| 1 | /* |
| 2 | * QEMU PowerPC SPI model |
| 3 | * |
| 4 | * Copyright (c) 2024, IBM Corporation. |
| 5 | * |
| 6 | * SPDX-License-Identifier: GPL-2.0-or-later |
| 7 | */ |
| 8 | |
| 9 | #include "qemu/osdep.h" |
| 10 | #include "qemu/log.h" |
| 11 | #include "hw/core/qdev-properties.h" |
| 12 | #include "hw/ppc/pnv_xscom.h" |
| 13 | #include "hw/ssi/pnv_spi.h" |
| 14 | #include "hw/ssi/pnv_spi_regs.h" |
| 15 | #include "hw/ssi/ssi.h" |
| 16 | #include "migration/vmstate.h" |
| 17 | #include <libfdt.h> |
| 18 | #include "hw/core/irq.h" |
| 19 | #include "trace.h" |
| 20 | |
| 21 | #define PNV_SPI_OPCODE_LO_NIBBLE(x) (x & 0x0F) |
| 22 | #define PNV_SPI_MASKED_OPCODE(x) (x & 0xF0) |
| 23 | #define PNV_SPI_FIFO_SIZE 16 |
| 24 | #define RDR_MATCH_FAILURE_LIMIT 16 |
| 25 | |
| 26 | /* |
| 27 | * Macro from include/hw/ppc/fdt.h |
| 28 | * fdt.h cannot be included here as it contain ppc target specific dependency. |
| 29 | */ |
| 30 | #define _FDT(exp) \ |
| 31 | do { \ |
| 32 | int _ret = (exp); \ |
| 33 | if (_ret < 0) { \ |
| 34 | qemu_log_mask(LOG_GUEST_ERROR, \ |
| 35 | "error creating device tree: %s: %s", \ |
| 36 | #exp, fdt_strerror(_ret)); \ |
| 37 | exit(1); \ |
| 38 | } \ |
| 39 | } while (0) |
| 40 | |
| 41 | static bool does_rdr_match(PnvSpi *s) |
| 42 | { |
| 43 | /* |
| 44 | * According to spec, the mask bits that are 0 are compared and the |
| 45 | * bits that are 1 are ignored. |
| 46 | */ |
| 47 | uint16_t rdr_match_mask = GETFIELD(SPI_MM_RDR_MATCH_MASK, s->regs[SPI_MM_REG]); |
| 48 | uint16_t rdr_match_val = GETFIELD(SPI_MM_RDR_MATCH_VAL, s->regs[SPI_MM_REG]); |
| 49 | |
| 50 | if ((~rdr_match_mask & rdr_match_val) == ((~rdr_match_mask) & |
| 51 | GETFIELD(PPC_BITMASK(48, 63), s->regs[SPI_RCV_DATA_REG]))) { |
| 52 | return true; |
| 53 | } |
| 54 | return false; |
| 55 | } |
| 56 | |
| 57 | static uint8_t get_from_offset(PnvSpi *s, uint8_t offset) |
| 58 | { |
| 59 | uint8_t byte; |
| 60 | |
| 61 | /* |
| 62 | * Offset is an index between 0 and PNV_SPI_REG_SIZE - 1 |
| 63 | * Check the offset before using it. |
| 64 | */ |
| 65 | if (offset < PNV_SPI_REG_SIZE) { |
| 66 | byte = (s->regs[SPI_XMIT_DATA_REG] >> (56 - offset * 8)) & 0xFF; |
| 67 | } else { |
| 68 | /* |
| 69 | * Log an error and return a 0xFF since we have to assign something |
| 70 | * to byte before returning. |
| 71 | */ |
| 72 | qemu_log_mask(LOG_GUEST_ERROR, "Invalid offset = %d used to get byte " |
| 73 | "from TDR\n", offset); |
| 74 | byte = 0xff; |
| 75 | } |
| 76 | return byte; |
| 77 | } |
| 78 | |
| 79 | static uint8_t read_from_frame(PnvSpi *s, uint8_t nr_bytes, uint8_t ecc_count, |
| 80 | uint8_t shift_in_count) |
| 81 | { |
| 82 | uint8_t byte; |
| 83 | int count = 0; |
| 84 | |
| 85 | while (count < nr_bytes) { |
| 86 | shift_in_count++; |
| 87 | if ((ecc_count != 0) && |
| 88 | (shift_in_count == (PNV_SPI_REG_SIZE + ecc_count))) { |
| 89 | shift_in_count = 0; |
| 90 | } else if (!fifo8_is_empty(&s->rx_fifo)) { |
| 91 | byte = fifo8_pop(&s->rx_fifo); |
| 92 | trace_pnv_spi_shift_rx(byte, count); |
| 93 | s->regs[SPI_RCV_DATA_REG] = (s->regs[SPI_RCV_DATA_REG] << 8) | byte; |
| 94 | } else { |
| 95 | qemu_log_mask(LOG_GUEST_ERROR, "pnv_spi: Reading empty RX_FIFO\n"); |
| 96 | } |
| 97 | count++; |
| 98 | } /* end of while */ |
| 99 | return shift_in_count; |
| 100 | } |
| 101 | |
| 102 | static void spi_response(PnvSpi *s) |
| 103 | { |
| 104 | uint8_t ecc_count; |
| 105 | uint8_t shift_in_count; |
| 106 | uint32_t rx_len; |
| 107 | int i; |
| 108 | |
| 109 | /* |
| 110 | * Processing here must handle: |
| 111 | * - Which bytes in the payload we should move to the RDR |
| 112 | * - Explicit mode counter configuration settings |
| 113 | * - RDR full and RDR overrun status |
| 114 | */ |
| 115 | |
| 116 | /* |
| 117 | * First check that the response payload is the exact same |
| 118 | * number of bytes as the request payload was |
| 119 | */ |
| 120 | rx_len = fifo8_num_used(&s->rx_fifo); |
| 121 | if (rx_len != (s->N1_bytes + s->N2_bytes)) { |
| 122 | qemu_log_mask(LOG_GUEST_ERROR, "Invalid response payload size in " |
| 123 | "bytes, expected %d, got %d\n", |
| 124 | (s->N1_bytes + s->N2_bytes), rx_len); |
| 125 | } else { |
| 126 | uint8_t ecc_control; |
| 127 | trace_pnv_spi_rx_received(rx_len); |
| 128 | trace_pnv_spi_log_Ncounts(s->N1_bits, s->N1_bytes, s->N1_tx, |
| 129 | s->N1_rx, s->N2_bits, s->N2_bytes, s->N2_tx, s->N2_rx); |
| 130 | /* |
| 131 | * Adding an ECC count let's us know when we have found a payload byte |
| 132 | * that was shifted in but cannot be loaded into RDR. Bits 29-30 of |
| 133 | * clock_config_reset_control register equal to either 0b00 or 0b10 |
| 134 | * indicate that we are taking in data with ECC and either applying |
| 135 | * the ECC or discarding it. |
| 136 | */ |
| 137 | ecc_count = 0; |
| 138 | ecc_control = GETFIELD(SPI_CLK_CFG_ECC_CTRL, s->regs[SPI_CLK_CFG_REG]); |
| 139 | if (ecc_control == 0 || ecc_control == 2) { |
| 140 | ecc_count = 1; |
| 141 | } |
| 142 | /* |
| 143 | * Use the N1_rx and N2_rx counts to control shifting data from the |
| 144 | * payload into the RDR. Keep an overall count of the number of bytes |
| 145 | * shifted into RDR so we can discard every 9th byte when ECC is |
| 146 | * enabled. |
| 147 | */ |
| 148 | shift_in_count = 0; |
| 149 | /* Handle the N1 portion of the frame first */ |
| 150 | if (s->N1_rx != 0) { |
| 151 | trace_pnv_spi_rx_read_N1frame(); |
| 152 | shift_in_count = read_from_frame(s, s->N1_bytes, ecc_count, shift_in_count); |
| 153 | } |
| 154 | /* Handle the N2 portion of the frame */ |
| 155 | if (s->N2_rx != 0) { |
| 156 | /* pop out N1_bytes from rx_fifo if not already */ |
| 157 | if (s->N1_rx == 0) { |
| 158 | for (i = 0; i < s->N1_bytes; i++) { |
| 159 | if (!fifo8_is_empty(&s->rx_fifo)) { |
| 160 | fifo8_pop(&s->rx_fifo); |
| 161 | } else { |
| 162 | qemu_log_mask(LOG_GUEST_ERROR, "pnv_spi: Reading empty" |
| 163 | " RX_FIFO\n"); |
| 164 | } |
| 165 | } |
| 166 | } |
| 167 | trace_pnv_spi_rx_read_N2frame(); |
| 168 | shift_in_count = read_from_frame(s, s->N2_bytes, ecc_count, shift_in_count); |
| 169 | } |
| 170 | if ((s->N1_rx + s->N2_rx) > 0) { |
| 171 | /* |
| 172 | * Data was received so handle RDR status. |
| 173 | * It is easier to handle RDR_full and RDR_overrun status here |
| 174 | * since the RDR register's shift_byte_in method is called |
| 175 | * multiple times in a row. Controlling RDR status is done here |
| 176 | * instead of in the RDR scoped methods for that reason. |
| 177 | */ |
| 178 | if (GETFIELD(SPI_STS_RDR_FULL, s->status) == 1) { |
