2 * QEMU JAZZ RC4030 chipset
4 * Copyright (c) 2007-2013 Hervé Poussineau
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25 #include "qemu/osdep.h"
27 #include "hw/mips/mips.h"
28 #include "hw/sysbus.h"
29 #include "qemu/timer.h"
31 #include "exec/address-spaces.h"
34 /********************************************************/
35 /* rc4030 emulation */
37 typedef struct dma_pagetable_entry
{
40 } QEMU_PACKED dma_pagetable_entry
;
42 #define DMA_PAGESIZE 4096
43 #define DMA_REG_ENABLE 1
44 #define DMA_REG_COUNT 2
45 #define DMA_REG_ADDRESS 3
47 #define DMA_FLAG_ENABLE 0x0001
48 #define DMA_FLAG_MEM_TO_DEV 0x0002
49 #define DMA_FLAG_TC_INTR 0x0100
50 #define DMA_FLAG_MEM_INTR 0x0200
51 #define DMA_FLAG_ADDR_INTR 0x0400
53 #define TYPE_RC4030 "rc4030"
55 OBJECT_CHECK(rc4030State, (obj), TYPE_RC4030)
57 typedef struct rc4030State
61 uint32_t config
; /* 0x0000: RC4030 config register */
62 uint32_t revision
; /* 0x0008: RC4030 Revision register */
63 uint32_t invalid_address_register
; /* 0x0010: Invalid Address register */
66 uint32_t dma_regs
[8][4];
67 uint32_t dma_tl_base
; /* 0x0018: DMA transl. table base */
68 uint32_t dma_tl_limit
; /* 0x0020: DMA transl. table limit */
71 uint32_t cache_maint
; /* 0x0030: Cache Maintenance */
72 uint32_t remote_failed_address
; /* 0x0038: Remote Failed Address */
73 uint32_t memory_failed_address
; /* 0x0040: Memory Failed Address */
74 uint32_t cache_ptag
; /* 0x0048: I/O Cache Physical Tag */
75 uint32_t cache_ltag
; /* 0x0050: I/O Cache Logical Tag */
76 uint32_t cache_bmask
; /* 0x0058: I/O Cache Byte Mask */
78 uint32_t nmi_interrupt
; /* 0x0200: interrupt source */
79 uint32_t memory_refresh_rate
; /* 0x0210: memory refresh rate */
80 uint32_t nvram_protect
; /* 0x0220: NV ram protect register */
81 uint32_t rem_speed
[16];
82 uint32_t imr_jazz
; /* Local bus int enable mask */
83 uint32_t isr_jazz
; /* Local bus int source */
86 QEMUTimer
*periodic_timer
;
87 uint32_t itr
; /* Interval timer reload */
90 qemu_irq jazz_bus_irq
;
92 /* whole DMA memory region, root of DMA address space */
96 MemoryRegion iomem_chipset
;
97 MemoryRegion iomem_jazzio
;
100 static void set_next_tick(rc4030State
*s
)
103 qemu_irq_lower(s
->timer_irq
);
105 tm_hz
= 1000 / (s
->itr
+ 1);
107 timer_mod(s
->periodic_timer
, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
) +
108 NANOSECONDS_PER_SECOND
/ tm_hz
);
111 /* called for accesses to rc4030 */
112 static uint64_t rc4030_read(void *opaque
, hwaddr addr
, unsigned int size
)
114 rc4030State
*s
= opaque
;
118 switch (addr
& ~0x3) {
119 /* Global config register */
123 /* Revision register */
127 /* Invalid Address register */
129 val
= s
->invalid_address_register
;
131 /* DMA transl. table base */
133 val
= s
->dma_tl_base
;
135 /* DMA transl. table limit */
137 val
= s
->dma_tl_limit
;
139 /* Remote Failed Address */
141 val
= s
->remote_failed_address
;
143 /* Memory Failed Address */
145 val
= s
->memory_failed_address
;
147 /* I/O Cache Byte Mask */
149 val
= s
->cache_bmask
;
151 if (s
->cache_bmask
== (uint32_t)-1)
154 /* Remote Speed Registers */
171 val
= s
->rem_speed
[(addr
- 0x0070) >> 3];
