cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

xilinx_spi.c (9871B)


      1/*
      2 * QEMU model of the Xilinx SPI Controller
      3 *
      4 * Copyright (C) 2010 Edgar E. Iglesias.
      5 * Copyright (C) 2012 Peter A. G. Crosthwaite <peter.crosthwaite@petalogix.com>
      6 * Copyright (C) 2012 PetaLogix
      7 *
      8 * Permission is hereby granted, free of charge, to any person obtaining a copy
      9 * of this software and associated documentation files (the "Software"), to deal
     10 * in the Software without restriction, including without limitation the rights
     11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     12 * copies of the Software, and to permit persons to whom the Software is
     13 * furnished to do so, subject to the following conditions:
     14 *
     15 * The above copyright notice and this permission notice shall be included in
     16 * all copies or substantial portions of the Software.
     17 *
     18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     24 * THE SOFTWARE.
     25 */
     26
     27#include "qemu/osdep.h"
     28#include "hw/sysbus.h"
     29#include "migration/vmstate.h"
     30#include "qemu/module.h"
     31#include "qemu/fifo8.h"
     32
     33#include "hw/irq.h"
     34#include "hw/qdev-properties.h"
     35#include "hw/ssi/ssi.h"
     36#include "qom/object.h"
     37
     38#ifdef XILINX_SPI_ERR_DEBUG
     39#define DB_PRINT(...) do { \
     40    fprintf(stderr,  ": %s: ", __func__); \
     41    fprintf(stderr, ## __VA_ARGS__); \
     42    } while (0)
     43#else
     44    #define DB_PRINT(...)
     45#endif
     46
     47#define R_DGIER     (0x1c / 4)
     48#define R_DGIER_IE  (1 << 31)
     49
     50#define R_IPISR     (0x20 / 4)
     51#define IRQ_DRR_NOT_EMPTY    (1 << (31 - 23))
     52#define IRQ_DRR_OVERRUN      (1 << (31 - 26))
     53#define IRQ_DRR_FULL         (1 << (31 - 27))
     54#define IRQ_TX_FF_HALF_EMPTY (1 << 6)
     55#define IRQ_DTR_UNDERRUN     (1 << 3)
     56#define IRQ_DTR_EMPTY        (1 << (31 - 29))
     57
     58#define R_IPIER     (0x28 / 4)
     59#define R_SRR       (0x40 / 4)
     60#define R_SPICR     (0x60 / 4)
     61#define R_SPICR_TXFF_RST     (1 << 5)
     62#define R_SPICR_RXFF_RST     (1 << 6)
     63#define R_SPICR_MTI          (1 << 8)
     64
     65#define R_SPISR     (0x64 / 4)
     66#define SR_TX_FULL    (1 << 3)
     67#define SR_TX_EMPTY   (1 << 2)
     68#define SR_RX_FULL    (1 << 1)
     69#define SR_RX_EMPTY   (1 << 0)
     70
     71#define R_SPIDTR    (0x68 / 4)
     72#define R_SPIDRR    (0x6C / 4)
     73#define R_SPISSR    (0x70 / 4)
     74#define R_TX_FF_OCY (0x74 / 4)
     75#define R_RX_FF_OCY (0x78 / 4)
     76#define R_MAX       (0x7C / 4)
     77
     78#define FIFO_CAPACITY 256
     79
     80#define TYPE_XILINX_SPI "xlnx.xps-spi"
     81OBJECT_DECLARE_SIMPLE_TYPE(XilinxSPI, XILINX_SPI)
     82
     83struct XilinxSPI {
     84    SysBusDevice parent_obj;
     85
     86    MemoryRegion mmio;
     87
     88    qemu_irq irq;
     89    int irqline;
     90
     91    uint8_t num_cs;
     92    qemu_irq *cs_lines;
     93
     94    SSIBus *spi;
     95
     96    Fifo8 rx_fifo;
     97    Fifo8 tx_fifo;
     98
     99    uint32_t regs[R_MAX];
    100};
    101
    102static void txfifo_reset(XilinxSPI *s)
    103{
    104    fifo8_reset(&s->tx_fifo);
    105
    106    s->regs[R_SPISR] &= ~SR_TX_FULL;
    107    s->regs[R_SPISR] |= SR_TX_EMPTY;
    108}
    109
    110static void rxfifo_reset(XilinxSPI *s)
    111{
    112    fifo8_reset(&s->rx_fifo);
    113
    114    s->regs[R_SPISR] |= SR_RX_EMPTY;
    115    s->regs[R_SPISR] &= ~SR_RX_FULL;
    116}
    117
    118static void xlx_spi_update_cs(XilinxSPI *s)
    119{
    120    int i;
    121
    122    for (i = 0; i < s->num_cs; ++i) {
    123        qemu_set_irq(s->cs_lines[i], !(~s->regs[R_SPISSR] & 1 << i));
    124    }
    125}
    126
    127static void xlx_spi_update_irq(XilinxSPI *s)
    128{
    129    uint32_t pending;
    130
    131    s->regs[R_IPISR] |=