| 179 | /* |
| 180 | * Data was shifted into the RDR before having been read |
| 181 | * causing previous data to have been overrun. |
| 182 | */ |
| 183 | s->status = SETFIELD(SPI_STS_RDR_OVERRUN, s->status, 1); |
| 184 | } else { |
| 185 | /* |
| 186 | * Set status to indicate that the received data register is |
| 187 | * full. This flag is only cleared once the RDR is unloaded. |
| 188 | */ |
| 189 | s->status = SETFIELD(SPI_STS_RDR_FULL, s->status, 1); |
| 190 | } |
| 191 | } |
| 192 | } /* end of else */ |
| 193 | } /* end of spi_response() */ |
| 194 | |
| 195 | static void transfer(PnvSpi *s) |
| 196 | { |
| 197 | uint32_t tx, rx, payload_len; |
| 198 | uint8_t rx_byte; |
| 199 | |
| 200 | payload_len = fifo8_num_used(&s->tx_fifo); |
| 201 | for (int offset = 0; offset < payload_len; offset += s->transfer_len) { |
| 202 | tx = 0; |
| 203 | for (int i = 0; i < s->transfer_len; i++) { |
| 204 | if ((offset + i) >= payload_len) { |
| 205 | tx <<= 8; |
| 206 | } else if (!fifo8_is_empty(&s->tx_fifo)) { |
| 207 | tx = (tx << 8) | fifo8_pop(&s->tx_fifo); |
| 208 | } else { |
| 209 | qemu_log_mask(LOG_GUEST_ERROR, "pnv_spi: TX_FIFO underflow\n"); |
| 210 | } |
| 211 | } |
| 212 | rx = ssi_transfer(s->ssi_bus, tx); |
| 213 | for (int i = 0; i < s->transfer_len; i++) { |
| 214 | if ((offset + i) >= payload_len) { |
| 215 | break; |
| 216 | } |
| 217 | rx_byte = (rx >> (8 * (s->transfer_len - 1) - i * 8)) & 0xFF; |
| 218 | if (!fifo8_is_full(&s->rx_fifo)) { |
| 219 | fifo8_push(&s->rx_fifo, rx_byte); |
| 220 | } else { |
| 221 | qemu_log_mask(LOG_GUEST_ERROR, "pnv_spi: RX_FIFO is full\n"); |
| 222 | break; |
| 223 | } |
| 224 | } |
| 225 | } |
| 226 | spi_response(s); |
| 227 | /* Reset fifo for next frame */ |
| 228 | fifo8_reset(&s->tx_fifo); |
| 229 | fifo8_reset(&s->rx_fifo); |
| 230 | } |
| 231 | |
| 232 | /* |
| 233 | * Calculate the N1 counters based on passed in opcode and |
| 234 | * internal register values. |
| 235 | * The method assumes that the opcode is a Shift_N1 opcode |
| 236 | * and doesn't test it. |
| 237 | * The counters returned are: |
| 238 | * N1 bits: Number of bits in the payload data that are significant |
| 239 | * to the responder. |
| 240 | * N1_bytes: Total count of payload bytes for the N1 (portion of the) frame. |
| 241 | * N1_tx: Total number of bytes taken from TDR for N1 |
| 242 | * N1_rx: Total number of bytes taken from the payload for N1 |
| 243 | */ |
| 244 | static void calculate_N1(PnvSpi *s, uint8_t opcode) |
| 245 | { |
| 246 | /* |
| 247 | * Shift_N1 opcode form: 0x3M |
| 248 | * Implicit mode: |
| 249 | * If M != 0 the shift count is M bytes and M is the number of tx bytes. |
| 250 | * Forced Implicit mode: |
| 251 | * M is the shift count but tx and rx is determined by the count control |
| 252 | * register fields. Note that we only check for forced Implicit mode when |
| 253 | * M != 0 since the mode doesn't make sense when M = 0. |
| 254 | * Explicit mode: |
| 255 | * If M == 0 then shift count is number of bits defined in the |
| 256 | * Counter Configuration Register's shift_count_N1 field. |
| 257 | */ |
| 258 | if (PNV_SPI_OPCODE_LO_NIBBLE(opcode) == 0) { |
| 259 | /* Explicit mode */ |
| 260 | s->N1_bits = GETFIELD(SPI_CTR_CFG_N1, s->regs[SPI_CTR_CFG_REG]); |
| 261 | s->N1_bytes = (s->N1_bits + 7) / 8; |
| 262 | s->N1_tx = 0; |
| 263 | s->N1_rx = 0; |
| 264 | /* If tx count control for N1 is set, load the tx value */ |
| 265 | if (GETFIELD(SPI_CTR_CFG_N1_CTRL_B2, s->regs[SPI_CTR_CFG_REG]) == 1) { |
| 266 | s->N1_tx = s->N1_bytes; |
| 267 | } |
| 268 | /* If rx count control for N1 is set, load the rx value */ |
| 269 | if (GETFIELD(SPI_CTR_CFG_N1_CTRL_B3, s->regs[SPI_CTR_CFG_REG]) == 1) { |
| 270 | s->N1_rx = s->N1_bytes; |
| 271 | } |
| 272 | } else { |
| 273 | /* Implicit mode/Forced Implicit mode, use M field from opcode */ |
| 274 | s->N1_bytes = PNV_SPI_OPCODE_LO_NIBBLE(opcode); |
| 275 | s->N1_bits = s->N1_bytes * 8; |
| 276 | /* |
| 277 | * Assume that we are going to transmit the count |
| 278 | * (pure Implicit only) |
| 279 | */ |
| 280 | s->N1_tx = s->N1_bytes; |
| 281 | s->N1_rx = 0; |
| 282 | /* Let Forced Implicit mode have an effect on the counts */ |
| 283 | if (GETFIELD(SPI_CTR_CFG_N1_CTRL_B1, s->regs[SPI_CTR_CFG_REG]) == 1) { |
| 284 | /* |
| 285 | * If Forced Implicit mode and count control doesn't |
| 286 | * indicate transmit then reset the tx count to 0 |
| 287 | */ |
| 288 | if (GETFIELD(SPI_CTR_CFG_N1_CTRL_B2, s->regs[SPI_CTR_CFG_REG]) == 0) { |
| 289 | s->N1_tx = 0; |
| 290 | } |
| 291 | /* If rx count control for N1 is set, load the rx value */ |
| 292 | if (GETFIELD(SPI_CTR_CFG_N1_CTRL_B3, s->regs[SPI_CTR_CFG_REG]) == 1) { |
| 293 | s->N1_rx = s->N1_bytes; |
| 294 | } |
| 295 | } |
| 296 | } |
| 297 | /* |
| 298 | * Enforce an upper limit on the size of N1 that is equal to the known size |
| 299 | * of the shift register, 64 bits or 72 bits if ECC is enabled. |
| 300 | * If the size exceeds 72 bits it is a user error so log an error, |
| 301 | * cap the size at a max of 64 bits or 72 bits and set the sequencer FSM |
| 302 | * error bit. |
| 303 | */ |
| 304 | uint8_t ecc_control = GETFIELD(SPI_CLK_CFG_ECC_CTRL, s->regs[SPI_CLK_CFG_REG]); |
| 305 | if (ecc_control == 0 || ecc_control == 2) { |
| 306 | if (s->N1_bytes > (PNV_SPI_REG_SIZE + 1)) { |
| 307 | qemu_log_mask(LOG_GUEST_ERROR, "Unsupported N1 shift size when " |
| 308 | "ECC enabled, bytes = 0x%x, bits = 0x%x\n", |
| 309 | s->N1_bytes, s->N1_bits); |
| 310 | s->N1_bytes = PNV_SPI_REG_SIZE + 1; |
| 311 | s->N1_bits = s->N1_bytes * 8; |
| 312 | } |
| 313 | } else if (s->N1_bytes > PNV_SPI_REG_SIZE) { |
| 314 | qemu_log_mask(LOG_GUEST_ERROR, "Unsupported N1 shift size, " |
| 315 | "bytes = 0x%x, bits = 0x%x\n", s->N1_bytes, s->N1_bits); |
| 316 | s->N1_bytes = PNV_SPI_REG_SIZE; |
| 317 | s->N1_bits = s->N1_bytes * 8; |
| 318 | } |
| 319 | } /* end of calculate_N1 */ |
| 320 | |
| 321 | /* |
| 322 | * Shift_N1 operation handler method |
| 323 | */ |
| 324 | static bool operation_shiftn1(PnvSpi *s, uint8_t opcode, bool send_n1_alone) |
| 325 | { |
| 326 | uint8_t n1_count; |
| 327 | bool stop = false; |
| 328 | /* |
| 329 | * Use a combination of N1 counters to build the N1 portion of the |
| 330 | * transmit payload. |
| 331 | * We only care about transmit at this time since the request payload |
| 332 | * only represents data going out on the controller output line. |
| 333 | * Leave mode specific considerations in the calculate function since |
| 334 | * all we really care about are counters that tell use exactly how |
