2 * ARM PrimeCell PL330 DMA Controller
4 * Copyright (c) 2009 Samsung Electronics.
5 * Contributed by Kirill Batuzov <batuzovk@ispras.ru>
6 * Copyright (c) 2012 Peter A.G. Crosthwaite (peter.crosthwaite@petalogix.com)
7 * Copyright (c) 2012 PetaLogix Pty Ltd.
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License
11 * as published by the Free Software Foundation; version 2 or later.
13 * You should have received a copy of the GNU General Public License along
14 * with this program; if not, see <http://www.gnu.org/licenses/>.
17 #include "qemu/osdep.h"
18 #include "qemu/cutils.h"
20 #include "hw/qdev-properties.h"
21 #include "hw/sysbus.h"
22 #include "migration/vmstate.h"
23 #include "qapi/error.h"
24 #include "qemu/timer.h"
25 #include "sysemu/dma.h"
27 #include "qemu/module.h"
29 #include "qom/object.h"
31 #ifndef PL330_ERR_DEBUG
32 #define PL330_ERR_DEBUG 0
35 #define PL330_PERIPH_NUM 32
36 #define PL330_MAX_BURST_LEN 128
37 #define PL330_INSN_MAXSIZE 6
39 #define PL330_FIFO_OK 0
40 #define PL330_FIFO_STALL 1
41 #define PL330_FIFO_ERR (-1)
43 #define PL330_FAULT_UNDEF_INSTR (1 << 0)
44 #define PL330_FAULT_OPERAND_INVALID (1 << 1)
45 #define PL330_FAULT_DMAGO_ERR (1 << 4)
46 #define PL330_FAULT_EVENT_ERR (1 << 5)
47 #define PL330_FAULT_CH_PERIPH_ERR (1 << 6)
48 #define PL330_FAULT_CH_RDWR_ERR (1 << 7)
49 #define PL330_FAULT_ST_DATA_UNAVAILABLE (1 << 12)
50 #define PL330_FAULT_FIFOEMPTY_ERR (1 << 13)
51 #define PL330_FAULT_INSTR_FETCH_ERR (1 << 16)
52 #define PL330_FAULT_DATA_WRITE_ERR (1 << 17)
53 #define PL330_FAULT_DATA_READ_ERR (1 << 18)
54 #define PL330_FAULT_DBG_INSTR (1 << 30)
55 #define PL330_FAULT_LOCKUP_ERR (1 << 31)
57 #define PL330_UNTAGGED 0xff
59 #define PL330_SINGLE 0x0
60 #define PL330_BURST 0x1
62 #define PL330_WATCHDOG_LIMIT 1024
64 /* IOMEM mapped registers */
65 #define PL330_REG_DSR 0x000
66 #define PL330_REG_DPC 0x004
67 #define PL330_REG_INTEN 0x020
68 #define PL330_REG_INT_EVENT_RIS 0x024
69 #define PL330_REG_INTMIS 0x028
70 #define PL330_REG_INTCLR 0x02C
71 #define PL330_REG_FSRD 0x030
72 #define PL330_REG_FSRC 0x034
73 #define PL330_REG_FTRD 0x038
74 #define PL330_REG_FTR_BASE 0x040
75 #define PL330_REG_CSR_BASE 0x100
76 #define PL330_REG_CPC_BASE 0x104
77 #define PL330_REG_CHANCTRL 0x400
78 #define PL330_REG_DBGSTATUS 0xD00
79 #define PL330_REG_DBGCMD 0xD04
80 #define PL330_REG_DBGINST0 0xD08
81 #define PL330_REG_DBGINST1 0xD0C
82 #define PL330_REG_CR0_BASE 0xE00
83 #define PL330_REG_PERIPH_ID 0xFE0
85 #define PL330_IOMEM_SIZE 0x1000
87 #define CFG_BOOT_ADDR 2
92 static const uint32_t pl330_id
[] = {
93 0x30, 0x13, 0x24, 0x00, 0x0D, 0xF0, 0x05, 0xB1
96 /* DMA channel states as they are described in PL330 Technical Reference Manual
97 * Most of them will not be used in emulation.
100 pl330_chan_stopped
= 0,
101 pl330_chan_executing
= 1,
102 pl330_chan_cache_miss
= 2,
103 pl330_chan_updating_pc
= 3,
104 pl330_chan_waiting_event
= 4,
105 pl330_chan_at_barrier
= 5,
106 pl330_chan_queue_busy
= 6,
107 pl330_chan_waiting_periph
= 7,
108 pl330_chan_killing
= 8,
109 pl330_chan_completing
= 9,
110 pl330_chan_fault_completing
= 14,
111 pl330_chan_fault
= 15,
114 typedef struct PL330State PL330State
;
116 typedef struct PL330Chan
{
124 uint32_t watchdog_timer
;
127 uint8_t request_flag
;
139 static const VMStateDescription vmstate_pl330_chan
= {
140 .name
= "pl330_chan",
142 .minimum_version_id
= 1,
143 .fields
= (const VMStateField
[]) {
144 VMSTATE_UINT32(src
, PL330Chan
),
145 VMSTATE_UINT32(dst
, PL330Chan
),
146 VMSTATE_UINT32(pc
, PL330Chan
),
147 VMSTATE_UINT32(control
, PL330Chan
),
148 VMSTATE_UINT32(status
, PL330Chan
),
149 VMSTATE_UINT32_ARRAY(lc
, PL330Chan
, 2),
150 VMSTATE_UINT32(fault_type
, PL330Chan
),
151 VMSTATE_UINT32(watchdog_timer
, PL330Chan
),
152 VMSTATE_BOOL(ns
, PL330Chan
),
153 VMSTATE_UINT8(request_flag
, PL330Chan
),
154 VMSTATE_UINT8(wakeup
, PL330Chan
),
155 VMSTATE_UINT8(wfp_sbp
, PL330Chan
),
156 VMSTATE_UINT8(state
, PL330Chan
),
157 VMSTATE_UINT8(stall
, PL330Chan
),
158 VMSTATE_END_OF_LIST()
162 typedef struct PL330Fifo
{
170 static const VMStateDescription vmstate_pl330_fifo
= {
171 .name
= "pl330_chan",
173 .minimum_version_id
= 1,
174 .fields
= (const VMStateField
[]) {
175 VMSTATE_VBUFFER_UINT32(buf
, PL330Fifo
, 1, NULL
, buf_size
),
176 VMSTATE_VBUFFER_UINT32(tag
, PL330Fifo
, 1, NULL
, buf_size
),
177 VMSTATE_UINT32(head
, PL330Fifo
),
178 VMSTATE_UINT32(num
, PL330Fifo
),
179 VMSTATE_UINT32(buf_size
, PL330Fifo
),
180 VMSTATE_END_OF_LIST()
184 typedef struct PL330QueueEntry
{
194 static const VMStateDescription vmstate_pl330_queue_entry
= {
195 .name
= "pl330_queue_entry",
197 .minimum_version_id
= 1,
198 .fields
= (const VMStateField
[]) {
199 VMSTATE_UINT32(addr
, PL330QueueEntry
),
200 VMSTATE_UINT32(len
, PL330QueueEntry
),
201 VMSTATE_UINT8(n
, PL330QueueEntry
),
202 VMSTATE_BOOL(inc
, PL330QueueEntry
),
203 VMSTATE_BOOL(z
, PL330QueueEntry
),
204 VMSTATE_UINT8(tag
, PL330QueueEntry
),
205 VMSTATE_UINT8(seqn
, PL330QueueEntry
),
