DRAM_256MB          0x2
     83#define     ASPEED_SDMC_DRAM_512MB          0x3
     84
     85#define ASPEED_SDMC_READONLY_MASK                       \
     86    (ASPEED_SDMC_RESERVED | ASPEED_SDMC_VGA_COMPAT |    \
     87     ASPEED_SDMC_VGA_APERTURE(ASPEED_SDMC_VGA_64MB))
     88/*
     89 * Configuration register Ox4 (for Aspeed AST2500 SOC and higher)
     90 *
     91 * Incompatibilities are annotated in the list. ASPEED_SDMC_HW_VERSION
     92 * should be set to 1 for the AST2500 SOC.
     93 */
     94#define ASPEED_SDMC_HW_VERSION(x)       ((x & 0xf) << 28) /* readonly */
     95#define ASPEED_SDMC_SW_VERSION          ((x & 0xff) << 20)
     96#define ASPEED_SDMC_CACHE_INITIAL_DONE  (1 << 19)  /* readonly */
     97#define ASPEED_SDMC_AST2500_RESERVED    0x7C000 /* 18:14 reserved */
     98#define ASPEED_SDMC_CACHE_DDR4_CONF     (1 << 13)
     99#define ASPEED_SDMC_CACHE_INITIAL       (1 << 12)
    100#define ASPEED_SDMC_CACHE_RANGE_CTRL    (1 << 11)
    101#define ASPEED_SDMC_CACHE_ENABLE        (1 << 10) /* differs from AST2400 */
    102#define ASPEED_SDMC_DRAM_TYPE           (1 << 4)  /* differs from AST2400 */
    103
    104/* DRAM size definitions differs */
    105#define     ASPEED_SDMC_AST2500_128MB       0x0
    106#define     ASPEED_SDMC_AST2500_256MB       0x1
    107#define     ASPEED_SDMC_AST2500_512MB       0x2
    108#define     ASPEED_SDMC_AST2500_1024MB      0x3
    109
    110#define     ASPEED_SDMC_AST2600_256MB       0x0
    111#define     ASPEED_SDMC_AST2600_512MB       0x1
    112#define     ASPEED_SDMC_AST2600_1024MB      0x2
    113#define     ASPEED_SDMC_AST2600_2048MB      0x3
    114
    115#define ASPEED_SDMC_AST2500_READONLY_MASK                               \
    116    (ASPEED_SDMC_HW_VERSION(0xf) | ASPEED_SDMC_CACHE_INITIAL_DONE |     \
    117     ASPEED_SDMC_AST2500_RESERVED | ASPEED_SDMC_VGA_COMPAT |            \
    118     ASPEED_SDMC_VGA_APERTURE(ASPEED_SDMC_VGA_64MB))
    119
    120static uint64_t aspeed_sdmc_read(void *opaque, hwaddr addr, unsigned size)
    121{
    122    AspeedSDMCState *s = ASPEED_SDMC(opaque);
    123
    124    addr >>= 2;
    125
    126    if (addr >= ARRAY_SIZE(s->regs)) {
    127        qemu_log_mask(LOG_GUEST_ERROR,
    128                      "%s: Out-of-bounds read at offset 0x%" HWADDR_PRIx "\n",
    129                      __func__, addr * 4);
    130        return 0;
    131    }
    132
    133    return s->regs[addr];
    134}
    135
    136static void aspeed_sdmc_write(void *opaque, hwaddr addr, uint64_t data,
    137                             unsigned int size)
    138{
    139    AspeedSDMCState *s = ASPEED_SDMC(opaque);
    140    AspeedSDMCClass *asc = ASPEED_SDMC_GET_CLASS(s);
    141
    142    addr >>= 2;
    143
    144    if (addr >= ARRAY_SIZE(s->regs)) {
    145        qemu_log_mask(LOG_GUEST_ERROR,
    146                      "%s: Out-of-bounds write at offset 0x%" HWADDR_PRIx "\n",
    147                      __func__, addr);
    148        return;
    149    }
    150
    151    asc->write(s, addr, data);
    152}
    153
    154static const MemoryRegionOps aspeed_sdmc_ops = {
    155    .read = aspeed_sdmc_read,
    156    .write = aspeed_sdmc_write,