| 335 | * many bytes are in the payload and how many of those bytes to |
| 336 | * include from the TDR into the payload. |
| 337 | */ |
| 338 | calculate_N1(s, opcode); |
| 339 | trace_pnv_spi_log_Ncounts(s->N1_bits, s->N1_bytes, s->N1_tx, |
| 340 | s->N1_rx, s->N2_bits, s->N2_bytes, s->N2_tx, s->N2_rx); |
| 341 | /* |
| 342 | * Zero out the N2 counters here in case there is no N2 operation following |
| 343 | * the N1 operation in the sequencer. This keeps leftover N2 information |
| 344 | * from interfering with spi_response logic. |
| 345 | */ |
| 346 | s->N2_bits = 0; |
| 347 | s->N2_bytes = 0; |
| 348 | s->N2_tx = 0; |
| 349 | s->N2_rx = 0; |
| 350 | /* |
| 351 | * N1_bytes is the overall size of the N1 portion of the frame regardless of |
| 352 | * whether N1 is used for tx, rx or both. Loop over the size to build a |
| 353 | * payload that is N1_bytes long. |
| 354 | * N1_tx is the count of bytes to take from the TDR and "shift" into the |
| 355 | * frame which means append those bytes to the payload for the N1 portion |
| 356 | * of the frame. |
| 357 | * If N1_tx is 0 or if the count exceeds the size of the TDR append 0xFF to |
| 358 | * the frame until the overall N1 count is reached. |
| 359 | */ |
| 360 | n1_count = 0; |
| 361 | while (n1_count < s->N1_bytes) { |
| 362 | /* |
| 363 | * Assuming that if N1_tx is not equal to 0 then it is the same as |
| 364 | * N1_bytes. |
| 365 | */ |
| 366 | if ((s->N1_tx != 0) && (n1_count < PNV_SPI_REG_SIZE)) { |
| 367 | |
| 368 | if (GETFIELD(SPI_STS_TDR_FULL, s->status) == 1) { |
| 369 | /* |
| 370 | * Note that we are only appending to the payload IF the TDR |
| 371 | * is full otherwise we don't touch the payload because we are |
| 372 | * going to NOT send the payload and instead tell the sequencer |
| 373 | * that called us to stop and wait for a TDR write so we have |
| 374 | * data to load into the payload. |
| 375 | */ |
| 376 | uint8_t n1_byte = 0x00; |
| 377 | n1_byte = get_from_offset(s, n1_count); |
| 378 | if (!fifo8_is_full(&s->tx_fifo)) { |
| 379 | trace_pnv_spi_tx_append("n1_byte", n1_byte, n1_count); |
| 380 | fifo8_push(&s->tx_fifo, n1_byte); |
| 381 | } else { |
| 382 | qemu_log_mask(LOG_GUEST_ERROR, "pnv_spi: TX_FIFO is full\n"); |
| 383 | break; |
| 384 | } |
| 385 | } else { |
| 386 | /* |
| 387 | * We hit a shift_n1 opcode TX but the TDR is empty, tell the |
| 388 | * sequencer to stop and break this loop. |
| 389 | */ |
| 390 | trace_pnv_spi_sequencer_stop_requested("Shift N1" |
| 391 | "set for transmit but TDR is empty"); |
| 392 | stop = true; |
| 393 | break; |
| 394 | } |
| 395 | } else { |
| 396 | /* |
| 397 | * Cases here: |
| 398 | * - we are receiving during the N1 frame segment and the RDR |
| 399 | * is full so we need to stop until the RDR is read |
| 400 | * - we are transmitting and we don't care about RDR status |
| 401 | * since we won't be loading RDR during the frame segment. |
| 402 | * - we are receiving and the RDR is empty so we allow the operation |
| 403 | * to proceed. |
| 404 | */ |
| 405 | if ((s->N1_rx != 0) && (GETFIELD(SPI_STS_RDR_FULL, s->status) == 1)) { |
| 406 | trace_pnv_spi_sequencer_stop_requested("shift N1" |
| 407 | "set for receive but RDR is full"); |
| 408 | stop = true; |
| 409 | break; |
| 410 | } else if (!fifo8_is_full(&s->tx_fifo)) { |
| 411 | trace_pnv_spi_tx_append_FF("n1_byte"); |
| 412 | fifo8_push(&s->tx_fifo, 0xff); |
| 413 | } else { |
| 414 | qemu_log_mask(LOG_GUEST_ERROR, "pnv_spi: TX_FIFO is full\n"); |
| 415 | break; |
| 416 | } |
| 417 | } |
| 418 | n1_count++; |
| 419 | } /* end of while */ |
| 420 | /* |
| 421 | * If we are not stopping due to an empty TDR and we are doing an N1 TX |
| 422 | * and the TDR is full we need to clear the TDR_full status. |
| 423 | * Do this here instead of up in the loop above so we don't log the message |
| 424 | * in every loop iteration. |
| 425 | * Ignore the send_n1_alone flag, all that does is defer the TX until the N2 |
| 426 | * operation, which was found immediately after the current opcode. The TDR |
| 427 | * was unloaded and will be shifted so we have to clear the TDR_full status. |
| 428 | */ |
| 429 | if (!stop && (s->N1_tx != 0) && |
| 430 | (GETFIELD(SPI_STS_TDR_FULL, s->status) == 1)) { |
| 431 | s->status = SETFIELD(SPI_STS_TDR_FULL, s->status, 0); |
| 432 | } |
| 433 | /* |
| 434 | * There are other reasons why the shifter would stop, such as a TDR empty |
| 435 | * or RDR full condition with N1 set to receive. If we haven't stopped due |
| 436 | * to either one of those conditions then check if the send_n1_alone flag is |
| 437 | * equal to False, indicating the next opcode is an N2 operation, AND if |
| 438 | * the N2 counter reload switch (bit 0 of the N2 count control field) is |
| 439 | * set. This condition requires a pacing write to "kick" off the N2 |
| 440 | * shift which includes the N1 shift as well when send_n1_alone is False. |
| 441 | */ |
| 442 | if (!stop && !send_n1_alone && |
| 443 | (GETFIELD(SPI_CTR_CFG_N2_CTRL_B0, s->regs[SPI_CTR_CFG_REG]) == 1)) { |
| 444 | trace_pnv_spi_sequencer_stop_requested("N2 counter reload " |
| 445 | "active, stop N1 shift, TDR_underrun set to 1"); |
| 446 | stop = true; |
| 447 | s->status = SETFIELD(SPI_STS_TDR_UNDERRUN, s->status, 1); |
| 448 | } |
| 449 | /* |
| 450 | * If send_n1_alone is set AND we have a full TDR then this is the first and |
| 451 | * last payload to send and we don't have an N2 frame segment to add to the |
| 452 | * payload. |
| 453 | */ |
| 454 | if (send_n1_alone && !stop) { |
| 455 | /* We have a TX and a full TDR or an RX and an empty RDR */ |
| 456 | trace_pnv_spi_tx_request("Shifting N1 frame", fifo8_num_used(&s->tx_fifo)); |
| 457 | transfer(s); |
| 458 | /* The N1 frame shift is complete so reset the N1 counters */ |
| 459 | s->N2_bits = 0; |
| 460 | s->N2_bytes = 0; |
| 461 | s->N2_tx = 0; |
| 462 | s->N2_rx = 0; |
| 463 | } |
| 464 | return stop; |
| 465 | } /* end of operation_shiftn1() */ |
| 466 | |
| 467 | /* |
| 468 | * Calculate the N2 counters based on passed in opcode and |
| 469 | * internal register values. |
| 470 | * The method assumes that the opcode is a Shift_N2 opcode |
| 471 | * and doesn't test it. |
| 472 | * The counters returned are: |
| 473 | * N2 bits: Number of bits in the payload data that are significant |
| 474 | * to the responder. |
| 475 | * N2_bytes: Total count of payload bytes for the N2 frame. |
| 476 | * N2_tx: Total number of bytes taken from TDR for N2 |
| 477 | * N2_rx: Total number of bytes taken from the payload for N2 |