206 VMSTATE_END_OF_LIST()
210 typedef struct PL330Queue
{
212 PL330QueueEntry
*queue
;
216 static const VMStateDescription vmstate_pl330_queue
= {
217 .name
= "pl330_queue",
219 .minimum_version_id
= 2,
220 .fields
= (const VMStateField
[]) {
221 VMSTATE_STRUCT_VARRAY_POINTER_UINT32(queue
, PL330Queue
, queue_size
,
222 vmstate_pl330_queue_entry
,
224 VMSTATE_END_OF_LIST()
229 SysBusDevice parent_obj
;
235 /* Config registers. cfg[5] = CfgDn. */
237 #define EVENT_SEC_STATE 3
238 #define PERIPH_SEC_STATE 4
239 /* cfg 0 bits and pieces */
241 uint8_t num_periph_req
;
243 uint8_t mgr_ns_at_rst
;
244 /* cfg 1 bits and pieces */
246 uint8_t num_i_cache_lines
;
247 /* CRD bits and pieces */
253 uint16_t data_buffer_dep
;
258 PL330Queue read_queue
;
259 PL330Queue write_queue
;
262 QEMUTimer
*timer
; /* is used for restore dma. */
268 uint8_t debug_status
;
269 uint8_t num_faulting
;
270 uint8_t periph_busy
[PL330_PERIPH_NUM
];
272 /* Memory region that DMA operation access */
273 MemoryRegion
*mem_mr
;
274 AddressSpace
*mem_as
;
277 #define TYPE_PL330 "pl330"
278 OBJECT_DECLARE_SIMPLE_TYPE(PL330State
, PL330
)
280 static const VMStateDescription vmstate_pl330
= {
283 .minimum_version_id
= 2,
284 .fields
= (const VMStateField
[]) {
285 VMSTATE_STRUCT(manager
, PL330State
, 0, vmstate_pl330_chan
, PL330Chan
),
286 VMSTATE_STRUCT_VARRAY_POINTER_UINT32(chan
, PL330State
, num_chnls
,
287 vmstate_pl330_chan
, PL330Chan
),
288 VMSTATE_VBUFFER_UINT32(lo_seqn
, PL330State
, 1, NULL
, num_chnls
),
289 VMSTATE_VBUFFER_UINT32(hi_seqn
, PL330State
, 1, NULL
, num_chnls
),
290 VMSTATE_STRUCT(fifo
, PL330State
, 0, vmstate_pl330_fifo
, PL330Fifo
),
291 VMSTATE_STRUCT(read_queue
, PL330State
, 0, vmstate_pl330_queue
,
293 VMSTATE_STRUCT(write_queue
, PL330State
, 0, vmstate_pl330_queue
,
295 VMSTATE_TIMER_PTR(timer
, PL330State
),
296 VMSTATE_UINT32(inten
, PL330State
),
297 VMSTATE_UINT32(int_status
, PL330State
),
298 VMSTATE_UINT32(ev_status
, PL330State
),
299 VMSTATE_UINT32_ARRAY(dbg
, PL330State
, 2),
300 VMSTATE_UINT8(debug_status
, PL330State
),
301 VMSTATE_UINT8(num_faulting
, PL330State
),
302 VMSTATE_UINT8_ARRAY(periph_busy
, PL330State
, PL330_PERIPH_NUM
),
303 VMSTATE_END_OF_LIST()
307 typedef struct PL330InsnDesc
{
308 /* OPCODE of the instruction */
310 /* Mask so we can select several sibling instructions, such as
311 DMALD, DMALDS and DMALDB */
313 /* Size of instruction in bytes */
316 void (*exec
)(PL330Chan
*, uint8_t opcode
, uint8_t *args
, int len
);
319 static void pl330_hexdump(uint8_t *buf
, size_t size
)
321 g_autoptr(GString
) str
= g_string_sized_new(64);
324 for (b
= 0; b
< size
; b
+= len
) {
325 len
= MIN(16, size
- b
);
326 g_string_truncate(str
, 0);
327 qemu_hexdump_line(str
, buf
+ b
, len
, 1, 4);
328 trace_pl330_hexdump(b
, str
->str
);
332 /* MFIFO Implementation
334 * MFIFO is implemented as a cyclic buffer of BUF_SIZE size. Tagged bytes are
335 * stored in this buffer. Data is stored in BUF field, tags - in the
336 * corresponding array elements of TAG field.
339 /* Initialize queue. */
341 static void pl330_fifo_init(PL330Fifo
*s
, uint32_t size
)
343 s
->buf
= g_malloc0(size
);
344 s
->tag
= g_malloc0(size
);
348 /* Cyclic increment */
350 static inline int pl330_fifo_inc(PL330Fifo
*s
, int x
)
352 return (x
+ 1) % s
->buf_size
;
355 /* Number of empty bytes in MFIFO */
357 static inline int pl330_fifo_num_free(PL330Fifo
*s
)
359 return s
->buf_size
- s
->num
;
362 /* Push LEN bytes of data stored in BUF to MFIFO and tag it with TAG.
363 * Zero returned on success, PL330_FIFO_STALL if there is no enough free
364 * space in MFIFO to store requested amount of data. If push was unsuccessful
365 * no data is stored to MFIFO.
368 static int pl330_fifo_push(PL330Fifo
*s
, uint8_t *buf
, int len
, uint8_t tag
)
372 if (s
->buf_size
- s
->num
< len
) {
373 return PL330_FIFO_STALL
;
375 for (i
= 0; i
< len
; i
++) {
376 int push_idx
= (s
->head
+ s
->num
+ i
) % s
->buf_size
;
377 s
->buf
[push_idx
] = buf
[i
];
378 s
->tag
[push_idx
] = tag
;
381 return PL330_FIFO_OK
;
384 /* Get LEN bytes of data from MFIFO and store it to BUF. Tag value of each
385 * byte is verified. Zero returned on success, PL330_FIFO_ERR on tag mismatch
386 * and PL330_FIFO_STALL if there is no enough data in MFIFO. If get was
387 * unsuccessful no data is removed from MFIFO.
390 static int pl330_fifo_get(PL330Fifo
*s
, uint8_t *buf
, int len
, uint8_t tag
)
395 return PL330_FIFO_STALL
;
397 for (i
= 0; i
< len
; i
++) {
398 if (s
->tag
[s
->head
] == tag
) {
399 int get_idx
= (s
->head
+ i
) % s
->buf_size
;
400 buf
[i
] = s
->buf
[get_idx
];
401 } else { /* Tag mismatch - Rollback transaction */
402 return PL330_FIFO_ERR
;
405 s
->head
= (s
->head
+ len
) % s
->buf_size
;
407 return PL330_FIFO_OK
;
410 /* Reset MFIFO. This completely erases all data in it. */
412 static inline void pl330_fifo_reset(PL330Fifo
*s
)
418 /* Return tag of the first byte stored in MFIFO. If MFIFO is empty
419 * PL330_UNTAGGED is returned.
