2 * QEMU model of the Xilinx Zynq Devcfg Interface
4 * (C) 2011 PetaLogix Pty Ltd
6 * Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com>
8 * Permission is hereby granted, free of charge, to any person obtaining a copy
9 * of this software and associated documentation files (the "Software"), to deal
10 * in the Software without restriction, including without limitation the rights
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12 * copies of the Software, and to permit persons to whom the Software is
13 * furnished to do so, subject to the following conditions:
15 * The above copyright notice and this permission notice shall be included in
16 * all copies or substantial portions of the Software.
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
27 #include "qemu/osdep.h"
28 #include "hw/dma/xlnx-zynq-devcfg.h"
29 #include "qemu/bitops.h"
30 #include "sysemu/sysemu.h"
31 #include "sysemu/dma.h"
33 #include "qemu/module.h"
35 #define FREQ_HZ 900000000
39 #ifndef XLNX_ZYNQ_DEVCFG_ERR_DEBUG
40 #define XLNX_ZYNQ_DEVCFG_ERR_DEBUG 0
43 #define DB_PRINT(fmt, args...) do { \
44 if (XLNX_ZYNQ_DEVCFG_ERR_DEBUG) { \
45 qemu_log("%s: " fmt, __func__, ## args); \
50 FIELD(CTRL
, FORCE_RST
, 31, 1) /* Not supported, wr ignored */
51 FIELD(CTRL
, PCAP_PR
, 27, 1) /* Forced to 0 on bad unlock */
52 FIELD(CTRL
, PCAP_MODE
, 26, 1)
53 FIELD(CTRL
, MULTIBOOT_EN
, 24, 1)
54 FIELD(CTRL
, USER_MODE
, 15, 1)
55 FIELD(CTRL
, PCFG_AES_FUSE
, 12, 1)
56 FIELD(CTRL
, PCFG_AES_EN
, 9, 3)
57 FIELD(CTRL
, SEU_EN
, 8, 1)
58 FIELD(CTRL
, SEC_EN
, 7, 1)
59 FIELD(CTRL
, SPNIDEN
, 6, 1)
60 FIELD(CTRL
, SPIDEN
, 5, 1)
61 FIELD(CTRL
, NIDEN
, 4, 1)
62 FIELD(CTRL
, DBGEN
, 3, 1)
63 FIELD(CTRL
, DAP_EN
, 0, 3)
66 #define AES_FUSE_LOCK 4
72 /* mapping bits in R_LOCK to what they lock in R_CTRL */
73 static const uint32_t lock_ctrl_map
[] = {
74 [AES_FUSE_LOCK
] = R_CTRL_PCFG_AES_FUSE_MASK
,
75 [AES_EN_LOCK
] = R_CTRL_PCFG_AES_EN_MASK
,
76 [SEU_LOCK
] = R_CTRL_SEU_EN_MASK
,
77 [SEC_LOCK
] = R_CTRL_SEC_EN_MASK
,
78 [DBG_LOCK
] = R_CTRL_SPNIDEN_MASK
| R_CTRL_SPIDEN_MASK
|
79 R_CTRL_NIDEN_MASK
| R_CTRL_DBGEN_MASK
|
84 FIELD(CFG
, RFIFO_TH
, 10, 2)
85 FIELD(CFG
, WFIFO_TH
, 8, 2)
86 FIELD(CFG
, RCLK_EDGE
, 7, 1)
87 FIELD(CFG
, WCLK_EDGE
, 6, 1)
88 FIELD(CFG
, DISABLE_SRC_INC