173 /* DMA channel base address */
207 int entry
= (addr
- 0x0100) >> 5;
208 int idx
= (addr
& 0x1f) >> 3;
209 val
= s
->dma_regs
[entry
][idx
];
212 /* Interrupt source */
214 val
= s
->nmi_interrupt
;
220 /* Memory refresh rate */
222 val
= s
->memory_refresh_rate
;
224 /* NV ram protect register */
226 val
= s
->nvram_protect
;
228 /* Interval timer count */
231 qemu_irq_lower(s
->timer_irq
);
235 val
= 7; /* FIXME: should be read from EISA controller */
238 qemu_log_mask(LOG_GUEST_ERROR
,
239 "rc4030: invalid read at 0x%x", (int)addr
);
244 if ((addr
& ~3) != 0x230) {
245 trace_rc4030_read(addr
, val
);
251 static void rc4030_write(void *opaque
, hwaddr addr
, uint64_t data
,
254 rc4030State
*s
= opaque
;
258 trace_rc4030_write(addr
, val
);
260 switch (addr
& ~0x3) {
261 /* Global config register */
265 /* DMA transl. table base */
267 s
->dma_tl_base
= val
;
269 /* DMA transl. table limit */
271 s
->dma_tl_limit
= val
;
273 /* DMA transl. table invalidated */
276 /* Cache Maintenance */
278 s
->cache_maint
= val
;
280 /* I/O Cache Physical Tag */
284 /* I/O Cache Logical Tag */
288 /* I/O Cache Byte Mask */
290 s
->cache_bmask
|= val
; /* HACK */
292 /* I/O Cache Buffer Window */
295 if (s
->cache_ltag
== 0x80000001 && s
->cache_bmask
== 0xf0f0f0f) {
296 hwaddr dest
= s
->cache_ptag
& ~0x1;
297 dest
+= (s
->cache_maint
& 0x3) << 3;
298 cpu_physical_memory_write(dest
, &val
, 4);
301 /* Remote Speed Registers */
318 s
->rem_speed
[(addr
- 0x0070) >> 3] = val
;
320 /* DMA channel base address */
354 int entry
= (addr
- 0x0100) >> 5;
355 int idx
= (addr
& 0x1f) >> 3;
356 s
->dma_regs
[entry
][idx
] = val
;
359 /* Memory refresh rate */
361 s
->memory_refresh_rate
= val
;
363 /* Interval timer reload */
365 s
->itr
= val
& 0x01FF;
366 qemu_irq_lower(s
->timer_irq
);
373 qemu_log_mask(LOG_GUEST_ERROR
,
374 "rc4030: invalid write of 0x%02x at 0x%x",
380 static const MemoryRegionOps rc4030_ops
= {
382 .write
= rc4030_write
,
383 .impl
.min_access_size
= 4,
384 .impl
.max_access_size
= 4,
385 .endianness
= DEVICE_NATIVE_ENDIAN
,
388 static void update_jazz_irq(rc4030State
*s
)
392 pending
= s
->isr_jazz
& s
->imr_jazz
;
395 qemu_irq_raise(s
->jazz_bus_irq
);
397 qemu_irq_lower(s
->jazz_bus_irq
);
400 static void rc4030_irq_jazz_request(void *opaque
, int irq
, int level
)
402 rc4030State
*s
= opaque
;
405 s
->isr_jazz
|= 1 << irq
;
407 s
->isr_jazz
&= ~(1 << irq
);
413 static void rc4030_periodic_timer(void *opaque
)
415 rc4030State
*s
= opaque
;
418 qemu_irq_raise(s
->timer_irq
);
421 static uint64_t jazzio_read(void *opaque
, hwaddr addr
, unsigned int size
)
423 rc4030State
*s
= opaque
;
429 /* Local bus int source */
431 uint32_t pending
= s
->isr_jazz
& s
->imr_jazz
;
436 val
= (irq
+ 1) << 2;
444 /* Local bus int enable mask */
449 qemu_log_mask(LOG_GUEST_ERROR
,
450 "rc4030/jazzio: invalid read at 0x%x", (int)addr
);
455 trace_jazzio_read(addr
, val
);
460 static void jazzio_write(void *opaque
, hwaddr addr
, uint64_t data
,
463 rc4030State
*s
= opaque
;
467 trace_jazzio_write(addr
, val
);
470 /* Local bus int enable mask */
476 qemu_log_mask(LOG_GUEST_ERROR
,
477 "rc4030/jazzio: invalid write of 0x%02x at 0x%x",
