2 * DEC 21272 (TSUNAMI/TYPHOON) chipset emulation.
4 * Written by Richard Henderson.
6 * This work is licensed under the GNU GPL license version 2 or later.
10 #include "exec/exec-all.h"
12 #include "hw/devices.h"
13 #include "sysemu/sysemu.h"
14 #include "hw/alpha_sys.h"
15 #include "exec/address-spaces.h"
18 #define TYPE_TYPHOON_PCI_HOST_BRIDGE "typhoon-pcihost"
20 typedef struct TyphoonCchip
{
29 typedef struct TyphoonWindow
{
32 uint32_t translated_base_pfn
;
35 typedef struct TyphoonPchip
{
37 MemoryRegion reg_iack
;
40 MemoryRegion reg_conf
;
45 #define TYPHOON_PCI_HOST_BRIDGE(obj) \
46 OBJECT_CHECK(TyphoonState, (obj), TYPE_TYPHOON_PCI_HOST_BRIDGE)
48 typedef struct TyphoonState
{
49 PCIHostState parent_obj
;
53 MemoryRegion dchip_region
;
54 MemoryRegion ram_region
;
56 /* QEMU emulation state. */
60 /* Called when one of DRIR or DIM changes. */
61 static void cpu_irq_change(AlphaCPU
*cpu
, uint64_t req
)
63 /* If there are any non-masked interrupts, tell the cpu. */
65 CPUState
*cs
= CPU(cpu
);
67 cpu_interrupt(cs
, CPU_INTERRUPT_HARD
);
69 cpu_reset_interrupt(cs
, CPU_INTERRUPT_HARD
);
74 static uint64_t cchip_read(void *opaque
, hwaddr addr
, unsigned size
)
76 CPUAlphaState
*env
= cpu_single_env
;
77 TyphoonState
*s
= opaque
;
87 /* CSC: Cchip System Configuration Register. */
88 /* All sorts of data here; probably the only thing relevant is
89 PIP<14> Pchip 1 Present = 0. */
93 /* MTR: Memory Timing Register. */
94 /* All sorts of stuff related to real DRAM. */
98 /* MISC: Miscellaneous Register. */
99 cpu
= ENV_GET_CPU(env
);
100 ret
= s
->cchip
.misc
| (cpu
->cpu_index
& 3);
104 /* MPD: Memory Presence Detect Register. */
107 case 0x0100: /* AAR0 */
108 case 0x0140: /* AAR1 */
109 case 0x0180: /* AAR2 */
110 case 0x01c0: /* AAR3 */
111 /* AAR: Array Address Register. */
112 /* All sorts of information about DRAM. */
116 /* DIM0: Device Interrupt Mask Register, CPU0. */
117 ret
= s
->cchip
.dim
[0];
120 /* DIM1: Device Interrupt Mask Register, CPU1. */
121 ret
= s
->cchip
.dim
[1];
124 /* DIR0: Device Interrupt Request Register, CPU0. */
125 ret
= s
->cchip
.dim
[0] & s
->cchip
.drir
;
128 /* DIR1: Device Interrupt Request Register, CPU1. */
129 ret
= s
->cchip
.dim
[1] & s
->cchip
.drir
;
132 /* DRIR: Device Raw Interrupt Request Register. */
137 /* PRBEN: Probe Enable Register. */
141 /* IIC0: Interval Ignore Count Register, CPU0. */
142 ret
= s
->cchip
.iic
[0];
145 /* IIC1: Interval Ignore Count Register, CPU1. */
146 ret
= s
->cchip
.iic
[1];
149 case 0x0400: /* MPR0 */
150 case 0x0440: /* MPR1 */
151 case 0x0480: /* MPR2 */
152 case 0x04c0: /* MPR3 */
153 /* MPR: Memory Programming Register. */
157 /* TTR: TIGbus Timing Register. */
158 /* All sorts of stuff related to interrupt delivery timings. */
161 /* TDR: TIGbug Device Timing Register. */
165 /* DIM2: Device Interrupt Mask Register, CPU2. */
166 ret
= s
->cchip
.dim
[2];
169 /* DIM3: Device Interrupt Mask Register, CPU3. */
170 ret
= s
->cchip
.dim
[3];
173 /* DIR2: Device Interrupt Request Register, CPU2. */
174 ret
= s
->cchip
.dim
[2] & s
->cchip
.drir
;
177 /* DIR3: Device Interrupt Request Register, CPU3. */
178 ret
= s
->cchip
.dim
[3] & s
->cchip
.drir
;
182 /* IIC2: Interval Ignore Count Register, CPU2. */
183 ret
= s
->cchip
.iic
[2];
186 /* IIC3: Interval Ignore Count Register, CPU3. */
187 ret
= s
->cchip
.iic
[3];
191 /* PWR: Power Management Control. */
194 case 0x0c00: /* CMONCTLA */
195 case 0x0c40: /* CMONCTLB */
196 case 0x0c80: /* CMONCNT01 */