, 5, 1)
89 FIELD(CFG
, DISABLE_DST_INC
, 4, 1)
90 #define R_CFG_RESET 0x50B
93 FIELD(INT_STS
, PSS_GTS_USR_B
, 31, 1)
94 FIELD(INT_STS
, PSS_FST_CFG_B
, 30, 1)
95 FIELD(INT_STS
, PSS_CFG_RESET_B
, 27, 1)
96 FIELD(INT_STS
, RX_FIFO_OV
, 18, 1)
97 FIELD(INT_STS
, WR_FIFO_LVL
, 17, 1)
98 FIELD(INT_STS
, RD_FIFO_LVL
, 16, 1)
99 FIELD(INT_STS
, DMA_CMD_ERR
, 15, 1)
100 FIELD(INT_STS
, DMA_Q_OV
, 14, 1)
101 FIELD(INT_STS
, DMA_DONE
, 13, 1)
102 FIELD(INT_STS
, DMA_P_DONE
, 12, 1)
103 FIELD(INT_STS
, P2D_LEN_ERR
, 11, 1)
104 FIELD(INT_STS
, PCFG_DONE
, 2, 1)
105 #define R_INT_STS_RSVD ((0x7 << 24) | (0x1 << 19) | (0xF < 7))
107 REG32(INT_MASK
, 0x10)
110 FIELD(STATUS
, DMA_CMD_Q_F
, 31, 1)
111 FIELD(STATUS
, DMA_CMD_Q_E
, 30, 1)
112 FIELD(STATUS
, DMA_DONE_CNT
, 28, 2)
113 FIELD(STATUS
, RX_FIFO_LVL
, 20, 5)
114 FIELD(STATUS
, TX_FIFO_LVL
, 12, 7)
115 FIELD(STATUS
, PSS_GTS_USR_B
, 11, 1)
116 FIELD(STATUS
, PSS_FST_CFG_B
, 10, 1)
117 FIELD(STATUS
, PSS_CFG_RESET_B
, 5, 1)
119 REG32(DMA_SRC_ADDR
, 0x18)
120 REG32(DMA_DST_ADDR
, 0x1C)
121 REG32(DMA_SRC_LEN
, 0x20)
122 REG32(DMA_DST_LEN
, 0x24)
123 REG32(ROM_SHADOW
, 0x28)
127 #define R_UNLOCK_MAGIC 0x757BDF0D
130 FIELD(MCTRL
, PS_VERSION
, 28, 4)
131 FIELD(MCTRL
, PCFG_POR_B
, 8, 1)
132 FIELD(MCTRL
, INT_PCAP_LPBK
, 4, 1)
133 FIELD(MCTRL
, QEMU
, 3, 1)
135 static void xlnx_zynq_devcfg_update_ixr(XlnxZynqDevcfg
*s
)
137 qemu_set_irq(s
->irq
, ~s
->regs
[R_INT_MASK
] & s
->regs
[R_INT_STS
]);
140 static void xlnx_zynq_devcfg_reset(DeviceState
*dev
)
142 XlnxZynqDevcfg
*s
= XLNX_ZYNQ_DEVCFG(dev
);
145 for (i
= 0; i
< XLNX_ZYNQ_DEVCFG_R_MAX
; ++i
) {
146 register_reset(&s
->regs_info
[i
]);
150 static void xlnx_zynq_devcfg_dma_go(XlnxZynqDevcfg
*s
)
153 uint8_t buf
[BTT_MAX
];
154 XlnxZynqDevcfgDMACmd
*dmah
= s
->dma_cmd_fifo
;
155 uint32_t btt
= BTT_MAX
;
156 bool loopback
= s
->regs
[R_MCTRL
] & R_MCTRL_INT_PCAP_LPBK_MASK
;
158 btt
= MIN(btt
, dmah
->src_len
);
160 btt
= MIN(btt
, dmah
->dest_len
);
162 DB_PRINT("reading %x bytes from %x\n", btt
, dmah
->src_addr
);
163 dma_memory_read(&address_space_memory
, dmah
->src_addr
, buf
, btt
);
164 dmah
->src_len
-= btt
;
165 dmah
->src_addr
+= btt
;
166 if (loopback
&& (dmah
->src_len
|| dmah
->dest_len
)) {
167 DB_PRINT("writing %x bytes from %x\n", btt
, dmah