    157    .endianness = DEVICE_LITTLE_ENDIAN,
    158    .valid.min_access_size = 4,
    159    .valid.max_access_size = 4,
    160};
    161
    162static void aspeed_sdmc_reset(DeviceState *dev)
    163{
    164    AspeedSDMCState *s = ASPEED_SDMC(dev);
    165    AspeedSDMCClass *asc = ASPEED_SDMC_GET_CLASS(s);
    166
    167    memset(s->regs, 0, sizeof(s->regs));
    168
    169    /* Set ram size bit and defaults values */
    170    s->regs[R_CONF] = asc->compute_conf(s, 0);
    171
    172    /*
    173     * PHY status:
    174     *  - set phy status ok (set bit 1)
    175     *  - initial PVT calibration ok (clear bit 3)
    176     *  - runtime calibration ok (clear bit 5)
    177     */
    178    s->regs[0x100] = BIT(1);
    179
    180    /* PHY eye window: set all as passing */
    181    s->regs[0x100 | (0x68 / 4)] = 0xff;
    182    s->regs[0x100 | (0x7c / 4)] = 0xff;
    183    s->regs[0x100 | (0x50 / 4)] = 0xfffffff;
    184}
    185
    186static void aspeed_sdmc_get_ram_size(Object *obj, Visitor *v, const char *name,
    187                                     void *opaque, Error **errp)
    188{
    189    AspeedSDMCState *s = ASPEED_SDMC(obj);
    190    int64_t value = s->ram_size;
    191
    192    visit_type_int(v, name, &value, errp);
    193}
    194
    195static void aspeed_sdmc_set_ram_size(Object *obj, Visitor *v, const char *name,
    196                                     void *opaque, Error **errp)
    197{
    198    int i;
    199    char *sz;
    200    int64_t value;
    201    AspeedSDMCState *s = ASPEED_SDMC(obj);
    202    AspeedSDMCClass *asc = ASPEED_SDMC_GET_CLASS(s);
    203
    204    if (!visit_type_int(v, name, &value, errp)) {
    205        return;
    206    }
    207
    208    for (i = 0; asc->valid_ram_sizes[i]; i++) {
    209        if (value == asc->valid_ram_sizes[i]) {
    210            s->ram_size = value;
    211            return;
    212        }
    213    }
    214
    215    sz = size_to_str(value);
    216    error_setg(errp, "Invalid RAM size %s", sz);
    217    g_free(sz);
    218}
    219
    220static void aspeed_sdmc_initfn(Object *obj)
    221{
    222    object_property_add(obj, "ram-size", "int",
    223                        aspeed_sdmc_get_ram_size, aspeed_sdmc_set_ram_size,
    224                        NULL, NULL);
    225}
    226
    227static void aspeed_sdmc_realize(DeviceState *dev, Error **errp)
    228{
    229    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
    230    AspeedSDMCState *s = ASPEED_SDMC(dev);
    231    AspeedSDMCClass *asc = ASPEED_SDMC_GET_CLASS(s);
    232
    233    assert(asc->max_ram_size < 4 * GiB); /* 32-bit address bus */
    234    s->max_ram_size = asc->max_ram_size;
    235
    236    memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_sdmc_ops, s,
    237                          TYPE_ASPEED_SDMC, 0x1000);
    238    sysbus_init_mmio(sbd, &s->iomem);
    239}
    240
    241static const VMStateDescription vmstate_aspeed_sdmc = {
    242    .name = "aspeed.sdmc",
    243    .version_id = 1,
    244    .minimum_version_id = 1,
    245    .fields = (VMStateField[]) {
    246        VMSTATE_UINT32_ARRAY(regs, AspeedSDMCState, ASPEED_SDMC_NR_REGS),
