2 * QEMU JAZZ RC4030 chipset
4 * Copyright (c) 2007-2013 Hervé Poussineau
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25 #include "qemu/osdep.h"
27 #include "hw/mips/mips.h"
28 #include "hw/sysbus.h"
29 #include "qemu/timer.h"
31 #include "qemu/module.h"
32 #include "exec/address-spaces.h"
35 /********************************************************/
36 /* rc4030 emulation */
38 typedef struct dma_pagetable_entry
{
41 } QEMU_PACKED dma_pagetable_entry
;
43 #define DMA_PAGESIZE 4096
44 #define DMA_REG_ENABLE 1
45 #define DMA_REG_COUNT 2
46 #define DMA_REG_ADDRESS 3
48 #define DMA_FLAG_ENABLE 0x0001
49 #define DMA_FLAG_MEM_TO_DEV 0x0002
50 #define DMA_FLAG_TC_INTR 0x0100
51 #define DMA_FLAG_MEM_INTR 0x0200
52 #define DMA_FLAG_ADDR_INTR 0x0400
54 #define TYPE_RC4030 "rc4030"
56 OBJECT_CHECK(rc4030State, (obj), TYPE_RC4030)
58 #define TYPE_RC4030_IOMMU_MEMORY_REGION "rc4030-iommu-memory-region"
60 typedef struct rc4030State
64 uint32_t config
; /* 0x0000: RC4030 config register */
65 uint32_t revision
; /* 0x0008: RC4030 Revision register */
66 uint32_t invalid_address_register
; /* 0x0010: Invalid Address register */
69 uint32_t dma_regs
[8][4];
70 uint32_t dma_tl_base
; /* 0x0018: DMA transl. table base */
71 uint32_t dma_tl_limit
; /* 0x0020: DMA transl. table limit */
74 uint32_t cache_maint
; /* 0x0030: Cache Maintenance */
75 uint32_t remote_failed_address
; /* 0x0038: Remote Failed Address */
76 uint32_t memory_failed_address
; /* 0x0040: Memory Failed Address */
77 uint32_t cache_ptag
; /* 0x0048: I/O Cache Physical Tag */
78 uint32_t cache_ltag
; /* 0x0050: I/O Cache Logical Tag */
79 uint32_t cache_bmask
; /* 0x0058: I/O Cache Byte Mask */
81 uint32_t nmi_interrupt
; /* 0x0200: interrupt source */
82 uint32_t memory_refresh_rate
; /* 0x0210: memory refresh rate */
83 uint32_t nvram_protect
; /* 0x0220: NV ram protect register */
84 uint32_t rem_speed
[16];
85 uint32_t imr_jazz
; /* Local bus int enable mask */
86 uint32_t isr_jazz
; /* Local bus int source */
89 QEMUTimer
*periodic_timer
;
90 uint32_t itr
; /* Interval timer reload */
93 qemu_irq jazz_bus_irq
;
95 /* whole DMA memory region, root of DMA address space */
96 IOMMUMemoryRegion dma_mr
;
99 MemoryRegion iomem_chipset
;
100 MemoryRegion iomem_jazzio
;
103 static void set_next_tick(rc4030State
*s
)
106 qemu_irq_lower(s
->timer_irq
);
108 tm_hz
= 1000 / (s
->itr
+ 1);
110 timer_mod(s
->periodic_timer
, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
) +
111 NANOSECONDS_PER_SECOND
/ tm_hz
);
114 /* called for accesses to rc4030 */
115 static uint64_t rc4030_read(void *opaque
, hwaddr addr
, unsigned int size
)
117 rc4030State
*s
= opaque
;
121 switch (addr
& ~0x3) {
122 /* Global config register */
126 /* Revision register */
130 /* Invalid Address register */
132 val
= s
->invalid_address_register
;
134 /* DMA transl. table base */
136 val
= s
->dma_tl_base
;
138 /* DMA transl. table limit */
140 val
= s
->dma_tl_limit
;
142 /* Remote Failed Address */
144 val
= s
->remote_failed_address
;
146 /* Memory Failed Address */
148 val
= s
->memory_failed_address
;
150 /* I/O Cache Byte Mask */
152 val
= s
->cache_bmask
;
154 if (s
->cache_bmask
== (uint32_t)-1)
157 /* Remote Speed Registers */
174 val
= s
->rem_speed
[(addr
- 0x0070) >> 3];
176 /* DMA channel base address */