| 478 | */ |
| 479 | static void calculate_N2(PnvSpi *s, uint8_t opcode) |
| 480 | { |
| 481 | /* |
| 482 | * Shift_N2 opcode form: 0x4M |
| 483 | * Implicit mode: |
| 484 | * If M!=0 the shift count is M bytes and M is the number of rx bytes. |
| 485 | * Forced Implicit mode: |
| 486 | * M is the shift count but tx and rx is determined by the count control |
| 487 | * register fields. Note that we only check for Forced Implicit mode when |
| 488 | * M != 0 since the mode doesn't make sense when M = 0. |
| 489 | * Explicit mode: |
| 490 | * If M==0 then shift count is number of bits defined in the |
| 491 | * Counter Configuration Register's shift_count_N1 field. |
| 492 | */ |
| 493 | if (PNV_SPI_OPCODE_LO_NIBBLE(opcode) == 0) { |
| 494 | /* Explicit mode */ |
| 495 | s->N2_bits = GETFIELD(SPI_CTR_CFG_N2, s->regs[SPI_CTR_CFG_REG]); |
| 496 | s->N2_bytes = (s->N2_bits + 7) / 8; |
| 497 | s->N2_tx = 0; |
| 498 | s->N2_rx = 0; |
| 499 | /* If tx count control for N2 is set, load the tx value */ |
| 500 | if (GETFIELD(SPI_CTR_CFG_N2_CTRL_B2, s->regs[SPI_CTR_CFG_REG]) == 1) { |
| 501 | s->N2_tx = s->N2_bytes; |
| 502 | } |
| 503 | /* If rx count control for N2 is set, load the rx value */ |
| 504 | if (GETFIELD(SPI_CTR_CFG_N2_CTRL_B3, s->regs[SPI_CTR_CFG_REG]) == 1) { |
| 505 | s->N2_rx = s->N2_bytes; |
| 506 | } |
| 507 | } else { |
| 508 | /* Implicit mode/Forced Implicit mode, use M field from opcode */ |
| 509 | s->N2_bytes = PNV_SPI_OPCODE_LO_NIBBLE(opcode); |
| 510 | s->N2_bits = s->N2_bytes * 8; |
| 511 | /* Assume that we are going to receive the count */ |
| 512 | s->N2_rx = s->N2_bytes; |
| 513 | s->N2_tx = 0; |
| 514 | /* Let Forced Implicit mode have an effect on the counts */ |
| 515 | if (GETFIELD(SPI_CTR_CFG_N2_CTRL_B1, s->regs[SPI_CTR_CFG_REG]) == 1) { |
| 516 | /* |
| 517 | * If Forced Implicit mode and count control doesn't |
| 518 | * indicate a receive then reset the rx count to 0 |
| 519 | */ |
| 520 | if (GETFIELD(SPI_CTR_CFG_N2_CTRL_B3, s->regs[SPI_CTR_CFG_REG]) == 0) { |
| 521 | s->N2_rx = 0; |
| 522 | } |
| 523 | /* If tx count control for N2 is set, load the tx value */ |
| 524 | if (GETFIELD(SPI_CTR_CFG_N2_CTRL_B2, s->regs[SPI_CTR_CFG_REG]) == 1) { |
| 525 | s->N2_tx = s->N2_bytes; |
| 526 | } |
| 527 | } |
| 528 | } |
| 529 | /* |
| 530 | * Enforce an upper limit on the size of N1 that is equal to the |
| 531 | * known size of the shift register, 64 bits or 72 bits if ECC |
| 532 | * is enabled. |
| 533 | * If the size exceeds 72 bits it is a user error so log an error, |
| 534 | * cap the size at a max of 64 bits or 72 bits and set the sequencer FSM |
| 535 | * error bit. |
| 536 | */ |
| 537 | uint8_t ecc_control = GETFIELD(SPI_CLK_CFG_ECC_CTRL, s->regs[SPI_CLK_CFG_REG]); |
| 538 | if (ecc_control == 0 || ecc_control == 2) { |
| 539 | if (s->N2_bytes > (PNV_SPI_REG_SIZE + 1)) { |
| 540 | /* Unsupported N2 shift size when ECC enabled */ |
| 541 | s->N2_bytes = PNV_SPI_REG_SIZE + 1; |
| 542 | s->N2_bits = s->N2_bytes * 8; |
| 543 | } |
| 544 | } else if (s->N2_bytes > PNV_SPI_REG_SIZE) { |
| 545 | /* Unsupported N2 shift size */ |
| 546 | s->N2_bytes = PNV_SPI_REG_SIZE; |
| 547 | s->N2_bits = s->N2_bytes * 8; |
| 548 | } |
| 549 | } /* end of calculate_N2 */ |
| 550 | |
| 551 | /* |
| 552 | * Shift_N2 operation handler method |
| 553 | */ |
| 554 | |
| 555 | static bool operation_shiftn2(PnvSpi *s, uint8_t opcode) |
| 556 | { |
| 557 | uint8_t n2_count; |
| 558 | bool stop = false; |
| 559 | /* |
| 560 | * Use a combination of N2 counters to build the N2 portion of the |
| 561 | * transmit payload. |
| 562 | */ |
| 563 | calculate_N2(s, opcode); |
| 564 | trace_pnv_spi_log_Ncounts(s->N1_bits, s->N1_bytes, s->N1_tx, |
| 565 | s->N1_rx, s->N2_bits, s->N2_bytes, s->N2_tx, s->N2_rx); |
| 566 | /* |
| 567 | * The only difference between this code and the code for shift N1 is |
| 568 | * that this code has to account for the possible presence of N1 transmit |
| 569 | * bytes already taken from the TDR. |
| 570 | * If there are bytes to be transmitted for the N2 portion of the frame |
| 571 | * and there are still bytes in TDR that have not been copied into the |
| 572 | * TX data of the payload, this code will handle transmitting those |
| 573 | * remaining bytes. |
| 574 | * If for some reason the transmit count(s) add up to more than the size |
| 575 | * of the TDR we will just append 0xFF to the transmit payload data until |
| 576 | * the payload is N1 + N2 bytes long. |
| 577 | */ |
| 578 | n2_count = 0; |
| 579 | while (n2_count < s->N2_bytes) { |
| 580 | /* |
| 581 | * If the RDR is full and we need to RX just bail out, letting the |
| 582 | * code continue will end up building the payload twice in the same |
| 583 | * buffer since RDR full causes a sequence stop and restart. |
| 584 | */ |
| 585 | if ((s->N2_rx != 0) && (GETFIELD(SPI_STS_RDR_FULL, s->status) == 1)) { |
| 586 | trace_pnv_spi_sequencer_stop_requested("shift N2 set" |
| 587 | "for receive but RDR is full"); |
| 588 | stop = true; |
| 589 | break; |
| 590 | } |
| 591 | if ((s->N2_tx != 0) && ((s->N1_tx + n2_count) < PNV_SPI_REG_SIZE)) { |
| 592 | /* Always append data for the N2 segment if it is set for TX */ |
| 593 | uint8_t n2_byte = 0x00; |
| 594 | n2_byte = get_from_offset(s, (s->N1_tx + n2_count)); |
| 595 | if (!fifo8_is_full(&s->tx_fifo)) { |
| 596 | trace_pnv_spi_tx_append("n2_byte", n2_byte, (s->N1_tx + n2_count)); |
| 597 | fifo8_push(&s->tx_fifo, n2_byte); |
| 598 | } else { |
| 599 | qemu_log_mask(LOG_GUEST_ERROR, "pnv_spi: TX_FIFO is full\n"); |
| 600 | break; |
| 601 | } |
| 602 | } else if (!fifo8_is_full(&s->tx_fifo)) { |
| 603 | /* |
| 604 | * Regardless of whether or not N2 is set for TX or RX, we need |
| 605 | * the number of bytes in the payload to match the overall length |
| 606 | * of the operation. |
| 607 | */ |
| 608 | trace_pnv_spi_tx_append_FF("n2_byte"); |
| 609 | fifo8_push(&s->tx_fifo, 0xff); |
| 610 | } else { |
| 611 | qemu_log_mask(LOG_GUEST_ERROR, "pnv_spi: TX_FIFO is full\n"); |
| 612 | break; |
| 613 | } |
| 614 | n2_count++; |
| 615 | } /* end of while */ |
| 616 | if (!stop) { |
| 617 | /* We have a TX and a full TDR or an RX and an empty RDR */ |
| 618 | trace_pnv_spi_tx_request("Shifting N2 frame", fifo8_num_used(&s->tx_fifo)); |
| 619 | transfer(s); |
| 620 | /* |
| 621 | * If we are doing an N2 TX and the TDR is full we need to clear the |
| 622 | * TDR_full status. Do this here instead of up in the loop above so we |
| 623 | * don't log the message in every loop iteration. |
| 624 | */ |