->dest_addr
);
168 dma_memory_write(&address_space_memory
, dmah
->dest_addr
, buf
, btt
);
169 dmah
->dest_len
-= btt
;
170 dmah
->dest_addr
+= btt
;
172 if (!dmah
->src_len
&& !dmah
->dest_len
) {
173 DB_PRINT("dma operation finished\n");
174 s
->regs
[R_INT_STS
] |= R_INT_STS_DMA_DONE_MASK
|
175 R_INT_STS_DMA_P_DONE_MASK
;
176 s
->dma_cmd_fifo_num
--;
177 memmove(s
->dma_cmd_fifo
, &s
->dma_cmd_fifo
[1],
178 sizeof(s
->dma_cmd_fifo
) - sizeof(s
->dma_cmd_fifo
[0]));
180 xlnx_zynq_devcfg_update_ixr(s
);
181 } while (s
->dma_cmd_fifo_num
);
184 static void r_ixr_post_write(RegisterInfo
*reg
, uint64_t val
)
186 XlnxZynqDevcfg
*s
= XLNX_ZYNQ_DEVCFG(reg
->opaque
);
188 xlnx_zynq_devcfg_update_ixr(s
);
191 static uint64_t r_ctrl_pre_write(RegisterInfo
*reg
, uint64_t val
)
193 XlnxZynqDevcfg
*s
= XLNX_ZYNQ_DEVCFG(reg
->opaque
);
196 for (i
= 0; i
< ARRAY_SIZE(lock_ctrl_map
); ++i
) {
197 if (s
->regs
[R_LOCK
] & 1 << i
) {
198 val
&= ~lock_ctrl_map
[i
];
199 val
|= lock_ctrl_map
[i
] & s
->regs
[R_CTRL
];
205 static void r_ctrl_post_write(RegisterInfo
*reg
, uint64_t val
)
207 const char *device_prefix
= object_get_typename(OBJECT(reg
->opaque
));
208 uint32_t aes_en
= FIELD_EX32(val
, CTRL
, PCFG_AES_EN
);
210 if (aes_en
!= 0 && aes_en
!= 7) {
211 qemu_log_mask(LOG_UNIMP
, "%s: warning, aes-en bits inconsistent,"
212 "unimplemented security reset should happen!\n",
217 static void r_unlock_post_write(RegisterInfo
*reg
, uint64_t val
)
219 XlnxZynqDevcfg
*s
= XLNX_ZYNQ_DEVCFG(reg
->opaque
);
220 const char *device_prefix
= object_get_typename(OBJECT(s
));
222 if (val
== R_UNLOCK_MAGIC
) {
223 DB_PRINT("successful unlock\n");
224 s
->regs
[R_CTRL
] |= R_CTRL_PCAP_PR_MASK
;
225 s
->regs
[R_CTRL
] |= R_CTRL_PCFG_AES_EN_MASK
;
226 memory_region_set_enabled(&s
->iomem
, true);
227 } else { /* bad unlock attempt */
228 qemu_log_mask(LOG_GUEST_ERROR
, "%s: failed unlock\n", device_prefix
);
229 s
->regs
[R_CTRL
] &= ~R_CTRL_PCAP_PR_MASK
;
230 s
->regs
[R_CTRL
] &= ~R_CTRL_PCFG_AES_EN_MASK
;
231 /* core becomes inaccessible */
232 memory_region_set_enabled(&s
->iomem
, false);
236 static uint64_t r_lock_pre_write(RegisterInfo
*reg
, uint64_t val
)
238 XlnxZynqDevcfg
*s
= XLNX_ZYNQ_DEVCFG(reg
->opaque
);
240 /* once bits are locked they stay locked */