210 int entry
= (addr
- 0x0100) >> 5;
211 int idx
= (addr
& 0x1f) >> 3;
212 val
= s
->dma_regs
[entry
][idx
];
215 /* Interrupt source */
217 val
= s
->nmi_interrupt
;
223 /* Memory refresh rate */
225 val
= s
->memory_refresh_rate
;
227 /* NV ram protect register */
229 val
= s
->nvram_protect
;
231 /* Interval timer count */
234 qemu_irq_lower(s
->timer_irq
);
238 val
= 7; /* FIXME: should be read from EISA controller */
241 qemu_log_mask(LOG_GUEST_ERROR
,
242 "rc4030: invalid read at 0x%x", (int)addr
);
247 if ((addr
& ~3) != 0x230) {
248 trace_rc4030_read(addr
, val
);
254 static void rc4030_write(void *opaque
, hwaddr addr
, uint64_t data
,
257 rc4030State
*s
= opaque
;
261 trace_rc4030_write(addr
, val
);
263 switch (addr
& ~0x3) {
264 /* Global config register */
268 /* DMA transl. table base */
270 s
->dma_tl_base
= val
;
272 /* DMA transl. table limit */
274 s
->dma_tl_limit
= val
;
276 /* DMA transl. table invalidated */
279 /* Cache Maintenance */
281 s
->cache_maint
= val
;
283 /* I/O Cache Physical Tag */
287 /* I/O Cache Logical Tag */
291 /* I/O Cache Byte Mask */
293 s
->cache_bmask
|= val
; /* HACK */
295 /* I/O Cache Buffer Window */
298 if (s
->cache_ltag
== 0x80000001 && s
->cache_bmask
== 0xf0f0f0f) {
299 hwaddr dest
= s
->cache_ptag
& ~0x1;
300 dest
+= (s
->cache_maint
& 0x3) << 3;
301 cpu_physical_memory_write(dest
, &val
, 4);
304 /* Remote Speed Registers */
321 s
->rem_speed
[(addr
- 0x0070) >> 3] = val
;
323 /* DMA channel base address */
357 int entry
= (addr
- 0x0100) >> 5;
358 int idx
= (addr
& 0x1f) >> 3;
359 s
->dma_regs
[entry
][idx
] = val
;
362 /* Memory refresh rate */
364 s
->memory_refresh_rate
= val
;
366 /* Interval timer reload */
368 s
->itr
= val
& 0x01FF;
369 qemu_irq_lower(s
->timer_irq
);
376 qemu_log_mask(LOG_GUEST_ERROR
,
377 "rc4030: invalid write of 0x%02x at 0x%x",
383 static const MemoryRegionOps rc4030_ops
= {
385 .write
= rc4030_write
,
386 .impl
.min_access_size
= 4,
387 .impl
.max_access_size
= 4,
388 .endianness
= DEVICE_NATIVE_ENDIAN
,
391 static void update_jazz_irq(rc4030State
*s
)
395 pending
= s
->isr_jazz
& s
->imr_jazz
;
398 qemu_irq_raise(s
->jazz_bus_irq
);
400 qemu_irq_lower(s
->jazz_bus_irq
);
403 static void rc4030_irq_jazz_request(void *opaque
, int irq
, int level
)
405 rc4030State
*s
= opaque
;
408 s
->isr_jazz
|= 1 << irq
;
410 s
->isr_jazz
&= ~(1 << irq
);
416 static void rc4030_periodic_timer(void *opaque
)
418 rc4030State
*s
= opaque
;
421 qemu_irq_raise(s
->timer_irq
);
424 static uint64_t jazzio_read(void *opaque
, hwaddr addr
, unsigned int size
)
426 rc4030State
*s
= opaque
;
432 /* Local bus int source */
434 uint32_t pending
= s
->isr_jazz
& s
->imr_jazz
;
439 val
= (irq
+ 1) << 2;
447 /* Local bus int enable mask */
452 qemu_log_mask(LOG_GUEST_ERROR
,
453 "rc4030/jazzio: invalid read at 0x%x", (int)addr
);
458 trace_jazzio_read(addr
, val
);
463 static void jazzio_write(void *opaque
, hwaddr addr
, uint64_t data
,
466 rc4030State
*s
= opaque
;
470 trace_jazzio_write(addr
, val
);
473 /* Local bus int enable mask */
479 qemu_log_mask(LOG_GUEST_ERROR
,
480 "rc4030/jazzio: invalid write of 0x%02x at 0x%x",
486 static const MemoryRegionOps jazzio_ops
= {
488 .write
= jazzio_write
,
489 .impl
.min_access_size
= 2,
490 .impl
.max_access_size