| 625 | if ((s->N2_tx != 0) && (GETFIELD(SPI_STS_TDR_FULL, s->status) == 1)) { |
| 626 | s->status = SETFIELD(SPI_STS_TDR_FULL, s->status, 0); |
| 627 | } |
| 628 | /* |
| 629 | * The N2 frame shift is complete so reset the N2 counters. |
| 630 | * Reset the N1 counters also in case the frame was a combination of |
| 631 | * N1 and N2 segments. |
| 632 | */ |
| 633 | s->N2_bits = 0; |
| 634 | s->N2_bytes = 0; |
| 635 | s->N2_tx = 0; |
| 636 | s->N2_rx = 0; |
| 637 | s->N1_bits = 0; |
| 638 | s->N1_bytes = 0; |
| 639 | s->N1_tx = 0; |
| 640 | s->N1_rx = 0; |
| 641 | } |
| 642 | return stop; |
| 643 | } /* end of operation_shiftn2()*/ |
| 644 | |
| 645 | static void operation_sequencer(PnvSpi *s) |
| 646 | { |
| 647 | /* |
| 648 | * Loop through each sequencer operation ID and perform the requested |
| 649 | * operations. |
| 650 | * Flag for indicating if we should send the N1 frame or wait to combine |
| 651 | * it with a preceding N2 frame. |
| 652 | */ |
| 653 | bool send_n1_alone = true; |
| 654 | bool stop = false; /* Flag to stop the sequencer */ |
| 655 | uint8_t opcode = 0; |
| 656 | uint8_t masked_opcode = 0; |
| 657 | uint8_t seq_index; |
| 658 | |
| 659 | /* |
| 660 | * Clear the sequencer FSM error bit - general_SPI_status[3] |
| 661 | * before starting a sequence. |
| 662 | */ |
| 663 | s->status = SETFIELD(SPI_STS_GEN_STATUS_B3, s->status, 0); |
| 664 | /* |
| 665 | * If the FSM is idle set the sequencer index to 0 |
| 666 | * (new/restarted sequence) |
| 667 | */ |
| 668 | if (GETFIELD(SPI_STS_SEQ_FSM, s->status) == SEQ_STATE_IDLE) { |
| 669 | s->status = SETFIELD(SPI_STS_SEQ_INDEX, s->status, 0); |
| 670 | } |
| 671 | /* |
| 672 | * SPI_STS_SEQ_INDEX of status register is kept in seq_index variable and |
| 673 | * updated back to status register at the end of operation_sequencer(). |
| 674 | */ |
| 675 | seq_index = GETFIELD(SPI_STS_SEQ_INDEX, s->status); |
| 676 | /* |
| 677 | * There are only 8 possible operation IDs to iterate through though |
| 678 | * some operations may cause more than one frame to be sequenced. |
| 679 | */ |
| 680 | while (seq_index < NUM_SEQ_OPS) { |
| 681 | opcode = s->seq_op[seq_index]; |
| 682 | /* Set sequencer state to decode */ |
| 683 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, SEQ_STATE_DECODE); |
| 684 | /* |
| 685 | * Only the upper nibble of the operation ID is needed to know what |
| 686 | * kind of operation is requested. |
| 687 | */ |
| 688 | masked_opcode = PNV_SPI_MASKED_OPCODE(opcode); |
| 689 | switch (masked_opcode) { |
| 690 | /* |
| 691 | * Increment the operation index in each case instead of just |
| 692 | * once at the end in case an operation like the branch |
| 693 | * operation needs to change the index. |
| 694 | */ |
| 695 | case SEQ_OP_STOP: |
| 696 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, SEQ_STATE_EXECUTE); |
| 697 | /* A stop operation in any position stops the sequencer */ |
| 698 | trace_pnv_spi_sequencer_op("STOP", seq_index); |
| 699 | |
| 700 | stop = true; |
| 701 | s->status = SETFIELD(SPI_STS_SHIFTER_FSM, s->status, FSM_IDLE); |
| 702 | s->loop_counter_1 = 0; |
| 703 | s->loop_counter_2 = 0; |
| 704 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, SEQ_STATE_IDLE); |
| 705 | break; |
| 706 | |
| 707 | case SEQ_OP_SELECT_SLAVE: |
| 708 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, SEQ_STATE_EXECUTE); |
| 709 | trace_pnv_spi_sequencer_op("SELECT_SLAVE", seq_index); |
| 710 | /* |
| 711 | * This device currently only supports a single responder |
| 712 | * connection at position 0. De-selecting a responder is fine |
| 713 | * and expected at the end of a sequence but selecting any |
| 714 | * responder other than 0 should cause an error. |
| 715 | */ |
| 716 | s->responder_select = PNV_SPI_OPCODE_LO_NIBBLE(opcode); |
| 717 | if (s->responder_select == 0) { |
| 718 | trace_pnv_spi_shifter_done(); |
| 719 | qemu_set_irq(s->cs_line[0], 1); |
| 720 | seq_index++; |
| 721 | s->status = SETFIELD(SPI_STS_SHIFTER_FSM, s->status, FSM_DONE); |
| 722 | } else if (s->responder_select != 1) { |
| 723 | qemu_log_mask(LOG_GUEST_ERROR, "Slave selection other than 1 " |
| 724 | "not supported, select = 0x%x\n", s->responder_select); |
| 725 | trace_pnv_spi_sequencer_stop_requested("invalid responder select"); |
| 726 | s->status = SETFIELD(SPI_STS_SHIFTER_FSM, s->status, FSM_IDLE); |
| 727 | stop = true; |
| 728 | } else { |
| 729 | /* |
| 730 | * Only allow an FSM_START state when a responder is |
| 731 | * selected |
| 732 | */ |
| 733 | s->status = SETFIELD(SPI_STS_SHIFTER_FSM, s->status, FSM_START); |
| 734 | trace_pnv_spi_shifter_stating(); |
| 735 | qemu_set_irq(s->cs_line[0], 0); |
| 736 | /* |
| 737 | * A Shift_N2 operation is only valid after a Shift_N1 |
| 738 | * according to the spec. The spec doesn't say if that means |
| 739 | * immediately after or just after at any point. We will track |
| 740 | * the occurrence of a Shift_N1 to enforce this requirement in |
| 741 | * the most generic way possible by assuming that the rule |
| 742 | * applies once a valid responder select has occurred. |
| 743 | */ |
| 744 | s->shift_n1_done = false; |
| 745 | seq_index++; |
| 746 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, |
| 747 | SEQ_STATE_INDEX_INCREMENT); |
| 748 | } |
| 749 | break; |
| 750 | |
| 751 | case SEQ_OP_SHIFT_N1: |
| 752 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, SEQ_STATE_EXECUTE); |
| 753 | trace_pnv_spi_sequencer_op("SHIFT_N1", seq_index); |
| 754 | /* |
| 755 | * Only allow a shift_n1 when the state is not IDLE or DONE. |
| 756 | * In either of those two cases the sequencer is not in a proper |
| 757 | * state to perform shift operations because the sequencer has: |
| 758 | * - processed a responder deselect (DONE) |
| 759 | * - processed a stop opcode (IDLE) |
| 760 | * - encountered an error (IDLE) |
| 761 | */ |
| 762 | if ((GETFIELD(SPI_STS_SHIFTER_FSM, s->status) == FSM_IDLE) || |
| 763 | (GETFIELD(SPI_STS_SHIFTER_FSM, s->status) == FSM_DONE)) { |
| 764 | qemu_log_mask(LOG_GUEST_ERROR, "Shift_N1 not allowed in " |
| 765 | "shifter state = 0x%llx", GETFIELD( |
| 766 | SPI_STS_SHIFTER_FSM, s->status)); |
| 767 | /* |
| 768 | * Set sequencer FSM error bit 3 (general_SPI_status[3]) |
| 769 | * in status reg. |
| 770 | */ |
| 771 | s->status = SETFIELD(SPI_STS_GEN_STATUS_B3, s->status, 1); |
| 772 | trace_pnv_spi_sequencer_stop_requested("invalid shifter state"); |
| 773 | stop = true; |
| 774 | } else { |
| 775 | /* |
| 776 | * Look for the special case where there is a shift_n1 set for |