483 static const MemoryRegionOps jazzio_ops
= {
485 .write
= jazzio_write
,
486 .impl
.min_access_size
= 2,
487 .impl
.max_access_size
= 2,
488 .endianness
= DEVICE_NATIVE_ENDIAN
,
491 static IOMMUTLBEntry
rc4030_dma_translate(MemoryRegion
*iommu
, hwaddr addr
,
492 IOMMUAccessFlags flag
)
494 rc4030State
*s
= container_of(iommu
, rc4030State
, dma_mr
);
495 IOMMUTLBEntry ret
= {
496 .target_as
= &address_space_memory
,
497 .iova
= addr
& ~(DMA_PAGESIZE
- 1),
498 .translated_addr
= 0,
499 .addr_mask
= DMA_PAGESIZE
- 1,
502 uint64_t i
, entry_address
;
503 dma_pagetable_entry entry
;
505 i
= addr
/ DMA_PAGESIZE
;
506 if (i
< s
->dma_tl_limit
/ sizeof(entry
)) {
507 entry_address
= (s
->dma_tl_base
& 0x7fffffff) + i
* sizeof(entry
);
508 if (address_space_read(ret
.target_as
, entry_address
,
509 MEMTXATTRS_UNSPECIFIED
, (unsigned char *)&entry
,
510 sizeof(entry
)) == MEMTX_OK
) {
511 ret
.translated_addr
= entry
.frame
& ~(DMA_PAGESIZE
- 1);
519 static const MemoryRegionIOMMUOps rc4030_dma_ops
= {
520 .translate
= rc4030_dma_translate
,
523 static void rc4030_reset(DeviceState
*dev
)
525 rc4030State
*s
= RC4030(dev
);
528 s
->config
= 0x410; /* some boards seem to accept 0x104 too */
530 s
->invalid_address_register
= 0;
532 memset(s
->dma_regs
, 0, sizeof(s
->dma_regs
));
534 s
->remote_failed_address
= s
->memory_failed_address
= 0;
536 s
->cache_ptag
= s
->cache_ltag
= 0;
539 s
->memory_refresh_rate
= 0x18186;
540 s
->nvram_protect
= 7;
541 for (i
= 0; i
< 15; i
++)
543 s
->imr_jazz
= 0x10; /* XXX: required by firmware, but why? */
548 qemu_irq_lower(s
->timer_irq
);
549 qemu_irq_lower(s
->jazz_bus_irq
);
552 static int rc4030_post_load(void *opaque
, int version_id
)
554 rc4030State
* s
= opaque
;
562 static const VMStateDescription vmstate_rc4030
= {
565 .post_load
= rc4030_post_load
,
566 .fields
= (VMStateField
[]) {
567 VMSTATE_UINT32(config
, rc4030State
),
568 VMSTATE_UINT32(invalid_address_register
, rc4030State
),
569 VMSTATE_UINT32_2DARRAY(dma_regs
, rc4030State
, 8, 4),
570 VMSTATE_UINT32(dma_tl_base
, rc4030State
),
571 VMSTATE_UINT32(dma_tl_limit
, rc4030State
),
572 VMSTATE_UINT32(cache_maint
, rc4030State
),
573 VMSTATE_UINT32(remote_failed_address
, rc4030State
),
574 VMSTATE_UINT32(memory_failed_address
, rc4030State
),
575 VMSTATE_UINT32(cache_ptag
, rc4030State
),
576 VMSTATE_UINT32(cache_ltag
, rc4030State
),
577 VMSTATE_UINT32(cache_bmask
, rc4030State
),
578 VMSTATE_UINT32(memory_refresh_rate
, rc4030State
),
579 VMSTATE_UINT32(nvram_protect
, rc4030State
),
580 VMSTATE_UINT32_ARRAY(rem_speed
, rc4030State
, 16),
581 VMSTATE_UINT32(imr_jazz
, rc4030State
),
582 VMSTATE_UINT32(isr_jazz
, rc4030State
),
583 VMSTATE_UINT32(itr
, rc4030State
),
584 VMSTATE_END_OF_LIST()
588 static void rc4030_do_dma(void *opaque
, int n
, uint8_t *buf
, int len
, int is_write
)
590 rc4030State
*s
= opaque
;
594 s
->dma_regs
[n
][DMA_REG_ENABLE
] &= ~(DMA_FLAG_TC_INTR
| DMA_FLAG_MEM_INTR
| DMA_FLAG_ADDR_INTR
);
596 /* Check DMA channel consistency */
597 dev_to_mem
= (s
->dma_regs
[n
][DMA_REG_ENABLE
] & DMA_FLAG_MEM_TO_DEV
) ? 0 : 1;
598 if (!(s
->dma_regs
[n