241 return s
->regs
[R_LOCK
] | val
;
244 static void r_dma_dst_len_post_write(RegisterInfo
*reg
, uint64_t val
)
246 XlnxZynqDevcfg
*s
= XLNX_ZYNQ_DEVCFG(reg
->opaque
);
248 s
->dma_cmd_fifo
[s
->dma_cmd_fifo_num
] = (XlnxZynqDevcfgDMACmd
) {
249 .src_addr
= s
->regs
[R_DMA_SRC_ADDR
] & ~0x3UL
,
250 .dest_addr
= s
->regs
[R_DMA_DST_ADDR
] & ~0x3UL
,
251 .src_len
= s
->regs
[R_DMA_SRC_LEN
] << 2,
252 .dest_len
= s
->regs
[R_DMA_DST_LEN
] << 2,
254 s
->dma_cmd_fifo_num
++;
255 DB_PRINT("dma transfer started; %d total transfers pending\n",
256 s
->dma_cmd_fifo_num
);
257 xlnx_zynq_devcfg_dma_go(s
);
260 static const RegisterAccessInfo xlnx_zynq_devcfg_regs_info
[] = {
261 { .name
= "CTRL", .addr
= A_CTRL
,
262 .reset
= R_CTRL_PCAP_PR_MASK
| R_CTRL_PCAP_MODE_MASK
| 0x3 << 13,
263 .rsvd
= 0x1 << 28 | 0x3ff << 13 | 0x3 << 13,
264 .pre_write
= r_ctrl_pre_write
,
265 .post_write
= r_ctrl_post_write
,
267 { .name
= "LOCK", .addr
= A_LOCK
,
268 .rsvd
= MAKE_64BIT_MASK(5, 64 - 5),
269 .pre_write
= r_lock_pre_write
,
271 { .name
= "CFG", .addr
= A_CFG
,
272 .reset
= R_CFG_RESET
,
275 { .name
= "INT_STS", .addr
= A_INT_STS
,
276 .w1c
= ~R_INT_STS_RSVD
,
277 .reset
= R_INT_STS_PSS_GTS_USR_B_MASK
|
278 R_INT_STS_PSS_CFG_RESET_B_MASK
|
279 R_INT_STS_WR_FIFO_LVL_MASK
,
280 .rsvd
= R_INT_STS_RSVD
,
281 .post_write
= r_ixr_post_write
,
283 { .name
= "INT_MASK", .addr
= A_INT_MASK
,
285 .rsvd
= R_INT_STS_RSVD
,
286 .post_write
= r_ixr_post_write
,
288 { .name
= "STATUS", .addr
= A_STATUS
,
289 .reset
= R_STATUS_DMA_CMD_Q_E_MASK
|
290 R_STATUS_PSS_GTS_USR_B_MASK
|
291 R_STATUS_PSS_CFG_RESET_B_MASK
,
294 { .name
= "DMA_SRC_ADDR", .addr
= A_DMA_SRC_ADDR
, },
295 { .name
= "DMA_DST_ADDR", .addr
= A_DMA_DST_ADDR
, },
296 { .name
= "DMA_SRC_LEN", .addr
= A_DMA_SRC_LEN
,
297 .ro
= MAKE_64BIT_MASK(27, 64 - 27) },
298 { .name
= "DMA_DST_LEN", .addr
= A_DMA_DST_LEN
,
299 .ro
= MAKE_64BIT_MASK(27, 64 - 27),
300 .post_write
= r_dma_dst_len_post_write
,
302 { .name
= "ROM_SHADOW", .addr
= A_ROM_SHADOW
,
305 { .name
= "SW_ID", .addr
= A_SW_ID
, },
306 { .name
= "UNLOCK", .addr
= A_UNLOCK
,
307 .post_write
= r_unlock_post_write
,
309 { .name
= "MCTRL", .addr
= R_MCTRL
* 4,
310 /* Silicon 3.0 for version field, the mysterious reserved bit 23
311 * and QEMU platform identifier.