    247        VMSTATE_END_OF_LIST()
    248    }
    249};
    250
    251static Property aspeed_sdmc_properties[] = {
    252    DEFINE_PROP_UINT64("max-ram-size", AspeedSDMCState, max_ram_size, 0),
    253    DEFINE_PROP_END_OF_LIST(),
    254};
    255
    256static void aspeed_sdmc_class_init(ObjectClass *klass, void *data)
    257{
    258    DeviceClass *dc = DEVICE_CLASS(klass);
    259    dc->realize = aspeed_sdmc_realize;
    260    dc->reset = aspeed_sdmc_reset;
    261    dc->desc = "ASPEED SDRAM Memory Controller";
    262    dc->vmsd = &vmstate_aspeed_sdmc;
    263    device_class_set_props(dc, aspeed_sdmc_properties);
    264}
    265
    266static const TypeInfo aspeed_sdmc_info = {
    267    .name = TYPE_ASPEED_SDMC,
    268    .parent = TYPE_SYS_BUS_DEVICE,
    269    .instance_size = sizeof(AspeedSDMCState),
    270    .instance_init = aspeed_sdmc_initfn,
    271    .class_init = aspeed_sdmc_class_init,
    272    .class_size = sizeof(AspeedSDMCClass),
    273    .abstract   = true,
    274};
    275
    276static int aspeed_sdmc_get_ram_bits(AspeedSDMCState *s)
    277{
    278    AspeedSDMCClass *asc = ASPEED_SDMC_GET_CLASS(s);
    279    int i;
    280
    281    /*
    282     * The bitfield value encoding the RAM size is the index of the
    283     * possible RAM size array
    284     */
    285    for (i = 0; asc->valid_ram_sizes[i]; i++) {
    286        if (s->ram_size == asc->valid_ram_sizes[i]) {
    287            return i;
    288        }
    289    }
    290
    291    /*
    292     * Invalid RAM sizes should have been excluded when setting the
    293     * SoC RAM size.
    294     */
    295    g_assert_not_reached();
    296}
    297
    298static uint32_t aspeed_2400_sdmc_compute_conf(AspeedSDMCState *s, uint32_t data)
    299{
    300    uint32_t fixed_conf = ASPEED_SDMC_VGA_COMPAT |
    301        ASPEED_SDMC_DRAM_SIZE(aspeed_sdmc_get_ram_bits(s));
    302
    303    /* Make sure readonly bits are kept */
    304    data &= ~ASPEED_SDMC_READONLY_MASK;
    305
    306    return data | fixed_conf;
    307}
    308
    309static void aspeed_2400_sdmc_write(AspeedSDMCState *s, uint32_t reg,
    310                                   uint32_t data)
    311{
    312    if (reg == R_PROT) {
    313        s->regs[reg] = (data == PROT_KEY_UNLOCK) ? PROT_UNLOCKED : PROT_SOFTLOCKED;
    314        return;
    315    }
    316
    317    if (!s->regs[R_PROT]) {
    318        qemu_log_mask(LOG_GUEST_ERROR, "%s: SDMC is locked!\n", __func__);
    319        return;
    320    }
    321
    322    switch (reg) {
    323    case R_CONF:
    324        data = aspeed_2400_sdmc_compute_conf(s, data);
    325        break;
    326    default:
    327        break;
    328    }
    329
    330    s->regs[reg] = data;
    331}
    332
    333static const uint64_t
    334aspeed_2400_ram_sizes[] = { 64 * MiB, 128 * MiB, 256 * MiB, 512 * MiB, 0};
    335
    336static void aspeed_2400_sdmc_class_init(ObjectClass *klass, void *data)
    337{
    338    DeviceClass *dc = DEVICE_CLASS(klass);
    339    AspeedSDMCClass *asc = ASPEED_SDMC_CLASS(klass);
    340
    341    dc->desc = "ASPEED 2400 SDRAM Memory Controller";