= 2,
491 .endianness
= DEVICE_NATIVE_ENDIAN
,
494 static IOMMUTLBEntry
rc4030_dma_translate(IOMMUMemoryRegion
*iommu
, hwaddr addr
,
495 IOMMUAccessFlags flag
, int iommu_idx
)
497 rc4030State
*s
= container_of(iommu
, rc4030State
, dma_mr
);
498 IOMMUTLBEntry ret
= {
499 .target_as
= &address_space_memory
,
500 .iova
= addr
& ~(DMA_PAGESIZE
- 1),
501 .translated_addr
= 0,
502 .addr_mask
= DMA_PAGESIZE
- 1,
505 uint64_t i
, entry_address
;
506 dma_pagetable_entry entry
;
508 i
= addr
/ DMA_PAGESIZE
;
509 if (i
< s
->dma_tl_limit
/ sizeof(entry
)) {
510 entry_address
= (s
->dma_tl_base
& 0x7fffffff) + i
* sizeof(entry
);
511 if (address_space_read(ret
.target_as
, entry_address
,
512 MEMTXATTRS_UNSPECIFIED
, (unsigned char *)&entry
,
513 sizeof(entry
)) == MEMTX_OK
) {
514 ret
.translated_addr
= entry
.frame
& ~(DMA_PAGESIZE
- 1);
522 static void rc4030_reset(DeviceState
*dev
)
524 rc4030State
*s
= RC4030(dev
);
527 s
->config
= 0x410; /* some boards seem to accept 0x104 too */
529 s
->invalid_address_register
= 0;
531 memset(s
->dma_regs
, 0, sizeof(s
->dma_regs
));
533 s
->remote_failed_address
= s
->memory_failed_address
= 0;
535 s
->cache_ptag
= s
->cache_ltag
= 0;
538 s
->memory_refresh_rate
= 0x18186;
539 s
->nvram_protect
= 7;
540 for (i
= 0; i
< 15; i
++)
542 s
->imr_jazz
= 0x10; /* XXX: required by firmware, but why? */
547 qemu_irq_lower(s
->timer_irq
);
548 qemu_irq_lower(s
->jazz_bus_irq
);
551 static int rc4030_post_load(void *opaque
, int version_id
)
553 rc4030State
* s
= opaque
;
561 static const VMStateDescription vmstate_rc4030
= {
564 .post_load
= rc4030_post_load
,
565 .fields
= (VMStateField
[]) {
566 VMSTATE_UINT32(config
, rc4030State
),
567 VMSTATE_UINT32(invalid_address_register
, rc4030State
),
568 VMSTATE_UINT32_2DARRAY(dma_regs
, rc4030State
, 8, 4),
569 VMSTATE_UINT32(dma_tl_base
, rc4030State
),
570 VMSTATE_UINT32(dma_tl_limit
, rc4030State
),
571 VMSTATE_UINT32(cache_maint
, rc4030State
),
572 VMSTATE_UINT32(remote_failed_address
, rc4030State
),
573 VMSTATE_UINT32(memory_failed_address
, rc4030State
),
574 VMSTATE_UINT32(cache_ptag
, rc4030State
),
575 VMSTATE_UINT32(cache_ltag
, rc4030State
),
576 VMSTATE_UINT32(cache_bmask
, rc4030State
),
577 VMSTATE_UINT32(memory_refresh_rate
, rc4030State
),
578 VMSTATE_UINT32(nvram_protect
, rc4030State
),
579 VMSTATE_UINT32_ARRAY(rem_speed
, rc4030State
, 16),
580 VMSTATE_UINT32(imr_jazz
, rc4030State
),
581 VMSTATE_UINT32(isr_jazz
, rc4030State
),
582 VMSTATE_UINT32(itr
, rc4030State
),
583 VMSTATE_END_OF_LIST()
587 static void rc4030_do_dma(void *opaque
, int n
, uint8_t *buf
, int len
, int is_write
)
589 rc4030State
*s
= opaque
;
593 s
->dma_regs
[n
][DMA_REG_ENABLE
] &= ~(DMA_FLAG_TC_INTR
| DMA_FLAG_MEM_INTR
| DMA_FLAG_ADDR_INTR
);
595 /* Check DMA channel consistency */
596 dev_to_mem
= (s
->dma_regs
[n
][DMA_REG_ENABLE
] & DMA_FLAG_MEM_TO_DEV
) ? 0 : 1;
597 if (!(s
->dma_regs
[n
][DMA_REG_ENABLE
] & DMA_FLAG_ENABLE
) ||
598 (is_write
!= dev_to_mem
)) {
599 s
->dma_regs
[n
][DMA_REG_ENABLE
] |= DMA_FLAG_MEM_INTR
;
600 s
->nmi_interrupt
|= 1 << n
;
604 /* Get start address and len */
605 if (len
> s
->dma_regs
[n
][DMA_REG_COUNT
])
606 len
= s
->dma_regs
[n
][DMA_REG_COUNT
];
607 dma_addr
= s
->dma_regs
[n
][DMA_REG_ADDRESS
];
609 /* Read/write data at right place */