| 777 | * transmit and it is followed by a shift_n2 set for transmit |
| 778 | * AND the combined transmit length of the two operations is |
| 779 | * less than or equal to the size of the TDR register. In this |
| 780 | * case we want to use both this current shift_n1 opcode and the |
| 781 | * following shift_n2 opcode to assemble the frame for |
| 782 | * transmission to the responder without requiring a refill of |
| 783 | * the TDR between the two operations. |
| 784 | */ |
| 785 | if ((seq_index != 7) && |
| 786 | PNV_SPI_MASKED_OPCODE(s->seq_op[(seq_index + 1)]) == |
| 787 | SEQ_OP_SHIFT_N2) { |
| 788 | send_n1_alone = false; |
| 789 | } |
| 790 | s->status = SETFIELD(SPI_STS_SHIFTER_FSM, s->status, FSM_SHIFT_N1); |
| 791 | stop = operation_shiftn1(s, opcode, send_n1_alone); |
| 792 | if (stop) { |
| 793 | /* |
| 794 | * The operation code says to stop, this can occur if: |
| 795 | * (1) RDR is full and the N1 shift is set for receive |
| 796 | * (2) TDR was empty at the time of the N1 shift so we need |
| 797 | * to wait for data. |
| 798 | * (3) Neither 1 nor 2 are occurring and we aren't sending |
| 799 | * N1 alone and N2 counter reload is set (bit 0 of the N2 |
| 800 | * counter reload field). In this case TDR_underrun will |
| 801 | * will be set and the Payload has been loaded so it is |
| 802 | * ok to advance the sequencer. |
| 803 | */ |
| 804 | if (GETFIELD(SPI_STS_TDR_UNDERRUN, s->status)) { |
| 805 | s->shift_n1_done = true; |
| 806 | s->status = SETFIELD(SPI_STS_SHIFTER_FSM, s->status, |
| 807 | FSM_SHIFT_N2); |
| 808 | seq_index++; |
| 809 | } else { |
| 810 | /* |
| 811 | * This is case (1) or (2) so the sequencer needs to |
| 812 | * wait and NOT go to the next sequence yet. |
| 813 | */ |
| 814 | s->status = SETFIELD(SPI_STS_SHIFTER_FSM, s->status, FSM_WAIT); |
| 815 | } |
| 816 | } else { |
| 817 | /* Ok to move on to the next index */ |
| 818 | s->shift_n1_done = true; |
| 819 | seq_index++; |
| 820 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, |
| 821 | SEQ_STATE_INDEX_INCREMENT); |
| 822 | } |
| 823 | } |
| 824 | break; |
| 825 | |
| 826 | case SEQ_OP_SHIFT_N2: |
| 827 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, SEQ_STATE_EXECUTE); |
| 828 | trace_pnv_spi_sequencer_op("SHIFT_N2", seq_index); |
| 829 | if (!s->shift_n1_done) { |
| 830 | qemu_log_mask(LOG_GUEST_ERROR, "Shift_N2 is not allowed if a " |
| 831 | "Shift_N1 is not done, shifter state = 0x%llx", |
| 832 | GETFIELD(SPI_STS_SHIFTER_FSM, s->status)); |
| 833 | /* |
| 834 | * In case the sequencer actually stops if an N2 shift is |
| 835 | * requested before any N1 shift is done. Set sequencer FSM |
| 836 | * error bit 3 (general_SPI_status[3]) in status reg. |
| 837 | */ |
| 838 | s->status = SETFIELD(SPI_STS_GEN_STATUS_B3, s->status, 1); |
| 839 | trace_pnv_spi_sequencer_stop_requested("shift_n2 w/no shift_n1 done"); |
| 840 | stop = true; |
| 841 | } else { |
| 842 | /* Ok to do a Shift_N2 */ |
| 843 | s->status = SETFIELD(SPI_STS_SHIFTER_FSM, s->status, FSM_SHIFT_N2); |
| 844 | stop = operation_shiftn2(s, opcode); |
| 845 | /* |
| 846 | * If the operation code says to stop set the shifter state to |
| 847 | * wait and stop |
| 848 | */ |
| 849 | if (stop) { |
| 850 | s->status = SETFIELD(SPI_STS_SHIFTER_FSM, s->status, FSM_WAIT); |
| 851 | } else { |
| 852 | /* Ok to move on to the next index */ |
| 853 | seq_index++; |
| 854 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, |
| 855 | SEQ_STATE_INDEX_INCREMENT); |
| 856 | } |
| 857 | } |
| 858 | break; |
| 859 | |
| 860 | case SEQ_OP_BRANCH_IFNEQ_RDR: |
| 861 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, SEQ_STATE_EXECUTE); |
| 862 | trace_pnv_spi_sequencer_op("BRANCH_IFNEQ_RDR", seq_index); |
| 863 | /* |
| 864 | * The memory mapping register RDR match value is compared against |
| 865 | * the 16 rightmost bytes of the RDR (potentially with masking). |
| 866 | * Since this comparison is performed against the contents of the |
| 867 | * RDR then a receive must have previously occurred otherwise |
| 868 | * there is no data to compare and the operation cannot be |
| 869 | * completed and will stop the sequencer until RDR full is set to |
| 870 | * 1. |
| 871 | */ |
| 872 | if (GETFIELD(SPI_STS_RDR_FULL, s->status) == 1) { |
| 873 | bool rdr_matched = false; |
| 874 | rdr_matched = does_rdr_match(s); |
| 875 | if (rdr_matched) { |
| 876 | trace_pnv_spi_RDR_match("success"); |
| 877 | s->fail_count = 0; |
| 878 | /* A match occurred, increment the sequencer index. */ |
| 879 | seq_index++; |
| 880 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, |
| 881 | SEQ_STATE_INDEX_INCREMENT); |
| 882 | } else { |
| 883 | trace_pnv_spi_RDR_match("failed"); |
| 884 | s->fail_count++; |
| 885 | /* |
| 886 | * Branch the sequencer to the index coded into the op |
| 887 | * code. |
| 888 | */ |
| 889 | seq_index = PNV_SPI_OPCODE_LO_NIBBLE(opcode); |
| 890 | } |
| 891 | if (s->fail_count >= RDR_MATCH_FAILURE_LIMIT) { |
| 892 | qemu_log_mask(LOG_GUEST_ERROR, "pnv_spi: RDR match failure" |
| 893 | " limit crossed %d times hence requesting " |
| 894 | "sequencer to stop.\n", |
| 895 | RDR_MATCH_FAILURE_LIMIT); |
| 896 | stop = true; |
| 897 | } |
| 898 | /* |
| 899 | * Regardless of where the branch ended up we want the |
| 900 | * sequencer to continue shifting so we have to clear |
| 901 | * RDR_full. |
| 902 | */ |
| 903 | s->status = SETFIELD(SPI_STS_RDR_FULL, s->status, 0); |
| 904 | } else { |
| 905 | trace_pnv_spi_sequencer_stop_requested("RDR not" |
| 906 | "full for 0x6x opcode"); |
| 907 | stop = true; |
| 908 | s->status = SETFIELD(SPI_STS_SHIFTER_FSM, s->status, FSM_WAIT); |
| 909 | } |
| 910 | break; |
| 911 | |
| 912 | case SEQ_OP_TRANSFER_TDR: |
| 913 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, SEQ_STATE_EXECUTE); |
| 914 | qemu_log_mask(LOG_GUEST_ERROR, "Transfer TDR is not supported\n"); |
| 915 | seq_index++; |
| 916 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, SEQ_STATE_INDEX_INCREMENT); |
| 917 | break; |
| 918 | |
| 919 | case SEQ_OP_BRANCH_IFNEQ_INC_1: |
| 920 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, SEQ_STATE_EXECUTE); |
| 921 | trace_pnv_spi_sequencer_op("BRANCH_IFNEQ_INC_1", seq_index); |
| 922 | /* |
| 923 | * The spec says the loop should execute count compare + 1 times. |
| 924 | * However we learned from engineering that we really only loop |
| 925 | * count_compare times, count compare = 0 makes this op code a |
| 926 | * no-op |
| 927 | */ |
| 928 | if (s->loop_counter_1 != |
| 929 | GETFIELD(SPI_CTR_CFG_CMP1, s->regs[SPI_CTR_CFG_REG])) { |