][DMA_REG_ENABLE
] & DMA_FLAG_ENABLE
) ||
599 (is_write
!= dev_to_mem
)) {
600 s
->dma_regs
[n
][DMA_REG_ENABLE
] |= DMA_FLAG_MEM_INTR
;
601 s
->nmi_interrupt
|= 1 << n
;
605 /* Get start address and len */
606 if (len
> s
->dma_regs
[n
][DMA_REG_COUNT
])
607 len
= s
->dma_regs
[n
][DMA_REG_COUNT
];
608 dma_addr
= s
->dma_regs
[n
][DMA_REG_ADDRESS
];
610 /* Read/write data at right place */
611 address_space_rw(&s
->dma_as
, dma_addr
, MEMTXATTRS_UNSPECIFIED
,
614 s
->dma_regs
[n
][DMA_REG_ENABLE
] |= DMA_FLAG_TC_INTR
;
615 s
->dma_regs
[n
][DMA_REG_COUNT
] -= len
;
618 struct rc4030DMAState
{
623 void rc4030_dma_read(void *dma
, uint8_t *buf
, int len
)
626 rc4030_do_dma(s
->opaque
, s
->n
, buf
, len
, 0);
629 void rc4030_dma_write(void *dma
, uint8_t *buf
, int len
)
632 rc4030_do_dma(s
->opaque
, s
->n
, buf
, len
, 1);
635 static rc4030_dma
*rc4030_allocate_dmas(void *opaque
, int n
)
638 struct rc4030DMAState
*p
;
641 s
= (rc4030_dma
*)g_malloc0(sizeof(rc4030_dma
) * n
);
642 p
= (struct rc4030DMAState
*)g_malloc0(sizeof(struct rc4030DMAState
) * n
);
643 for (i
= 0; i
< n
; i
++) {
652 static void rc4030_initfn(Object
*obj
)
654 DeviceState
*dev
= DEVICE(obj
);
655 rc4030State
*s
= RC4030(obj
);
656 SysBusDevice
*sysbus
= SYS_BUS_DEVICE(obj
);
658 qdev_init_gpio_in(dev
, rc4030_irq_jazz_request
, 16);
660 sysbus_init_irq(sysbus
, &s
->timer_irq
);
661 sysbus_init_irq(sysbus
, &s
->jazz_bus_irq
);
663 sysbus_init_mmio(sysbus
, &s
->iomem_chipset
);
664 sysbus_init_mmio(sysbus
, &s
->iomem_jazzio
);
667 static void rc4030_realize(DeviceState
*dev
, Error
**errp
)
669 rc4030State
*s
= RC4030(dev
);
670 Object
*o
= OBJECT(dev
);
672 s
->periodic_timer
= timer_new_ns(QEMU_CLOCK_VIRTUAL
,
673 rc4030_periodic_timer
, s
);
675 memory_region_init_io(&s
->iomem_chipset
, NULL
, &rc4030_ops
, s
,
676 "rc4030.chipset", 0x300);
677 memory_region_init_io(&s
->iomem_jazzio
, NULL
, &jazzio_ops
, s
,
678 "rc4030.jazzio", 0x00001000);
680 memory_region_init_iommu(&s
->dma_mr
, o
, &rc4030_dma_ops
,
681 "rc4030.dma", UINT32_MAX
);
682 address_space_init(&s
->dma_as
, &s
->dma_mr
, "rc4030-dma");
685 static void rc4030_unrealize(DeviceState
*dev
, Error
**errp
)
687 rc4030State
*s
= RC4030(dev
);
689 timer_free(s
->periodic_timer
);
691 address_space_destroy(&s
->dma_as
);
692 object_unparent(OBJECT(&s
->dma_mr
));
695 static void rc4030_class_init(ObjectClass
*klass
, void *class_data
)
697 DeviceClass
*dc
= DEVICE_CLASS(klass
);
699 dc
->realize
= rc4030_realize
;
700 dc
->unrealize
= rc4030_unrealize
;
701 dc
->reset
= rc4030_reset
;
702 dc
->vmsd
= &vmstate_rc4030
;
705 static const TypeInfo rc4030_info
= {
707 .parent
= TYPE_SYS_BUS_DEVICE
,
708 .instance_size
= sizeof(rc4030State
),
709 .instance_init
= rc4030_initfn
,
710 .class_init
= rc4030_class_init
,
713 static void rc4030_register_types(void)
715 type_register_static(&rc4030_info
);
718 type_init(rc4030_register_types
)
720 DeviceState
*rc4030_init(rc4030_dma
**dmas
, MemoryRegion
**dma_mr
)
724 dev
= qdev_create(NULL
, TYPE_RC4030
);
725 qdev_init_nofail(dev
);
727 *dmas
= rc4030_allocate_dmas(dev
, 4);
728 *dma_mr
= &RC4030(dev
)->dma_mr
;