610 address_space_rw(&s
->dma_as
, dma_addr
, MEMTXATTRS_UNSPECIFIED
,
613 s
->dma_regs
[n
][DMA_REG_ENABLE
] |= DMA_FLAG_TC_INTR
;
614 s
->dma_regs
[n
][DMA_REG_COUNT
] -= len
;
617 struct rc4030DMAState
{
622 void rc4030_dma_read(void *dma
, uint8_t *buf
, int len
)
625 rc4030_do_dma(s
->opaque
, s
->n
, buf
, len
, 0);
628 void rc4030_dma_write(void *dma
, uint8_t *buf
, int len
)
631 rc4030_do_dma(s
->opaque
, s
->n
, buf
, len
, 1);
634 static rc4030_dma
*rc4030_allocate_dmas(void *opaque
, int n
)
637 struct rc4030DMAState
*p
;
640 s
= (rc4030_dma
*)g_malloc0(sizeof(rc4030_dma
) * n
);
641 p
= (struct rc4030DMAState
*)g_malloc0(sizeof(struct rc4030DMAState
) * n
);
642 for (i
= 0; i
< n
; i
++) {
651 static void rc4030_initfn(Object
*obj
)
653 DeviceState
*dev
= DEVICE(obj
);
654 rc4030State
*s
= RC4030(obj
);
655 SysBusDevice
*sysbus
= SYS_BUS_DEVICE(obj
);
657 qdev_init_gpio_in(dev
, rc4030_irq_jazz_request
, 16);
659 sysbus_init_irq(sysbus
, &s
->timer_irq
);
660 sysbus_init_irq(sysbus
, &s
->jazz_bus_irq
);
662 sysbus_init_mmio(sysbus
, &s
->iomem_chipset
);
663 sysbus_init_mmio(sysbus
, &s
->iomem_jazzio
);
666 static void rc4030_realize(DeviceState
*dev
, Error
**errp
)
668 rc4030State
*s
= RC4030(dev
);
669 Object
*o
= OBJECT(dev
);
671 s
->periodic_timer
= timer_new_ns(QEMU_CLOCK_VIRTUAL
,
672 rc4030_periodic_timer
, s
);
674 memory_region_init_io(&s
->iomem_chipset
, NULL
, &rc4030_ops
, s
,
675 "rc4030.chipset", 0x300);
676 memory_region_init_io(&s
->iomem_jazzio
, NULL
, &jazzio_ops
, s
,
677 "rc4030.jazzio", 0x00001000);
679 memory_region_init_iommu(&s
->dma_mr
, sizeof(s
->dma_mr
),
680 TYPE_RC4030_IOMMU_MEMORY_REGION
,
681 o
, "rc4030.dma", UINT32_MAX
);
682 address_space_init(&s
->dma_as
, MEMORY_REGION(&s
->dma_mr
), "rc4030-dma");
685 static void rc4030_unrealize(DeviceState
*dev
, Error
**errp
)
687 rc4030State
*s
= RC4030(dev
);
689 timer_free(s
->periodic_timer
);
691 address_space_destroy(&s
->dma_as
);
692 object_unparent(OBJECT(&s
->dma_mr
));
695 static void rc4030_class_init(ObjectClass
*klass
, void *class_data
)
697 DeviceClass
*dc
= DEVICE_CLASS(klass
);
699 dc
->realize
= rc4030_realize
;
700 dc
->unrealize
= rc4030_unrealize
;
701 dc
->reset
= rc4030_reset
;
702 dc
->vmsd
= &vmstate_rc4030
;
705 static const TypeInfo rc4030_info
= {
707 .parent
= TYPE_SYS_BUS_DEVICE
,
708 .instance_size
= sizeof(rc4030State
),
709 .instance_init
= rc4030_initfn
,
710 .class_init
= rc4030_class_init
,
713 static void rc4030_iommu_memory_region_class_init(ObjectClass
*klass
,
716 IOMMUMemoryRegionClass
*imrc
= IOMMU_MEMORY_REGION_CLASS(klass
);
718 imrc
->translate
= rc4030_dma_translate
;
721 static const TypeInfo rc4030_iommu_memory_region_info
= {
722 .parent
= TYPE_IOMMU_MEMORY_REGION
,
723 .name
= TYPE_RC4030_IOMMU_MEMORY_REGION
,
724 .class_init
= rc4030_iommu_memory_region_class_init
,
727 static void rc4030_register_types(void)
729 type_register_static(&rc4030_info
);
730 type_register_static(&rc4030_iommu_memory_region_info
);
733 type_init(rc4030_register_types
)
735 DeviceState
*rc4030_init(rc4030_dma
**dmas
, IOMMUMemoryRegion
**dma_mr
)
739 dev
= qdev_create(NULL
, TYPE_RC4030
);
740 qdev_init_nofail(dev
);
742 *dmas
= rc4030_allocate_dmas(dev
, 4);
743 *dma_mr
= &RC4030(dev
)->dma_mr
;