422 static inline uint8_t pl330_fifo_tag(PL330Fifo
*s
)
424 return (!s
->num
) ? PL330_UNTAGGED
: s
->tag
[s
->head
];
427 /* Returns non-zero if tag TAG is present in fifo or zero otherwise */
429 static int pl330_fifo_has_tag(PL330Fifo
*s
, uint8_t tag
)
434 for (n
= 0; n
< s
->num
; n
++) {
435 if (s
->tag
[i
] == tag
) {
438 i
= pl330_fifo_inc(s
, i
);
443 /* Remove all entry tagged with TAG from MFIFO */
445 static void pl330_fifo_tagged_remove(PL330Fifo
*s
, uint8_t tag
)
450 for (n
= 0; n
< s
->num
; n
++) {
451 if (s
->tag
[i
] != tag
) {
452 s
->buf
[t
] = s
->buf
[i
];
453 s
->tag
[t
] = s
->tag
[i
];
454 t
= pl330_fifo_inc(s
, t
);
458 i
= pl330_fifo_inc(s
, i
);
462 /* Read-Write Queue implementation
464 * A Read-Write Queue stores up to QUEUE_SIZE instructions (loads or stores).
465 * Each instruction is described by source (for loads) or destination (for
466 * stores) address ADDR, width of data to be loaded/stored LEN, number of
467 * stores/loads to be performed N, INC bit, Z bit and TAG to identify channel
468 * this instruction belongs to. Queue does not store any information about
469 * nature of the instruction: is it load or store. PL330 has different queues
470 * for loads and stores so this is already known at the top level where it
473 * Queue works as FIFO for instructions with equivalent tags, but can issue
474 * instructions with different tags in arbitrary order. SEQN field attached to
475 * each instruction helps to achieve this. For each TAG queue contains
476 * instructions with consecutive SEQN values ranging from LO_SEQN[TAG] to
477 * HI_SEQN[TAG]-1 inclusive. SEQN is 8-bit unsigned integer, so SEQN=255 is
478 * followed by SEQN=0.
480 * Z bit indicates that zeroes should be stored. No MFIFO fetches are performed
484 static void pl330_queue_reset(PL330Queue
*s
)
488 for (i
= 0; i
< s
->queue_size
; i
++) {
489 s
->queue
[i
].tag
= PL330_UNTAGGED
;
493 /* Initialize queue */
494 static void pl330_queue_init(PL330Queue
*s
, int size
, PL330State
*parent
)
497 s
->queue
= g_new0(PL330QueueEntry
, size
);
498 s
->queue_size
= size
;
501 /* Returns pointer to an empty slot or NULL if queue is full */
502 static PL330QueueEntry
*pl330_queue_find_empty(PL330Queue
*s
)
506 for (i
= 0; i
< s
->queue_size
; i
++) {
507 if (s
->queue
[i
].tag
== PL330_UNTAGGED
) {
514 /* Put instruction in queue.
517 * - non-zero - queue is full
520 static int pl330_queue_put_insn(PL330Queue
*s
, uint32_t addr
,
521 int len
, int n
, bool inc
, bool z
, uint8_t tag
)
523 PL330QueueEntry
*entry
= pl330_queue_find_empty(s
);
534 entry
->seqn
= s
->parent
->hi_seqn
[tag
];
535 s
->parent
->hi_seqn
[tag
]++;
539 /* Returns a pointer to queue slot containing instruction which satisfies
540 * following conditions:
541 * - it has valid tag value (not PL330_UNTAGGED)
542 * - if enforce_seq is set it has to be issuable without violating queue
544 * - if TAG argument is not PL330_UNTAGGED this instruction has tag value
545 * equivalent to the argument TAG value.
546 * If such instruction cannot be found NULL is returned.
549 static PL330QueueEntry
*pl330_queue_find_insn(PL330Queue
*s
, uint8_t tag
,
554 for (i
= 0; i
< s
->queue_size
; i
++) {
555 if (s
->queue
[i
].tag
!= PL330_UNTAGGED
) {
557 s
->queue
[i
].seqn
== s
->parent
->lo_seqn
[s
->queue
[i
].tag
]) &&
558 (s
->queue
[i
].tag
== tag
|| tag
== PL330_UNTAGGED
||
567 /* Removes instruction from queue. */
569 static inline void pl330_queue_remove_insn(PL330Queue
*s
, PL330QueueEntry
*e
)
571 s
->parent
->lo_seqn
[e
->tag
]++;
572 e
->tag
= PL330_UNTAGGED
;
575 /* Removes all instructions tagged with TAG from queue. */
577 static inline void pl330_queue_remove_tagged(PL330Queue
*s
, uint8_t tag
)
581 for (i
= 0; i
< s
->queue_size
; i
++) {
582 if (s
->queue
[i
].tag
== tag
) {
583 s
->queue
[i
].tag
= PL330_UNTAGGED
;
588 /* DMA instruction execution engine */
590 /* Moves DMA channel to the FAULT state and updates it's status. */
592 static inline void pl330_fault(PL330Chan
*ch
, uint32_t flags
)
594 trace_pl330_fault(ch
, flags
);
595 ch
->fault_type
|= flags
;
596 if (ch
->state
== pl330_chan_fault
) {
599 ch
->state
= pl330_chan_fault
;
600 ch
->parent
->num_faulting
++;
601 if (ch
->parent
->num_faulting
== 1) {
602 trace_pl330_fault_abort();
603 qemu_irq_raise(ch
->parent
->irq_abort
);
608 * For information about instructions see PL330 Technical Reference Manual.