    132            (!fifo8_is_empty(&s->rx_fifo) ? IRQ_DRR_NOT_EMPTY : 0) |
    133            (fifo8_is_full(&s->rx_fifo) ? IRQ_DRR_FULL : 0);
    134
    135    pending = s->regs[R_IPISR] & s->regs[R_IPIER];
    136
    137    pending = pending && (s->regs[R_DGIER] & R_DGIER_IE);
    138    pending = !!pending;
    139
    140    /* This call lies right in the data paths so don't call the
    141       irq chain unless things really changed.  */
    142    if (pending != s->irqline) {
    143        s->irqline = pending;
    144        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
    145                    pending, s->regs[R_IPISR], s->regs[R_IPIER]);
    146        qemu_set_irq(s->irq, pending);
    147    }
    148
    149}
    150
    151static void xlx_spi_do_reset(XilinxSPI *s)
    152{
    153    memset(s->regs, 0, sizeof s->regs);
    154
    155    rxfifo_reset(s);
    156    txfifo_reset(s);
    157
    158    s->regs[R_SPISSR] = ~0;
    159    xlx_spi_update_irq(s);
    160    xlx_spi_update_cs(s);
    161}
    162
    163static void xlx_spi_reset(DeviceState *d)
    164{
    165    xlx_spi_do_reset(XILINX_SPI(d));
    166}
    167
    168static inline int spi_master_enabled(XilinxSPI *s)
    169{
    170    return !(s->regs[R_SPICR] & R_SPICR_MTI);
    171}
    172
    173static void spi_flush_txfifo(XilinxSPI *s)
    174{
    175    uint32_t tx;
    176    uint32_t rx;
    177
    178    while (!fifo8_is_empty(&s->tx_fifo)) {
    179        tx = (uint32_t)fifo8_pop(&s->tx_fifo);
    180        DB_PRINT("data tx:%x\n", tx);
    181        rx = ssi_transfer(s->spi, tx);
    182        DB_PRINT("data rx:%x\n", rx);
    183        if (fifo8_is_full(&s->rx_fifo)) {
    184            s->regs[R_IPISR] |= IRQ_DRR_OVERRUN;
    185        } else {
    186            fifo8_push(&s->rx_fifo, (uint8_t)rx);
    187            if (fifo8_is_full(&s->rx_fifo)) {
    188                s->regs[R_SPISR] |= SR_RX_FULL;
    189                s->regs[R_IPISR] |= IRQ_DRR_FULL;
    190            }
    191        }
    192
    193        s->regs[R_SPISR] &= ~SR_RX_EMPTY;
    194        s->regs[R_SPISR] &= ~SR_TX_FULL;
    195        s->regs[R_SPISR] |= SR_TX_EMPTY;
    196
    197        s->regs[R_IPISR] |= IRQ_DTR_EMPTY;
    198        s->regs[R_IPISR] |= IRQ_DRR_NOT_EMPTY;
    199    }
    200
    201}
    202
    203static uint64_t
    204spi_read(void *opaque, hwaddr addr, unsigned int size)
    205{
    206    XilinxSPI *s = opaque;
    207    uint32_t r = 0;
    208
    209    addr >>= 2;
    210    switch (addr) {
    211    case R_SPIDRR:
    212        if (fifo8_is_empty(&s->rx_fifo)) {
    213            DB_PRINT("Read from empty FIFO!\n");
    214            return 0xdeadbeef;
    215        }
    216
    217        s->regs[R_SPISR] &= ~SR_RX_FULL;
    218        r = fifo8_pop(&s->rx_fifo);
    219        if (fifo8_is_empty(&s->rx_fifo)) {
    220            s->regs[R_SPISR] |= SR_RX_EMPTY;
    221        }
    222        break;
    223
    224    case R_SPISR:
    225        r = s->regs[addr];
    226        break;
    227
    228    default:
    229        if (addr < ARRAY_SIZE(s->regs)) {
    230            r = s->regs[addr];
    231        }
    232        break;
    233
    234    }
    235    DB_PRINT("addr=" TARGET_FMT_plx " = %x\n", addr * 4, r);
    236    xlx_spi_update_irq(s);
    237    return r;
    238}
    239
    240static void
    241spi_write(void *opaque, hwaddr addr,
    242            uint64_t val64, unsigned int size)
    243{
    244    XilinxSPI *s = opaque;
    245    uint32_t value = val64;
    246
    247    DB_PRINT("addr=" TARGET_FMT_plx " = %x\n", addr, value);
    248    addr >>= 2;
    249    switch (addr) {
    250    case R_SRR:
    251        if (value != 0xa) {
    252            DB_PRINT("Invalid write to SRR %x\n", value);
    253        } else {
    254            xlx_spi_do_reset(s);
    255        }
    256        break;
    257
    258    case R_SPIDTR:
    259        s->regs[R_SPISR] &= ~SR_TX_EMPTY;
    260        fifo8_push(&s->tx_fifo, (uint8_t)value);