    342    asc->max_ram_size = 512 * MiB;
    343    asc->compute_conf = aspeed_2400_sdmc_compute_conf;
    344    asc->write = aspeed_2400_sdmc_write;
    345    asc->valid_ram_sizes = aspeed_2400_ram_sizes;
    346}
    347
    348static const TypeInfo aspeed_2400_sdmc_info = {
    349    .name = TYPE_ASPEED_2400_SDMC,
    350    .parent = TYPE_ASPEED_SDMC,
    351    .class_init = aspeed_2400_sdmc_class_init,
    352};
    353
    354static uint32_t aspeed_2500_sdmc_compute_conf(AspeedSDMCState *s, uint32_t data)
    355{
    356    uint32_t fixed_conf = ASPEED_SDMC_HW_VERSION(1) |
    357        ASPEED_SDMC_VGA_APERTURE(ASPEED_SDMC_VGA_64MB) |
    358        ASPEED_SDMC_CACHE_INITIAL_DONE |
    359        ASPEED_SDMC_DRAM_SIZE(aspeed_sdmc_get_ram_bits(s));
    360
    361    /* Make sure readonly bits are kept */
    362    data &= ~ASPEED_SDMC_AST2500_READONLY_MASK;
    363
    364    return data | fixed_conf;
    365}
    366
    367static void aspeed_2500_sdmc_write(AspeedSDMCState *s, uint32_t reg,
    368                                   uint32_t data)
    369{
    370    if (reg == R_PROT) {
    371        s->regs[reg] = (data == PROT_KEY_UNLOCK) ? PROT_UNLOCKED : PROT_SOFTLOCKED;
    372        return;
    373    }
    374
    375    if (!s->regs[R_PROT]) {
    376        qemu_log_mask(LOG_GUEST_ERROR, "%s: SDMC is locked!\n", __func__);
    377        return;
    378    }
    379
    380    switch (reg) {
    381    case R_CONF:
    382        data = aspeed_2500_sdmc_compute_conf(s, data);
    383        break;
    384    case R_STATUS1:
    385        /* Will never return 'busy' */
    386        data &= ~PHY_BUSY_STATE;
    387        break;
    388    case R_ECC_TEST_CTRL:
    389        /* Always done, always happy */
    390        data |= ECC_TEST_FINISHED;
    391        data &= ~ECC_TEST_FAIL;
    392        break;
    393    default:
    394        break;
    395    }
    396
    397    s->regs[reg] = data;
    398}
    399
    400static const uint64_t
    401aspeed_2500_ram_sizes[] = { 128 * MiB, 256 * MiB, 512 * MiB, 1024 * MiB, 0};
    402
    403static void aspeed_2500_sdmc_class_init(ObjectClass *klass, void *data)
    404{
    405    DeviceClass *dc = DEVICE_CLASS(klass);
    406    AspeedSDMCClass *asc = ASPEED_SDMC_CLASS(klass);
    407
    408    dc->desc = "ASPEED 2500 SDRAM Memory Controller";
    409    asc->max_ram_size = 1 * GiB;
    410    asc->compute_conf = aspeed_2500_sdmc_compute_conf;
    411    asc->write = aspeed_2500_sdmc_write;
    412    asc->valid_ram_sizes = aspeed_2500_ram_sizes;
    413}
    414
    415static const TypeInfo aspeed_2500_sdmc_info = {
    416    .name = TYPE_ASPEED_2500_SDMC,
    417    .parent = TYPE_ASPEED_SDMC,
    418    .class_init = aspeed_2500_sdmc_class_init,
    419};
    420
    421static uint32_t aspeed_2600_sdmc_compute_conf(AspeedSDMCState *s, uint32_t data)
    422{
    423    uint32_t fixed_conf = ASPEED_SDMC_HW_VERSION(3) |
    424        ASPEED_SDMC_VGA_APERTURE(ASPEED_SDMC_VGA_64MB) |
    425        ASPEED_SDMC_DRAM_SIZE(aspeed_sdmc_get_ram_bits(s));
    426
    427    /* Make sure readonly bits are kept (use ast2500 mask) */
    428    data &= ~ASPEED_SDMC_AST2500_READONLY_MASK;