| 930 | /* |
| 931 | * Next index is the lower nibble of the branch operation ID, |
| 932 | * mask off all but the first three bits so we don't try to |
| 933 | * access beyond the sequencer_operation_reg boundary. |
| 934 | */ |
| 935 | seq_index = PNV_SPI_OPCODE_LO_NIBBLE(opcode); |
| 936 | s->loop_counter_1++; |
| 937 | } else { |
| 938 | /* Continue to next index if loop counter is reached */ |
| 939 | seq_index++; |
| 940 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, |
| 941 | SEQ_STATE_INDEX_INCREMENT); |
| 942 | } |
| 943 | break; |
| 944 | |
| 945 | case SEQ_OP_BRANCH_IFNEQ_INC_2: |
| 946 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, SEQ_STATE_EXECUTE); |
| 947 | trace_pnv_spi_sequencer_op("BRANCH_IFNEQ_INC_2", seq_index); |
| 948 | uint8_t condition2 = GETFIELD(SPI_CTR_CFG_CMP2, |
| 949 | s->regs[SPI_CTR_CFG_REG]); |
| 950 | /* |
| 951 | * The spec says the loop should execute count compare + 1 times. |
| 952 | * However we learned from engineering that we really only loop |
| 953 | * count_compare times, count compare = 0 makes this op code a |
| 954 | * no-op |
| 955 | */ |
| 956 | if (s->loop_counter_2 != condition2) { |
| 957 | /* |
| 958 | * Next index is the lower nibble of the branch operation ID, |
| 959 | * mask off all but the first three bits so we don't try to |
| 960 | * access beyond the sequencer_operation_reg boundary. |
| 961 | */ |
| 962 | seq_index = PNV_SPI_OPCODE_LO_NIBBLE(opcode); |
| 963 | s->loop_counter_2++; |
| 964 | } else { |
| 965 | /* Continue to next index if loop counter is reached */ |
| 966 | seq_index++; |
| 967 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, |
| 968 | SEQ_STATE_INDEX_INCREMENT); |
| 969 | } |
| 970 | break; |
| 971 | |
| 972 | default: |
| 973 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, SEQ_STATE_EXECUTE); |
| 974 | /* Ignore unsupported operations. */ |
| 975 | seq_index++; |
| 976 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, SEQ_STATE_INDEX_INCREMENT); |
| 977 | break; |
| 978 | } /* end of switch */ |
| 979 | /* |
| 980 | * If we used all 8 opcodes without seeing a 00 - STOP in the sequence |
| 981 | * we need to go ahead and end things as if there was a STOP at the |
| 982 | * end. |
| 983 | */ |
| 984 | if (seq_index == NUM_SEQ_OPS) { |
| 985 | /* All 8 opcodes completed, sequencer idling */ |
| 986 | s->status = SETFIELD(SPI_STS_SHIFTER_FSM, s->status, FSM_IDLE); |
| 987 | seq_index = 0; |
| 988 | s->loop_counter_1 = 0; |
| 989 | s->loop_counter_2 = 0; |
| 990 | s->status = SETFIELD(SPI_STS_SEQ_FSM, s->status, SEQ_STATE_IDLE); |
| 991 | break; |
| 992 | } |
| 993 | /* Break the loop if a stop was requested */ |
| 994 | if (stop) { |
| 995 | break; |
| 996 | } |
| 997 | } /* end of while */ |
| 998 | /* Update sequencer index field in status.*/ |
| 999 | s->status = SETFIELD(SPI_STS_SEQ_INDEX, s->status, seq_index); |
| 1000 | } /* end of operation_sequencer() */ |
| 1001 | |
| 1002 | /* |
| 1003 | * The SPIC engine and its internal sequencer can be interrupted and reset by |
| 1004 | * a hardware signal, the sbe_spicst_hard_reset bits from Pervasive |
| 1005 | * Miscellaneous Register of sbe_register_bo device. |
| 1006 | * Reset immediately aborts any SPI transaction in progress and returns the |
| 1007 | * sequencer and state machines to idle state. |
| 1008 | * The configuration register values are not changed. The status register is |
| 1009 | * not reset. The engine registers are not reset. |
| 1010 | * The SPIC engine reset does not have any affect on the attached devices. |
| 1011 | * Reset handling of any attached devices is beyond the scope of the engine. |
| 1012 | */ |
| 1013 | static void do_reset(DeviceState *dev) |
| 1014 | { |
| 1015 | PnvSpi *s = PNV_SPI(dev); |
| 1016 | DeviceState *ssi_dev; |
| 1017 | |
| 1018 | trace_pnv_spi_reset(); |
| 1019 | |
| 1020 | /* Connect cs irq */ |
| 1021 | ssi_dev = ssi_get_cs(s->ssi_bus, 0); |
| 1022 | if (ssi_dev) { |
| 1023 | qemu_irq cs_line = qdev_get_gpio_in_named(ssi_dev, SSI_GPIO_CS, 0); |
| 1024 | qdev_connect_gpio_out_named(DEVICE(s), "cs", 0, cs_line); |
| 1025 | } |
| 1026 | |
| 1027 | /* Reset all N1 and N2 counters, and other constants */ |
| 1028 | s->N2_bits = 0; |
| 1029 | s->N2_bytes = 0; |
| 1030 | s->N2_tx = 0; |
| 1031 | s->N2_rx = 0; |
| 1032 | s->N1_bits = 0; |
| 1033 | s->N1_bytes = 0; |
| 1034 | s->N1_tx = 0; |
| 1035 | s->N1_rx = 0; |
| 1036 | s->loop_counter_1 = 0; |
| 1037 | s->loop_counter_2 = 0; |
| 1038 | /* Disconnected from responder */ |
| 1039 | qemu_set_irq(s->cs_line[0], 1); |
| 1040 | } |
| 1041 | |
| 1042 | static uint64_t pnv_spi_xscom_read(void *opaque, hwaddr addr, unsigned size) |
| 1043 | { |
| 1044 | PnvSpi *s = PNV_SPI(opaque); |
| 1045 | uint32_t reg = addr >> 3; |
| 1046 | uint64_t val = ~0ull; |
| 1047 | |
| 1048 | switch (reg) { |
| 1049 | case ERROR_REG: |
| 1050 | case SPI_CTR_CFG_REG: |
| 1051 | case CONFIG_REG1: |
| 1052 | case SPI_CLK_CFG_REG: |
| 1053 | case SPI_MM_REG: |
| 1054 | case SPI_XMIT_DATA_REG: |
| 1055 | val = s->regs[reg]; |
| 1056 | break; |
| 1057 | case SPI_RCV_DATA_REG: |
| 1058 | val = s->regs[reg]; |
| 1059 | trace_pnv_spi_read_RDR(val); |
| 1060 | s->status = SETFIELD(SPI_STS_RDR_FULL, s->status, 0); |
| 1061 | if (GETFIELD(SPI_STS_SHIFTER_FSM, s->status) == FSM_WAIT) { |
| 1062 | trace_pnv_spi_start_sequencer(); |
| 1063 | operation_sequencer(s); |
| 1064 | } |
| 1065 | break; |
| 1066 | case SPI_SEQ_OP_REG: |
| 1067 | val = 0; |
| 1068 | for (int i = 0; i < PNV_SPI_REG_SIZE; i++) { |
| 1069 | val = (val << 8) | s->seq_op[i]; |
| 1070 | } |
| 1071 | break; |
| 1072 | case SPI_STS_REG: |
| 1073 | val = s->status; |
| 1074 | break; |
| 1075 | default: |
| 1076 | qemu_log_mask(LOG_GUEST_ERROR, "pnv_spi_regs: Invalid xscom " |
| 1077 | "read at 0x%" PRIx32 "\n", reg); |
| 1078 | } |
| 1079 | |
| 1080 | trace_pnv_spi_read(addr, val); |
| 1081 | return val; |
| 1082 | } |
| 1083 | |
| 1084 | static void pnv_spi_xscom_write(void *opaque, hwaddr addr, |
| 1085 | uint64_t val, unsigned size) |
| 1086 | { |
| 1087 | PnvSpi *s = PNV_SPI(opaque); |
| 1088 | uint32_t reg = addr >> 3; |
| 1089 | |
| 1090 | trace_pnv_spi_write(addr, val); |
| 1091 | |
| 1092 | switch (reg) { |
| 1093 | case ERROR_REG: |
| 1094 | case SPI_CTR_CFG_REG: |
| 1095 | case CONFIG_REG1: |
| 1096 | case SPI_MM_REG: |
| 1097 | case SPI_RCV_DATA_REG: |
| 1098 | s->regs[reg] = val; |
| 1099 | break; |
| 1100 | case SPI_CLK_CFG_REG: |
| 1101 | /* |
| 1102 | * To reset the SPI controller write the sequence 0x5 0xA to |