611 * CH - channel executing the instruction
613 * ARGS - array of 8-bit arguments
614 * LEN - number of elements in ARGS array
617 static void pl330_dmaadxh(PL330Chan
*ch
, uint8_t *args
, bool ra
, bool neg
)
619 uint32_t im
= (args
[1] << 8) | args
[0];
624 if (ch
->is_manager
) {
625 pl330_fault(ch
, PL330_FAULT_UNDEF_INSTR
);
635 static void pl330_dmaaddh(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
637 pl330_dmaadxh(ch
, args
, extract32(opcode
, 1, 1), false);
640 static void pl330_dmaadnh(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
642 pl330_dmaadxh(ch
, args
, extract32(opcode
, 1, 1), true);
645 static void pl330_dmaend(PL330Chan
*ch
, uint8_t opcode
,
646 uint8_t *args
, int len
)
648 PL330State
*s
= ch
->parent
;
650 if (ch
->state
== pl330_chan_executing
&& !ch
->is_manager
) {
651 /* Wait for all transfers to complete */
652 if (pl330_fifo_has_tag(&s
->fifo
, ch
->tag
) ||
653 pl330_queue_find_insn(&s
->read_queue
, ch
->tag
, false) != NULL
||
654 pl330_queue_find_insn(&s
->write_queue
, ch
->tag
, false) != NULL
) {
660 trace_pl330_dmaend();
661 pl330_fifo_tagged_remove(&s
->fifo
, ch
->tag
);
662 pl330_queue_remove_tagged(&s
->read_queue
, ch
->tag
);
663 pl330_queue_remove_tagged(&s
->write_queue
, ch
->tag
);
664 ch
->state
= pl330_chan_stopped
;
667 static void pl330_dmaflushp(PL330Chan
*ch
, uint8_t opcode
,
668 uint8_t *args
, int len
)
673 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
676 periph_id
= (args
[0] >> 3) & 0x1f;
677 if (periph_id
>= ch
->parent
->num_periph_req
) {
678 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
681 if (ch
->ns
&& !(ch
->parent
->cfg
[CFG_PNS
] & (1 << periph_id
))) {
682 pl330_fault(ch
, PL330_FAULT_CH_PERIPH_ERR
);
688 static void pl330_dmago(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
697 if (!ch
->is_manager
) {
698 pl330_fault(ch
, PL330_FAULT_UNDEF_INSTR
);
702 chan_id
= args
[0] & 7;
703 if ((args
[0] >> 3)) {
704 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
707 if (chan_id
>= ch
->parent
->num_chnls
) {
708 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
711 pc
= (((uint32_t)args
[4]) << 24) | (((uint32_t)args
[3]) << 16) |
712 (((uint32_t)args
[2]) << 8) | (((uint32_t)args
[1]));
713 if (ch
->parent
->chan
[chan_id
].state
!= pl330_chan_stopped
) {
714 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
718 pl330_fault(ch
, PL330_FAULT_DMAGO_ERR
);
721 s
= &ch
->parent
->chan
[chan_id
];
724 s
->state
= pl330_chan_executing
;
727 static void pl330_dmald(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
729 uint8_t bs
= opcode
& 3;
734 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
737 if ((bs
== 1 && ch
->request_flag
== PL330_BURST
) ||
738 (bs
== 3 && ch
->request_flag
== PL330_SINGLE
)) {
742 if (bs
== 1 && ch
->request_flag
== PL330_SINGLE
) {
745 num
= ((ch
->control
>> 4) & 0xf) + 1;
747 size
= (uint32_t)1 << ((ch
->control
>> 1) & 0x7);
748 inc
= !!(ch
->control
& 1);
749 ch
->stall
= pl330_queue_put_insn(&ch
->parent
->read_queue
, ch
->src
,
750 size
, num
, inc
, 0, ch
->tag
);
752 trace_pl330_dmald(ch
->tag
, ch
->src
, size
, num
, inc
? 'Y' : 'N');
753 ch
->src
+= inc
? size
* num
- (ch
->src
& (size
- 1)) : 0;
757 static void pl330_dmaldp(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
762 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
765 periph_id
= (args
[0] >> 3) & 0x1f;
766 if (periph_id
>= ch
->parent
->num_periph_req
) {
767 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
770 if (ch
->ns
&& !(ch
->parent
->cfg
[CFG_PNS
] & (1 << periph_id
))) {
771 pl330_fault(ch
, PL330_FAULT_CH_PERIPH_ERR
);
774 pl330_dmald(ch
, opcode
, args
, len
);
777 static void pl330_dmalp(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
779 uint8_t lc
= (opcode
& 2) >> 1;
781 ch
->lc
[lc
] = args
[0];
784 static void pl330_dmakill(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
786 if (ch
->state
== pl330_chan_fault
||
787 ch
->state
== pl330_chan_fault_completing
) {
788 /* This is the only way for a channel to leave the faulting state */
790 ch
->parent
->num_faulting
--;
791 if (ch
->parent
->num_faulting
== 0) {
792 trace_pl330_dmakill();
793 qemu_irq_lower(ch
->parent
->irq_abort
);
796 ch
->state
= pl330_chan_killing
;
797 pl330_fifo_tagged_remove(&ch
->parent
->fifo
, ch
->tag
);
798 pl330_queue_remove_tagged(&ch
->parent
->read_queue
, ch
->tag
);
799 pl330_queue_remove_tagged(&ch
->parent
->write_queue
, ch
->tag
);
800 ch
->state
= pl330_chan_stopped
;
803 static void pl330_dmalpend(PL330Chan
*ch
, uint8_t opcode
,
804 uint8_t *args
, int len
)
806 uint8_t nf
= (opcode
& 0x10) >> 4;
807 uint8_t bs
= opcode
& 3;
808 uint8_t lc
= (opcode
& 4) >> 2;
810 trace_pl330_dmalpend(nf
, bs
, lc
, ch
->lc
[lc
], ch
->request_flag
);
813 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
816 if ((bs
== 1 && ch
->request_flag
== PL330_BURST
) ||
817 (bs
== 3 && ch
->request_flag
== PL330_SINGLE
)) {
821 if (!nf
|| ch
->lc
[lc
]) {
825 trace_pl330_dmalpiter();
828 /* "ch->pc -= args[0] + len + 1" is incorrect when args[0] == 256 */
830 trace_pl330_dmalpfallthrough();
835 static void pl330_dmamov(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
837 uint8_t rd
= args
[0] & 7;
840 if ((args
[0] >> 3)) {
841 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
844 im
= (((uint32_t)args
[4]) << 24) | (((uint32_t)args