    429
    430    return data | fixed_conf;
    431}
    432
    433static void aspeed_2600_sdmc_write(AspeedSDMCState *s, uint32_t reg,
    434                                   uint32_t data)
    435{
    436    /* Unprotected registers */
    437    switch (reg) {
    438    case R_ISR:
    439    case R_MCR6C:
    440    case R_TEST_START_LEN:
    441    case R_TEST_FAIL_DQ:
    442    case R_TEST_INIT_VAL:
    443    case R_DRAM_SW:
    444    case R_DRAM_TIME:
    445    case R_ECC_ERR_INJECT:
    446        s->regs[reg] = data;
    447        return;
    448    }
    449
    450    if (s->regs[R_PROT] == PROT_HARDLOCKED) {
    451        qemu_log_mask(LOG_GUEST_ERROR, "%s: SDMC is locked until system reset!\n",
    452                __func__);
    453        return;
    454    }
    455
    456    if (reg != R_PROT && s->regs[R_PROT] == PROT_SOFTLOCKED) {
    457        qemu_log_mask(LOG_GUEST_ERROR,
    458                      "%s: SDMC is locked! (write to MCR%02x blocked)\n",
    459                      __func__, reg * 4);
    460        return;
    461    }
    462
    463    switch (reg) {
    464    case R_PROT:
    465        if (data == PROT_KEY_UNLOCK)  {
    466            data = PROT_UNLOCKED;
    467        } else if (data == PROT_KEY_HARDLOCK) {
    468            data = PROT_HARDLOCKED;
    469        } else {
    470            data = PROT_SOFTLOCKED;
    471        }
    472        break;
    473    case R_CONF:
    474        data = aspeed_2600_sdmc_compute_conf(s, data);
    475        break;
    476    case R_STATUS1:
    477        /* Will never return 'busy'. 'lock status' is always set */
    478        data &= ~PHY_BUSY_STATE;
    479        data |= PHY_PLL_LOCK_STATUS;
    480        break;
    481    case R_ECC_TEST_CTRL:
    482        /* Always done, always happy */
    483        data |= ECC_TEST_FINISHED;
    484        data &= ~ECC_TEST_FAIL;
    485        break;
    486    default:
    487        break;
    488    }
    489
    490    s->regs[reg] = data;
    491}
    492
    493static const uint64_t
    494aspeed_2600_ram_sizes[] = { 256 * MiB, 512 * MiB, 1024 * MiB, 2048 * MiB, 0};
    495
    496static void aspeed_2600_sdmc_class_init(ObjectClass *klass, void *data)
    497{
    498    DeviceClass *dc = DEVICE_CLASS(klass);
    499    AspeedSDMCClass *asc = ASPEED_SDMC_CLASS(klass);
    500
    501    dc->desc = "ASPEED 2600 SDRAM Memory Controller";
    502    asc->max_ram_size = 2 * GiB;
    503    asc->compute_conf = aspeed_2600_sdmc_compute_conf;
    504    asc->write = aspeed_2600_sdmc_write;
    505    asc->valid_ram_sizes = aspeed_2600_ram_sizes;
    506}
    507
    508static const TypeInfo aspeed_2600_sdmc_info = {
    509    .name = TYPE_ASPEED_2600_SDMC,
    510    .parent = TYPE_ASPEED_SDMC,
    511    .class_init = aspeed_2600_sdmc_class_init,
    512};
    513
    514static void aspeed_sdmc_register_types(void)
    515{
    516    type_register_static(&aspeed_sdmc_info);
    517    type_register_static(&aspeed_2400_sdmc_info);
    518    type_register_static(&aspeed_2500_sdmc_info);
    519    type_register_static(&aspeed_2600_sdmc_info);
    520}
    521
    522type_init(aspeed_sdmc_register_types);