| 1103 | * reset_control field |
| 1104 | */ |
| 1105 | if ((GETFIELD(SPI_CLK_CFG_RST_CTRL, s->regs[SPI_CLK_CFG_REG]) == 0x5) |
| 1106 | && (GETFIELD(SPI_CLK_CFG_RST_CTRL, val) == 0xA)) { |
| 1107 | /* SPI controller reset sequence completed, resetting */ |
| 1108 | s->regs[reg] = SPI_CLK_CFG_HARD_RST; |
| 1109 | } else { |
| 1110 | s->regs[reg] = val; |
| 1111 | } |
| 1112 | break; |
| 1113 | case SPI_XMIT_DATA_REG: |
| 1114 | /* |
| 1115 | * Writing to the transmit data register causes the transmit data |
| 1116 | * register full status bit in the status register to be set. Writing |
| 1117 | * when the transmit data register full status bit is already set |
| 1118 | * causes a "Resource Not Available" condition. This is not possible |
| 1119 | * in the model since writes to this register are not asynchronous to |
| 1120 | * the operation sequence like it would be in hardware. |
| 1121 | */ |
| 1122 | s->regs[reg] = val; |
| 1123 | trace_pnv_spi_write_TDR(val); |
| 1124 | s->status = SETFIELD(SPI_STS_TDR_FULL, s->status, 1); |
| 1125 | s->status = SETFIELD(SPI_STS_TDR_UNDERRUN, s->status, 0); |
| 1126 | trace_pnv_spi_start_sequencer(); |
| 1127 | operation_sequencer(s); |
| 1128 | break; |
| 1129 | case SPI_SEQ_OP_REG: |
| 1130 | for (int i = 0; i < PNV_SPI_REG_SIZE; i++) { |
| 1131 | s->seq_op[i] = (val >> (56 - i * 8)) & 0xFF; |
| 1132 | } |
| 1133 | break; |
| 1134 | case SPI_STS_REG: |
| 1135 | /* other fields are ignore_write */ |
| 1136 | s->status = SETFIELD(SPI_STS_RDR_OVERRUN, s->status, |
| 1137 | GETFIELD(SPI_STS_RDR, val)); |
| 1138 | s->status = SETFIELD(SPI_STS_TDR_OVERRUN, s->status, |
| 1139 | GETFIELD(SPI_STS_TDR, val)); |
| 1140 | break; |
| 1141 | default: |
| 1142 | qemu_log_mask(LOG_GUEST_ERROR, "pnv_spi_regs: Invalid xscom " |
| 1143 | "write at 0x%" PRIx32 "\n", reg); |
| 1144 | } |
| 1145 | } |
| 1146 | |
| 1147 | static const MemoryRegionOps pnv_spi_xscom_ops = { |
| 1148 | .read = pnv_spi_xscom_read, |
| 1149 | .write = pnv_spi_xscom_write, |
| 1150 | .valid.min_access_size = 8, |
| 1151 | .valid.max_access_size = 8, |
| 1152 | .impl.min_access_size = 8, |
| 1153 | .impl.max_access_size = 8, |
| 1154 | .endianness = DEVICE_BIG_ENDIAN, |
| 1155 | }; |
| 1156 | |
| 1157 | static const Property pnv_spi_properties[] = { |
| 1158 | DEFINE_PROP_UINT32("spic_num", PnvSpi, spic_num, 0), |
| 1159 | DEFINE_PROP_UINT32("chip-id", PnvSpi, chip_id, 0), |
| 1160 | DEFINE_PROP_UINT8("transfer_len", PnvSpi, transfer_len, 4), |
| 1161 | }; |
| 1162 | |
| 1163 | static void pnv_spi_realize(DeviceState *dev, Error **errp) |
| 1164 | { |
| 1165 | PnvSpi *s = PNV_SPI(dev); |
| 1166 | g_autofree char *name = g_strdup_printf("chip%d." TYPE_PNV_SPI_BUS ".%d", |
| 1167 | s->chip_id, s->spic_num); |
| 1168 | s->ssi_bus = ssi_create_bus(dev, name); |
| 1169 | s->cs_line = g_new0(qemu_irq, 1); |
| 1170 | qdev_init_gpio_out_named(DEVICE(s), s->cs_line, "cs", 1); |
| 1171 | |
| 1172 | fifo8_create(&s->tx_fifo, PNV_SPI_FIFO_SIZE); |
| 1173 | fifo8_create(&s->rx_fifo, PNV_SPI_FIFO_SIZE); |
| 1174 | |
| 1175 | /* spi scoms */ |
| 1176 | pnv_xscom_region_init(&s->xscom_spic_regs, OBJECT(s), &pnv_spi_xscom_ops, |
| 1177 | s, "xscom-spi", PNV10_XSCOM_PIB_SPIC_SIZE); |
| 1178 | } |
| 1179 | |
| 1180 | static void pnv_spi_unrealize(DeviceState *dev) |
| 1181 | { |
| 1182 | PnvSpi *s = PNV_SPI(dev); |
| 1183 | fifo8_destroy(&s->tx_fifo); |
| 1184 | fifo8_destroy(&s->rx_fifo); |
| 1185 | } |
| 1186 | |
| 1187 | static int pnv_spi_dt_xscom(PnvXScomInterface *dev, void *fdt, |
| 1188 | int offset) |
| 1189 | { |
| 1190 | PnvSpi *s = PNV_SPI(dev); |
| 1191 | g_autofree char *name; |
| 1192 | int s_offset; |
| 1193 | const char compat[] = "ibm,power10-spi"; |
| 1194 | uint32_t spic_pcba = PNV10_XSCOM_PIB_SPIC_BASE + |
| 1195 | s->spic_num * PNV10_XSCOM_PIB_SPIC_SIZE; |
| 1196 | uint32_t reg[] = { |
| 1197 | cpu_to_be32(spic_pcba), |
| 1198 | cpu_to_be32(PNV10_XSCOM_PIB_SPIC_SIZE) |
| 1199 | }; |
| 1200 | name = g_strdup_printf("pnv_spi@%x", spic_pcba); |
| 1201 | s_offset = fdt_add_subnode(fdt, offset, name); |
| 1202 | _FDT(s_offset); |
| 1203 | |
| 1204 | _FDT(fdt_setprop(fdt, s_offset, "reg", reg, sizeof(reg))); |
| 1205 | _FDT(fdt_setprop(fdt, s_offset, "compatible", compat, sizeof(compat))); |
| 1206 | _FDT((fdt_setprop_cell(fdt, s_offset, "spic_num#", s->spic_num))); |
| 1207 | return 0; |
| 1208 | } |
| 1209 | |
| 1210 | static const VMStateDescription pnv_spi_vmstate = { |
| 1211 | .name = TYPE_PNV_SPI, |
| 1212 | .version_id = 1, |
| 1213 | .fields = (const VMStateField[]) { |
| 1214 | VMSTATE_UINT8(fail_count, PnvSpi), |
| 1215 | VMSTATE_UINT8(transfer_len, PnvSpi), |
| 1216 | VMSTATE_UINT8(responder_select, PnvSpi), |
| 1217 | VMSTATE_BOOL(shift_n1_done, PnvSpi), |
| 1218 | VMSTATE_UINT8(loop_counter_1, PnvSpi), |
| 1219 | VMSTATE_UINT8(loop_counter_2, PnvSpi), |
| 1220 | VMSTATE_UINT8(N1_bits, PnvSpi), |
| 1221 | VMSTATE_UINT8(N2_bits, PnvSpi), |
| 1222 | VMSTATE_UINT8(N1_bytes, PnvSpi), |
| 1223 | VMSTATE_UINT8(N2_bytes, PnvSpi), |
| 1224 | VMSTATE_UINT8(N1_tx, PnvSpi), |
| 1225 | VMSTATE_UINT8(N2_tx, PnvSpi), |
| 1226 | VMSTATE_UINT8(N1_rx, PnvSpi), |
| 1227 | VMSTATE_UINT8(N2_rx, PnvSpi), |
| 1228 | VMSTATE_UINT64_ARRAY(regs, PnvSpi, PNV_SPI_REGS), |
| 1229 | VMSTATE_UINT8_ARRAY(seq_op, PnvSpi, PNV_SPI_REG_SIZE), |
| 1230 | VMSTATE_UINT64(status, PnvSpi), |
| 1231 | VMSTATE_END_OF_LIST(), |
| 1232 | }, |
| 1233 | }; |
| 1234 | |
| 1235 | static void pnv_spi_class_init(ObjectClass *klass, const void *data) |
| 1236 | { |
| 1237 | DeviceClass *dc = DEVICE_CLASS(klass); |
| 1238 | PnvXScomInterfaceClass *xscomc = PNV_XSCOM_INTERFACE_CLASS(klass); |
| 1239 | |
| 1240 | xscomc->dt_xscom = pnv_spi_dt_xscom; |
| 1241 | |
| 1242 | dc->desc = "PowerNV SPI"; |
| 1243 | dc->realize = pnv_spi_realize; |
| 1244 | dc->unrealize = pnv_spi_unrealize; |
| 1245 | device_class_set_legacy_reset(dc, do_reset); |
| 1246 | dc->vmsd = &pnv_spi_vmstate; |
| 1247 | device_class_set_props(dc, pnv_spi_properties); |
| 1248 | } |
| 1249 | |
| 1250 | static const TypeInfo pnv_spi_info = { |
| 1251 | .name = TYPE_PNV_SPI, |
| 1252 | .parent = TYPE_SYS_BUS_DEVICE, |
| 1253 | .instance_size = sizeof(PnvSpi), |
| 1254 | .class_init = pnv_spi_class_init, |
| 1255 | .interfaces = (const InterfaceInfo[]) { |
| 1256 | { TYPE_PNV_XSCOM_INTERFACE }, |
| 1257 | { } |
| 1258 | } |
| 1259 | }; |
| 1260 | |
| 1261 | static void pnv_spi_register_types(void) |
| 1262 | { |
| 1263 | type_register_static(&pnv_spi_info); |
| 1264 | } |
| 1265 | |
| 1266 | type_init(pnv_spi_register_types); |