[3]) << 16) |
845 (((uint32_t)args
[2]) << 8) | (((uint32_t)args
[1]));
857 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
862 static void pl330_dmanop(PL330Chan
*ch
, uint8_t opcode
,
863 uint8_t *args
, int len
)
868 static void pl330_dmarmb(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
870 if (pl330_queue_find_insn(&ch
->parent
->read_queue
, ch
->tag
, false)) {
871 ch
->state
= pl330_chan_at_barrier
;
875 ch
->state
= pl330_chan_executing
;
879 static void pl330_dmasev(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
884 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
887 ev_id
= (args
[0] >> 3) & 0x1f;
888 if (ev_id
>= ch
->parent
->num_events
) {
889 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
892 if (ch
->ns
&& !(ch
->parent
->cfg
[CFG_INS
] & (1 << ev_id
))) {
893 pl330_fault(ch
, PL330_FAULT_EVENT_ERR
);
896 if (ch
->parent
->inten
& (1 << ev_id
)) {
897 ch
->parent
->int_status
|= (1 << ev_id
);
898 trace_pl330_dmasev_evirq(ev_id
);
899 qemu_irq_raise(ch
->parent
->irq
[ev_id
]);
901 trace_pl330_dmasev_event(ev_id
);
902 ch
->parent
->ev_status
|= (1 << ev_id
);
905 static void pl330_dmast(PL330Chan
*ch
, uint8_t opcode
, uint8_t *args
, int len
)
907 uint8_t bs
= opcode
& 3;
912 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
915 if ((bs
== 1 && ch
->request_flag
== PL330_BURST
) ||
916 (bs
== 3 && ch
->request_flag
== PL330_SINGLE
)) {
920 num
= ((ch
->control
>> 18) & 0xf) + 1;
921 size
= (uint32_t)1 << ((ch
->control
>> 15) & 0x7);
922 inc
= !!((ch
->control
>> 14) & 1);
923 ch
->stall
= pl330_queue_put_insn(&ch
->parent
->write_queue
, ch
->dst
,
924 size
, num
, inc
, 0, ch
->tag
);
926 trace_pl330_dmast(ch
->tag
, ch
->dst
, size
, num
, inc
? 'Y' : 'N');
927 ch
->dst
+= inc
? size
* num
- (ch
->dst
& (size
- 1)) : 0;
931 static void pl330_dmastp(PL330Chan
*ch
, uint8_t opcode
,
932 uint8_t *args
, int len
)
937 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
940 periph_id
= (args
[0] >> 3) & 0x1f;
941 if (periph_id
>= ch
->parent
->num_periph_req
) {
942 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
945 if (ch
->ns
&& !(ch
->parent
->cfg
[CFG_PNS
] & (1 << periph_id
))) {
946 pl330_fault(ch
, PL330_FAULT_CH_PERIPH_ERR
);
949 pl330_dmast(ch
, opcode
, args
, len
);
952 static void pl330_dmastz(PL330Chan
*ch
, uint8_t opcode
,
953 uint8_t *args
, int len
)
958 num
= ((ch
->control
>> 18) & 0xf) + 1;
959 size
= (uint32_t)1 << ((ch
->control
>> 15) & 0x7);
960 inc
= !!((ch
->control
>> 14) & 1);
961 ch
->stall
= pl330_queue_put_insn(&ch
->parent
->write_queue
, ch
->dst
,
962 size
, num
, inc
, 1, ch
->tag
);
964 ch
->dst
+= size
* num
;
968 static void pl330_dmawfe(PL330Chan
*ch
, uint8_t opcode
,
969 uint8_t *args
, int len
)
975 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
978 ev_id
= (args
[0] >> 3) & 0x1f;
979 if (ev_id
>= ch
->parent
->num_events
) {
980 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
983 if (ch
->ns
&& !(ch
->parent
->cfg
[CFG_INS
] & (1 << ev_id
))) {
984 pl330_fault(ch
, PL330_FAULT_EVENT_ERR
);
988 ch
->state
= pl330_chan_waiting_event
;
989 if (~ch
->parent
->inten
& ch
->parent
->ev_status
& 1 << ev_id
) {
990 ch
->state
= pl330_chan_executing
;
991 /* If anyone else is currently waiting on the same event, let them
992 * clear the ev_status so they pick up event as well
994 for (i
= 0; i
< ch
->parent
->num_chnls
; ++i
) {
995 PL330Chan
*peer
= &ch
->parent
->chan
[i
];
996 if (peer
->state
== pl330_chan_waiting_event
&&
997 peer
->wakeup
== ev_id
) {
1001 ch
->parent
->ev_status
&= ~(1 << ev_id
);
1002 trace_pl330_dmawfe(ev_id
);
1008 static void pl330_dmawfp(PL330Chan
*ch
, uint8_t opcode
,
1009 uint8_t *args
, int len
)
1011 uint8_t bs
= opcode
& 3;
1015 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
1018 periph_id
= (args
[0] >> 3) & 0x1f;
1019 if (periph_id
>= ch
->parent
->num_periph_req
) {
1020 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
1023 if (ch
->ns
&& !(ch
->parent
->cfg
[CFG_PNS
] & (1 << periph_id
))) {
1024 pl330_fault(ch
, PL330_FAULT_CH_PERIPH_ERR
);
1029 ch
->request_flag
= PL330_SINGLE
;
1033 ch
->request_flag
= PL330_BURST
;
1037 ch
->request_flag
= PL330_BURST
;
1041 pl330_fault(ch
, PL330_FAULT_OPERAND_INVALID
);
1045 if (ch
->parent
->periph_busy
[periph_id
]) {
1046 ch
->state
= pl330_chan_waiting_periph
;
1048 } else if (ch
->state
== pl330_chan_waiting_periph
) {
1049 ch
->state
= pl330_chan_executing
;
1053 static void pl330_dmawmb(PL330Chan
*ch
, uint8_t opcode
,
1054 uint8_t *args
, int len
)
1056 if (pl330_queue_find_insn(&ch
->parent
->write_queue
, ch
->tag
, false)) {
1057 ch
->state
= pl330_chan_at_barrier
;
1061 ch
->state
= pl330_chan_executing
;
1065 /* NULL terminated array of the instruction descriptions. */
1066 static const PL330InsnDesc insn_desc
[] = {
1067 { .opcode
= 0x54, .opmask
= 0xFD, .size
= 3, .exec
= pl330_dmaaddh
, },
1068 { .opcode
= 0x5c, .opmask
= 0xFD, .size
= 3, .exec
= pl330_dmaadnh
, },
1069 { .opcode
= 0x00, .opmask
= 0xFF, .size
= 1, .exec
= pl330_dmaend
, },
1070 { .opcode
= 0x35, .opmask
= 0xFF, .size
= 2, .exec
= pl330_dmaflushp
, },
1071 { .opcode
= 0xA0, .opmask
= 0xFD, .size
= 6, .exec
= pl330_dmago
, },
1072 { .opcode
= 0x04, .opmask
= 0xFC, .size
= 1, .exec
= pl330_dmald
, },
1073 { .opcode
= 0x25, .opmask
= 0xFD, .size
= 2, .exec
= pl330_dmaldp
, },
1074 { .opcode
= 0x20, .opmask