    261        if (fifo8_is_full(&s->tx_fifo)) {
    262            s->regs[R_SPISR] |= SR_TX_FULL;
    263        }
    264        if (!spi_master_enabled(s)) {
    265            goto done;
    266        } else {
    267            DB_PRINT("DTR and master enabled\n");
    268        }
    269        spi_flush_txfifo(s);
    270        break;
    271
    272    case R_SPISR:
    273        DB_PRINT("Invalid write to SPISR %x\n", value);
    274        break;
    275
    276    case R_IPISR:
    277        /* Toggle the bits.  */
    278        s->regs[addr] ^= value;
    279        break;
    280
    281    /* Slave Select Register.  */
    282    case R_SPISSR:
    283        s->regs[addr] = value;
    284        xlx_spi_update_cs(s);
    285        break;
    286
    287    case R_SPICR:
    288        /* FIXME: reset irq and sr state to empty queues.  */
    289        if (value & R_SPICR_RXFF_RST) {
    290            rxfifo_reset(s);
    291        }
    292
    293        if (value & R_SPICR_TXFF_RST) {
    294            txfifo_reset(s);
    295        }
    296        value &= ~(R_SPICR_RXFF_RST | R_SPICR_TXFF_RST);
    297        s->regs[addr] = value;
    298
    299        if (!(value & R_SPICR_MTI)) {
    300            spi_flush_txfifo(s);
    301        }
    302        break;
    303
    304    default:
    305        if (addr < ARRAY_SIZE(s->regs)) {
    306            s->regs[addr] = value;
    307        }
    308        break;
    309    }
    310
    311done:
    312    xlx_spi_update_irq(s);
    313}
    314
    315static const MemoryRegionOps spi_ops = {
    316    .read = spi_read,
    317    .write = spi_write,
    318    .endianness = DEVICE_NATIVE_ENDIAN,
    319    .valid = {
    320        .min_access_size = 4,
    321        .max_access_size = 4
    322    }
    323};
    324
    325static void xilinx_spi_realize(DeviceState *dev, Error **errp)
    326{
    327    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
    328    XilinxSPI *s = XILINX_SPI(dev);
    329    int i;
    330
    331    DB_PRINT("\n");
    332
    333    s->spi = ssi_create_bus(dev, "spi");
    334
    335    sysbus_init_irq(sbd, &s->irq);
    336    s->cs_lines = g_new0(qemu_irq, s->num_cs);
    337    for (i = 0; i < s->num_cs; ++i) {
    338        sysbus_init_irq(sbd, &s->cs_lines[i]);
    339    }
    340
    341    memory_region_init_io(&s->mmio, OBJECT(s), &spi_ops, s,
    342                          "xilinx-spi", R_MAX * 4);
    343    sysbus_init_mmio(sbd, &s->mmio);
    344
    345    s->irqline = -1;
    346
    347    fifo8_create(&s->tx_fifo, FIFO_CAPACITY);
    348    fifo8_create(&s->rx_fifo, FIFO_CAPACITY);
    349}
    350
    351static const VMStateDescription vmstate_xilinx_spi = {
    352    .name = "xilinx_spi",
    353    .version_id = 1,
    354    .minimum_version_id = 1,
    355    .fields = (VMStateField[]) {
    356        VMSTATE_FIFO8(tx_fifo, XilinxSPI),
    357        VMSTATE_FIFO8(rx_fifo, XilinxSPI),
    358        VMSTATE_UINT32_ARRAY(regs, XilinxSPI, R_MAX),
    359        VMSTATE_END_OF_LIST()
    360    }
    361};
    362
    363static Property xilinx_spi_properties[] = {
    364    DEFINE_PROP_UINT8("num-ss-bits", XilinxSPI, num_cs, 1),
    365    DEFINE_PROP_END_OF_LIST(),
    366};
    367
    368static void xilinx_spi_class_init(ObjectClass *klass, void *data)
    369{
    370    DeviceClass *dc = DEVICE_CLASS(klass);
    371
    372    dc->realize = xilinx_spi_realize;
    373    dc->reset = xlx_spi_reset;
    374    device_class_set_props(dc, xilinx_spi_properties);
    375    dc->vmsd = &vmstate_xilinx_spi;
    376}
    377
    378static const TypeInfo xilinx_spi_info = {
    379    .name           = TYPE_XILINX_SPI,
    380    .parent         = TYPE_SYS_BUS_DEVICE,
    381    .instance_size  = sizeof(XilinxSPI),
    382    .class_init     = xilinx_spi_class_init,
    383};
    384
    385static void xilinx_spi_register_types(void)
    386{
    387    type_register_static(&xilinx_spi_info);
    388}
    389
    390type_init(xilinx_spi_register_types)