313 .reset
= 0x2 << R_MCTRL_PS_VERSION_SHIFT
| 1 << 23 | R_MCTRL_QEMU_MASK
,
314 .ro
= ~R_MCTRL_INT_PCAP_LPBK_MASK
,
319 static const MemoryRegionOps xlnx_zynq_devcfg_reg_ops
= {
320 .read
= register_read_memory
,
321 .write
= register_write_memory
,
322 .endianness
= DEVICE_LITTLE_ENDIAN
,
324 .min_access_size
= 4,
325 .max_access_size
= 4,
329 static const VMStateDescription vmstate_xlnx_zynq_devcfg_dma_cmd
= {
330 .name
= "xlnx_zynq_devcfg_dma_cmd",
332 .minimum_version_id
= 1,
333 .fields
= (VMStateField
[]) {
334 VMSTATE_UINT32(src_addr
, XlnxZynqDevcfgDMACmd
),
335 VMSTATE_UINT32(dest_addr
, XlnxZynqDevcfgDMACmd
),
336 VMSTATE_UINT32(src_len
, XlnxZynqDevcfgDMACmd
),
337 VMSTATE_UINT32(dest_len
, XlnxZynqDevcfgDMACmd
),
338 VMSTATE_END_OF_LIST()
342 static const VMStateDescription vmstate_xlnx_zynq_devcfg
= {
343 .name
= "xlnx_zynq_devcfg",
345 .minimum_version_id
= 1,
346 .fields
= (VMStateField
[]) {
347 VMSTATE_STRUCT_ARRAY(dma_cmd_fifo
, XlnxZynqDevcfg
,
348 XLNX_ZYNQ_DEVCFG_DMA_CMD_FIFO_LEN
, 0,
349 vmstate_xlnx_zynq_devcfg_dma_cmd
,
350 XlnxZynqDevcfgDMACmd
),
351 VMSTATE_UINT8(dma_cmd_fifo_num
, XlnxZynqDevcfg
),
352 VMSTATE_UINT32_ARRAY(regs
, XlnxZynqDevcfg
, XLNX_ZYNQ_DEVCFG_R_MAX
),
353 VMSTATE_END_OF_LIST()
357 static void xlnx_zynq_devcfg_init(Object
*obj
)
359 SysBusDevice
*sbd
= SYS_BUS_DEVICE(obj
);
360 XlnxZynqDevcfg
*s
= XLNX_ZYNQ_DEVCFG(obj
);
361 RegisterInfoArray
*reg_array
;
363 sysbus_init_irq(sbd
, &s
->irq
);
365 memory_region_init(&s
->iomem
, obj
, "devcfg", XLNX_ZYNQ_DEVCFG_R_MAX
* 4);
367 register_init_block32(DEVICE(obj
), xlnx_zynq_devcfg_regs_info
,
368 ARRAY_SIZE(xlnx_zynq_devcfg_regs_info
),
369 s
->regs_info
, s
->regs
,
370 &xlnx_zynq_devcfg_reg_ops
,
371 XLNX_ZYNQ_DEVCFG_ERR_DEBUG
,
372 XLNX_ZYNQ_DEVCFG_R_MAX
);
373 memory_region_add_subregion(&s
->iomem
,
377 sysbus_init_mmio(sbd
, &s
->iomem
);
380 static void xlnx_zynq_devcfg_class_init(ObjectClass
*klass
, void *data
)
382 DeviceClass
*dc
= DEVICE_CLASS(klass
);
384 dc
->reset
= xlnx_zynq_devcfg_reset
;
385 dc
->vmsd
= &vmstate_xlnx_zynq_devcfg
;
388 static const TypeInfo xlnx_zynq_devcfg_info
= {
389 .name
= TYPE_XLNX_ZYNQ_DEVCFG
,
390 .parent
= TYPE_SYS_BUS_DEVICE
,
391 .instance_size
= sizeof(XlnxZynqDevcfg
),
392 .instance_init
= xlnx_zynq_devcfg_init
,
393 .class_init
= xlnx_zynq_devcfg_class_init
,
396 static void xlnx_zynq_devcfg_register_types(void)
398 type_register_static(&xlnx_zynq_devcfg_info
);
401 type_init(xlnx_zynq_devcfg_register_types
)