= 0xFD, .size
= 2, .exec
= pl330_dmalp
, },
1075 /* dmastp must be before dmalpend in this list, because their maps
1078 { .opcode
= 0x29, .opmask
= 0xFD, .size
= 2, .exec
= pl330_dmastp
, },
1079 { .opcode
= 0x28, .opmask
= 0xE8, .size
= 2, .exec
= pl330_dmalpend
, },
1080 { .opcode
= 0x01, .opmask
= 0xFF, .size
= 1, .exec
= pl330_dmakill
, },
1081 { .opcode
= 0xBC, .opmask
= 0xFF, .size
= 6, .exec
= pl330_dmamov
, },
1082 { .opcode
= 0x18, .opmask
= 0xFF, .size
= 1, .exec
= pl330_dmanop
, },
1083 { .opcode
= 0x12, .opmask
= 0xFF, .size
= 1, .exec
= pl330_dmarmb
, },
1084 { .opcode
= 0x34, .opmask
= 0xFF, .size
= 2, .exec
= pl330_dmasev
, },
1085 { .opcode
= 0x08, .opmask
= 0xFC, .size
= 1, .exec
= pl330_dmast
, },
1086 { .opcode
= 0x0C, .opmask
= 0xFF, .size
= 1, .exec
= pl330_dmastz
, },
1087 { .opcode
= 0x36, .opmask
= 0xFF, .size
= 2, .exec
= pl330_dmawfe
, },
1088 { .opcode
= 0x30, .opmask
= 0xFC, .size
= 2, .exec
= pl330_dmawfp
, },
1089 { .opcode
= 0x13, .opmask
= 0xFF, .size
= 1, .exec
= pl330_dmawmb
, },
1090 { .opcode
= 0x00, .opmask
= 0x00, .size
= 0, .exec
= NULL
, }
1093 /* Instructions which can be issued via debug registers. */
1094 static const PL330InsnDesc debug_insn_desc
[] = {
1095 { .opcode
= 0xA0, .opmask
= 0xFD, .size
= 6, .exec
= pl330_dmago
, },
1096 { .opcode
= 0x01, .opmask
= 0xFF, .size
= 1, .exec
= pl330_dmakill
, },
1097 { .opcode
= 0x34, .opmask
= 0xFF, .size
= 2, .exec
= pl330_dmasev
, },
1098 { .opcode
= 0x00, .opmask
= 0x00, .size
= 0, .exec
= NULL
, }
1101 static inline const PL330InsnDesc
*pl330_fetch_insn(PL330Chan
*ch
)
1106 dma_memory_read(ch
->parent
->mem_as
, ch
->pc
, &opcode
, 1,
1107 MEMTXATTRS_UNSPECIFIED
);
1108 for (i
= 0; insn_desc
[i
].size
; i
++) {
1109 if ((opcode
& insn_desc
[i
].opmask
) == insn_desc
[i
].opcode
) {
1110 return &insn_desc
[i
];
1116 static inline void pl330_exec_insn(PL330Chan
*ch
, const PL330InsnDesc
*insn
)
1118 uint8_t buf
[PL330_INSN_MAXSIZE
];
1120 assert(insn
->size
<= PL330_INSN_MAXSIZE
);
1121 dma_memory_read(ch
->parent
->mem_as
, ch
->pc
, buf
, insn
->size
,
1122 MEMTXATTRS_UNSPECIFIED
);
1123 insn
->exec(ch
, buf
[0], &buf
[1], insn
->size
- 1);
1126 static inline void pl330_update_pc(PL330Chan
*ch
,
1127 const PL330InsnDesc
*insn
)
1129 ch
->pc
+= insn
->size
;
1132 /* Try to execute current instruction in channel CH. Number of executed
1133 instructions is returned (0 or 1). */
1134 static int pl330_chan_exec(PL330Chan
*ch
)
1136 const PL330InsnDesc
*insn
;
1138 if (ch
->state
!= pl330_chan_executing
&&
1139 ch
->state
!= pl330_chan_waiting_periph
&&
1140 ch
->state
!= pl330_chan_at_barrier
&&
1141 ch
->state
!= pl330_chan_waiting_event
) {
1145 insn
= pl330_fetch_insn(ch
);
1147 trace_pl330_chan_exec_undef();
1148 pl330_fault(ch
, PL330_FAULT_UNDEF_INSTR
);
1151 pl330_exec_insn(ch
, insn
);
1153 pl330_update_pc(ch
, insn
);
1154 ch
->watchdog_timer
= 0;
1156 /* WDT only active in exec state */
1157 } else if (ch
->state
== pl330_chan_executing
) {
1158 ch
->watchdog_timer
++;
1159 if (ch
->watchdog_timer
>= PL330_WATCHDOG_LIMIT
) {
1160 pl330_fault(ch
, PL330_FAULT_LOCKUP_ERR
);
1166 /* Try to execute 1 instruction in each channel, one instruction from read
1167 queue and one instruction from write queue. Number of successfully executed
1168 instructions is returned. */
1169 static int pl330_exec_cycle(PL330Chan
*channel
)
1171 PL330State
*s
= channel
->parent
;
1176 uint8_t buf
[PL330_MAX_BURST_LEN
];
1178 /* Execute one instruction in each channel */
1179 num_exec
+= pl330_chan_exec(channel
);
1181 /* Execute one instruction from read queue */
1182 q
= pl330_queue_find_insn(&s
->read_queue
, PL330_UNTAGGED
, true);
1183 if (q
!= NULL
&& q
->len
<= pl330_fifo_num_free(&s
->fifo
)) {
1184 int len
= q
->len
- (q
->addr
& (q
->len
- 1));
1186 dma_memory_read(s
->mem_as
, q
->addr
, buf
, len
,
1187 MEMTXATTRS_UNSPECIFIED
);
1188 trace_pl330_exec_cycle(q
->addr
, len
);
1189 if (trace_event_get_state_backends(TRACE_PL330_HEXDUMP
)) {
1190 pl330_hexdump(buf
, len
);
1192 fifo_res
= pl330_fifo_push(&s
->fifo
, buf
, len
, q
->tag
);
1193 if (fifo_res
== PL330_FIFO_OK
) {
1199 pl330_queue_remove_insn(&s
->read_queue
, q
);
1205 /* Execute one instruction from write queue. */
1206 q
= pl330_queue_find_insn(&s
->write_queue
, pl330_fifo_tag(&s
->fifo
), true);
1208 int len
= q
->len
- (q
->addr
& (q
->len
- 1));
1211 for (i
= 0; i
< len
; i
++) {
1215 fifo_res
= pl330_fifo_get(&s
->fifo
, buf
, len
, q
->tag
);
1217 if (fifo_res
== PL330_FIFO_OK
|| q
->z
) {
1218 dma_memory_write(s
->mem_as
, q
->addr
, buf
, len
,
1219 MEMTXATTRS_UNSPECIFIED
);
1220 trace_pl330_exec_cycle(q
->addr
, len
);
1221 if (trace_event_get_state_backends(TRACE_PL330_HEXDUMP
)) {
1222 pl330_hexdump(buf
, len
);
1228 } else if (fifo_res
== PL330_FIFO_STALL
) {
1229 pl330_fault(&channel
->parent
->chan
[q
->tag
],
1230 PL330_FAULT_FIFOEMPTY_ERR
);
1234 pl330_queue_remove_insn(&s
->write_queue
, q
);
1241 static int pl330_exec_channel(PL330Chan
*channel
)
1245 /* TODO: Is it all right to execute everything or should we do per-cycle
1247 while (pl330_exec_cycle(channel
)) {
1251 /* Detect deadlock */
1252 if (channel
->state
== pl330_chan_executing
) {
1253 pl330_fault(channel
, PL330_FAULT_LOCKUP_ERR
);
1255 /* Situation when one of the queues has deadlocked but all channels
1256 * have finished their programs should be impossible.
1262 static inline void pl330_exec(PL330State
*s
)
1267 insr_exec
= pl330_exec_channel(&s
->manager
);
1269 for (i
= 0; i
< s
->num_chnls
; i
++) {
1270 insr_exec
+= pl330_exec_channel(&s
->chan
[i
]);
1272 } while (insr_exec
);
1275 static void pl330_exec_cycle_timer(void *opaque
)
1277 PL330State
*s
= (PL330State
*)opaque
;
1281 /* Stop or restore dma operations */
1283 static void pl330_dma_stop_irq(void *opaque
, int irq
, int level
)
1285 PL330State
*s
= (PL330State
*)opaque
;
1287 if (s
->periph_busy
[irq
] != level
) {
1288 s
->periph_busy
[irq
] = level
;
1289 timer_mod(s
->timer
, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
));
1293 static void pl330_debug_exec(PL330State
*s
)
1300 const PL330InsnDesc
*insn
;
1302 s
->debug_status
= 1;
1303 chan_id
= (s
->dbg
[0] >> 8) & 0x07;
1304 opcode
= (s
->dbg
[0] >> 16) & 0xff;
1305 args
[0] = (s
->dbg
[0] >> 24) & 0xff;
1306 args
[1] = (s
->dbg
[1] >> 0) & 0xff;
1307 args
[2] = (s
->dbg
[1] >> 8) & 0xff;
1308 args
[3] = (s
->dbg
[1] >> 16) & 0xff;
1309 args
[4] = (s
->dbg
[1] >> 24) & 0xff;
1310 trace_pl330_debug_exec(chan_id
);
1311 if (s
->dbg
[0] & 1) {
1312 ch
= &s
->chan
[chan_id
];
1317 for (i
= 0; debug_insn_desc
[i
].size
; i
++) {
1318 if ((opcode
& debug_insn_desc
[i
].opmask
) == debug_insn_desc
[i
].opcode
) {
1319 insn
= &debug_insn_desc
[i
];
1323 pl330_fault(ch
, PL330_FAULT_UNDEF_INSTR
| PL330_FAULT_DBG_INSTR
);
1327 insn
->exec(ch
, opcode
, args
, insn
->size
- 1);
1328 if (ch
->fault_type
) {
1329 ch
->fault_type
|= PL330_FAULT_DBG_INSTR
;
1332 trace_pl330_debug_exec_stall();
1333 qemu_log_mask(LOG_UNIMP
, "pl330: stall of debug instruction not "
1336 s
->debug_status
= 0;
1339 /* IOMEM mapped registers */
1341 static void pl330_iomem_write(void *opaque
, hwaddr offset
,
1342 uint64_t value
, unsigned size
)
1344 PL330State
*s
= (PL330State
*) opaque
;
1347 trace_pl330_iomem_write((unsigned)offset
, (unsigned)value
);
1350 case PL330_REG_INTEN
:
1353 case PL330_REG_INTCLR
:
1354 for (i
= 0; i
< s
->num_events
; i
++) {
1355 if (s
->int_status
& s
->inten
& value
& (1 << i
)) {
1356 trace_pl330_iomem_write_clr(i
);
1357 qemu_irq_lower(s
->irq
[i
]);
1360 s
->ev_status
&= ~(value
& s
->inten
);
1361 s
->int_status
&= ~(value
& s
->inten
);
1363 case PL330_REG_DBGCMD
:
1364 if ((value
& 3) == 0) {
1365 pl330_debug_exec(s
);
1368 qemu_log_mask(LOG_GUEST_ERROR
, "pl330: write of illegal value %u "
1369 "for offset " HWADDR_FMT_plx
"\n", (unsigned)value
,
1373 case PL330_REG_DBGINST0
:
1376 case PL330_REG_DBGINST1
:
1380 qemu_log_mask(LOG_GUEST_ERROR
, "pl330: bad write offset " HWADDR_FMT_plx
1386 static inline uint32_t pl330_iomem_read_imp(void *opaque
,
1389 PL330State
*s
= (PL330State
*)opaque
;
1394 if (offset
>= PL330_REG_PERIPH_ID
&& offset
< PL330_REG_PERIPH_ID
+ 32) {
1395 return pl330_id
[(offset
- PL330_REG_PERIPH_ID
) >> 2];
1397 if (offset
>= PL330_REG_CR0_BASE
&& offset
< PL330_REG_CR0_BASE
+ 24) {
1398 return s
->cfg
[(offset
- PL330_REG_CR0_BASE
) >> 2];
1400 if (offset
>= PL330_REG_CHANCTRL
&& offset
< PL330_REG_DBGSTATUS
) {
1401 offset
-= PL330_REG_CHANCTRL
;
1402 chan_id
= offset
>> 5;
1403 if (chan_id
>= s
->num_chnls
) {
1404 qemu_log_mask(LOG_GUEST_ERROR
, "pl330: bad read offset "
1405 HWADDR_FMT_plx
"\n", offset
);
1408 switch (offset
& 0x1f) {
1410 return s
->chan
[chan_id
].src
;
1412 return s
->chan
[chan_id
].dst
;
1414 return s
->chan
[chan_id
].control
;
1416 return s
->chan
[chan_id
].lc
[0];
1418 return s
->chan
[chan_id
].lc
[1];
1420 qemu_log_mask(LOG_GUEST_ERROR
, "pl330: bad read offset "
1421 HWADDR_FMT_plx
"\n", offset
);
1425 if (offset
>= PL330_REG_CSR_BASE
&& offset
< 0x400) {
1426 offset
-= PL330_REG_CSR_BASE
;
1427 chan_id
= offset
>> 3;
1428 if (chan_id
>= s
->num_chnls
) {
1429 qemu_log_mask(LOG_GUEST_ERROR
, "pl330: bad read offset "
1430 HWADDR_FMT_plx
"\n", offset
);
1433 switch ((offset
>> 2) & 1) {
1435 res
= (s
->chan
[chan_id
].ns
<< 21) |
1436 (s
->chan
[chan_id
].wakeup
<< 4) |
1437 (s
->chan
[chan_id
].state
) |
1438 (s
->chan
[chan_id
].wfp_sbp
<< 14);
1441 return s
->chan
[chan_id
].pc
;
1443 qemu_log_mask(LOG_GUEST_ERROR
, "pl330: read error\n");
1447 if (offset
>= PL330_REG_FTR_BASE
&& offset
< 0x100) {
1448 offset
-= PL330_REG_FTR_BASE
;
1449 chan_id
= offset
>> 2;
1450 if (chan_id
>= s
->num_chnls
) {
1451 qemu_log_mask(LOG_GUEST_ERROR
, "pl330: bad read offset "
1452 HWADDR_FMT_plx
"\n", offset
);
1455 return s
->chan
[chan_id
].fault_type
;
1459 return (s
->manager
.ns
<< 9) | (s
->manager
.wakeup
<< 4) |
1460 (s
->manager
.state
& 0xf);
1462 return s
->manager
.pc
;
1463 case PL330_REG_INTEN
:
1465 case PL330_REG_INT_EVENT_RIS
:
1466 return s
->ev_status
;
1467 case PL330_REG_INTMIS
:
1468 return s
->int_status
;
1469 case PL330_REG_INTCLR
:
1470 /* Documentation says that we can't read this register
1471 * but linux kernel does it
1474 case PL330_REG_FSRD
:
1475 return s
->manager
.state
? 1 : 0;
1476 case PL330_REG_FSRC
:
1478 for (i
= 0; i
< s
->num_chnls
; i
++) {
1479 if (s
->chan
[i
].state
== pl330_chan_fault
||
1480 s
->chan
[i
].state
== pl330_chan_fault_completing
) {
1485 case PL330_REG_FTRD
:
1486 return s
->manager
.fault_type
;
1487 case PL330_REG_DBGSTATUS
:
1488 return s
->debug_status
;
1490 qemu_log_mask(LOG_GUEST_ERROR
, "pl330: bad read offset "
1491 HWADDR_FMT_plx
"\n", offset
);
1496 static uint64_t pl330_iomem_read(void *opaque
, hwaddr offset
,
1499 uint32_t ret
= pl330_iomem_read_imp(opaque
, offset
);
1500 trace_pl330_iomem_read((uint32_t)offset
, ret
);
1504 static const MemoryRegionOps pl330_ops
= {
1505 .read
= pl330_iomem_read
,
1506 .write
= pl330_iomem_write
,
1507 .endianness
= DEVICE_NATIVE_ENDIAN
,
1509 .min_access_size
= 4,
1510 .max_access_size
= 4,
1514 /* Controller logic and initialization */
1516 static void pl330_chan_reset(PL330Chan
*ch
)
1521 ch
->state
= pl330_chan_stopped
;
1522 ch
->watchdog_timer
= 0;
1529 static void pl330_reset(DeviceState
*d
)
1532 PL330State
*s
= PL330(d
);
1537 s
->debug_status
= 0;
1538 s
->num_faulting
= 0;
1539 s
->manager
.ns
= s
->mgr_ns_at_rst
;
1540 pl330_fifo_reset(&s
->fifo
);
1541 pl330_queue_reset(&s
->read_queue
);
1542 pl330_queue_reset(&s
->write_queue
);
1544 for (i
= 0; i
< s
->num_chnls
; i
++) {
1545 pl330_chan_reset(&s
->chan
[i
]);
1547 for (i
= 0; i
< s
->num_periph_req
; i
++) {
1548 s
->periph_busy
[i
] = 0;
1551 timer_del(s
->timer
);
1554 static void pl330_realize(DeviceState
*dev
, Error
**errp
)
1557 PL330State
*s
= PL330(dev
);
1559 sysbus_init_irq(SYS_BUS_DEVICE(dev
), &s
->irq_abort
);
1560 memory_region_init_io(&s
->iomem
, OBJECT(s
), &pl330_ops
, s
,
1561 "dma", PL330_IOMEM_SIZE
);
1562 sysbus_init_mmio(SYS_BUS_DEVICE(dev
), &s
->iomem
);
1565 error_setg(errp
, "'memory' link is not set");
1567 } else if (s
->mem_mr
== get_system_memory()) {
1568 /* Avoid creating new AS for system memory. */
1569 s
->mem_as
= &address_space_memory
;
1571 s
->mem_as
= g_new0(AddressSpace
, 1);
1572 address_space_init(s
->mem_as
, s
->mem_mr
,
1573 memory_region_name(s
->mem_mr
));
1576 s
->timer
= timer_new_ns(QEMU_CLOCK_VIRTUAL
, pl330_exec_cycle_timer
, s
);
1578 s
->cfg
[0] = (s
->mgr_ns_at_rst
? 0x4 : 0) |
1579 (s
->num_periph_req
> 0 ? 1 : 0) |
1580 ((s
->num_chnls
- 1) & 0x7) << 4 |
1581 ((s
->num_periph_req
- 1) & 0x1f) << 12 |
1582 ((s
->num_events
- 1) & 0x1f) << 17;
1584 switch (s
->i_cache_len
) {
1598 error_setg(errp
, "Bad value for i-cache_len property: %" PRIx8
,
1602 s
->cfg
[1] |= ((s
->num_i_cache_lines
- 1) & 0xf) << 4;
1604 s
->chan
= g_new0(PL330Chan
, s
->num_chnls
);
1605 s
->hi_seqn
= g_new0(uint8_t, s
->num_chnls
);
1606 s
->lo_seqn
= g_new0(uint8_t, s
->num_chnls
);
1607 for (i
= 0; i
< s
->num_chnls
; i
++) {
1608 s
->chan
[i
].parent
= s
;
1609 s
->chan
[i
].tag
= (uint8_t)i
;
1611 s
->manager
.parent
= s
;
1612 s
->manager
.tag
= s
->num_chnls
;
1613 s
->manager
.is_manager
= true;
1615 s
->irq
= g_new0(qemu_irq
, s
->num_events
);
1616 for (i
= 0; i
< s
->num_events
; i
++) {
1617 sysbus_init_irq(SYS_BUS_DEVICE(dev
), &s
->irq
[i
]);
1620 qdev_init_gpio_in(dev
, pl330_dma_stop_irq
, PL330_PERIPH_NUM
);
1622 switch (s
->data_width
) {
1624 s
->cfg
[CFG_CRD
] |= 0x2;
1627 s
->cfg
[CFG_CRD
] |= 0x3;
1630 s
->cfg
[CFG_CRD
] |= 0x4;
1633 error_setg(errp
, "Bad value for data_width property: %" PRIx8
,
1638 s
->cfg
[CFG_CRD
] |= ((s
->wr_cap
- 1) & 0x7) << 4 |
1639 ((s
->wr_q_dep
- 1) & 0xf) << 8 |
1640 ((s
->rd_cap
- 1) & 0x7) << 12 |
1641 ((s
->rd_q_dep
- 1) & 0xf) << 16 |
1642 ((s
->data_buffer_dep
- 1) & 0x1ff) << 20;
1644 pl330_queue_init(&s
->read_queue
, s
->rd_q_dep
, s
);
1645 pl330_queue_init(&s
->write_queue
, s
->wr_q_dep
, s
);
1646 pl330_fifo_init(&s
->fifo
, s
->data_width
/ 4 * s
->data_buffer_dep
);
1649 static Property pl330_properties
[] = {
1651 DEFINE_PROP_UINT32("num_chnls", PL330State
, num_chnls
, 8),
1652 DEFINE_PROP_UINT8("num_periph_req", PL330State
, num_periph_req
, 4),
1653 DEFINE_PROP_UINT8("num_events", PL330State
, num_events
, 16),
1654 DEFINE_PROP_UINT8("mgr_ns_at_rst", PL330State
, mgr_ns_at_rst
, 0),
1656 DEFINE_PROP_UINT8("i-cache_len", PL330State
, i_cache_len
, 4),
1657 DEFINE_PROP_UINT8("num_i-cache_lines", PL330State
, num_i_cache_lines
, 8),
1659 DEFINE_PROP_UINT32("boot_addr", PL330State
, cfg
[CFG_BOOT_ADDR
], 0),
1660 DEFINE_PROP_UINT32("INS", PL330State
, cfg
[CFG_INS
], 0),
1661 DEFINE_PROP_UINT32("PNS", PL330State
, cfg
[CFG_PNS
], 0),
1663 DEFINE_PROP_UINT8("data_width", PL330State
, data_width
, 64),
1664 DEFINE_PROP_UINT8("wr_cap", PL330State
, wr_cap
, 8),
1665 DEFINE_PROP_UINT8("wr_q_dep", PL330State
, wr_q_dep
, 16),
1666 DEFINE_PROP_UINT8("rd_cap", PL330State
, rd_cap
, 8),
1667 DEFINE_PROP_UINT8("rd_q_dep", PL330State
, rd_q_dep
, 16),
1668 DEFINE_PROP_UINT16("data_buffer_dep", PL330State
, data_buffer_dep
, 256),
1670 DEFINE_PROP_LINK("memory", PL330State
, mem_mr
,
1671 TYPE_MEMORY_REGION
, MemoryRegion
*),
1673 DEFINE_PROP_END_OF_LIST(),
1676 static void pl330_class_init(ObjectClass
*klass
, void *data
)
1678 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1680 dc
->realize
= pl330_realize
;
1681 dc
->reset
= pl330_reset
;
1682 device_class_set_props(dc
, pl330_properties
);
1683 dc
->vmsd
= &vmstate_pl330
;
1686 static const TypeInfo pl330_type_info
= {
1688 .parent
= TYPE_SYS_BUS_DEVICE
,
1689 .instance_size
= sizeof(PL330State
),
1690 .class_init
= pl330_class_init
,
1693 static void pl330_register_types(void)
1695 type_register_static(&pl330_type_info
);
1698 type_init(pl330_register_types
)