197 case 0x0cc0: /* CMONCNT23 */
201 cpu_unassigned_access(cpu_single_env
, addr
, 0, 0, 0, size
);
205 s
->latch_tmp
= ret
>> 32;
209 static uint64_t dchip_read(void *opaque
, hwaddr addr
, unsigned size
)
211 /* Skip this. It's all related to DRAM timing and setup. */
215 static uint64_t pchip_read(void *opaque
, hwaddr addr
, unsigned size
)
217 TyphoonState
*s
= opaque
;
226 /* WSBA0: Window Space Base Address Register. */
227 ret
= s
->pchip
.win
[0].base_addr
;
231 ret
= s
->pchip
.win
[1].base_addr
;
235 ret
= s
->pchip
.win
[2].base_addr
;
239 ret
= s
->pchip
.win
[3].base_addr
;
243 /* WSM0: Window Space Mask Register. */
244 ret
= s
->pchip
.win
[0].mask
;
248 ret
= s
->pchip
.win
[1].mask
;
252 ret
= s
->pchip
.win
[2].mask
;
256 ret
= s
->pchip
.win
[3].mask
;
260 /* TBA0: Translated Base Address Register. */
261 ret
= (uint64_t)s
->pchip
.win
[0].translated_base_pfn
<< 10;
265 ret
= (uint64_t)s
->pchip
.win
[1].translated_base_pfn
<< 10;
269 ret
= (uint64_t)s
->pchip
.win
[2].translated_base_pfn
<< 10;
273 ret
= (uint64_t)s
->pchip
.win
[3].translated_base_pfn
<< 10;
277 /* PCTL: Pchip Control Register. */
281 /* PLAT: Pchip Master Latency Register. */
284 /* PERROR: Pchip Error Register. */
287 /* PERRMASK: Pchip Error Mask Register. */
290 /* PERRSET: Pchip Error Set Register. */
293 /* TLBIV: Translation Buffer Invalidate Virtual Register (WO). */
296 /* TLBIA: Translation Buffer Invalidate All Register (WO). */
298 case 0x0500: /* PMONCTL */
299 case 0x0540: /* PMONCNT */
300 case 0x0800: /* SPRST */
304 cpu_unassigned_access(cpu_single_env
, addr
, 0, 0, 0, size
);
308 s
->latch_tmp
= ret
>> 32;
312 static void cchip_write(void *opaque
, hwaddr addr
,
313 uint64_t v32
, unsigned size
)
315 TyphoonState
*s
= opaque
;
316 uint64_t val
, oldval
, newval
;
319 val
= v32
<< 32 | s
->latch_tmp
;
328 /* CSC: Cchip System Configuration Register. */
329 /* All sorts of data here; nothing relevant RW. */
333 /* MTR: Memory Timing Register. */
334 /* All sorts of stuff related to real DRAM. */
338 /* MISC: Miscellaneous Register. */
339 newval
= oldval
= s
->cchip
.misc
;
340 newval
&= ~(val
& 0x10000ff0); /* W1C fields */
341 if (val
& 0x100000) {
342 newval
&= ~0xff0000ull
; /* ACL clears ABT and ABW */
344 newval
|= val
& 0x00f00000; /* ABT field is W1S */
345 if ((newval
& 0xf0000) == 0) {
346 newval
|= val
& 0xf0000; /* ABW field is W1S iff zero */
349 newval
|= (val
& 0xf000) >> 4; /* IPREQ field sets IPINTR. */
351 newval
&= ~0xf0000000000ull
; /* WO and RW fields */
352 newval
|= val
& 0xf0000000000ull
;
353 s
->cchip
.misc
= newval
;
355 /* Pass on changes to IPI and ITI state. */
356 if ((newval
^ oldval
) & 0xff0) {
358 for (i
= 0; i
< 4; ++i
) {
359 AlphaCPU
*cpu
= s
->cchip
.cpu
[i
];
361 CPUState
*cs
= CPU(cpu
);
362 /* IPI can be either cleared or set by the write. */
363 if (newval
& (1 << (i
+ 8))) {
364 cpu_interrupt(cs
, CPU_INTERRUPT_SMP
);
366 cpu_reset_interrupt(cs
, CPU_INTERRUPT_SMP
);
369 /* ITI can only be cleared by the write. */
370 if ((newval
& (1 << (i
+ 4))) == 0) {
371 cpu_reset_interrupt(cs
, CPU_INTERRUPT_TIMER
);
379 /* MPD: Memory Presence Detect Register. */
382 case 0x0100: /* AAR0 */
383 case 0x0140: /* AAR1 */
384 case 0x0180: /* AAR2 */
385 case 0x01c0: /* AAR3 */
386 /* AAR: Array Address Register. */
387 /* All sorts of information about DRAM. */
390 case 0x0200: /* DIM0 */
391 /* DIM: Device Interrupt Mask Register, CPU0. */
392 s
->cchip
.dim
[0] = val
;
393 cpu_irq_change(s
->cchip
.cpu
[0], val
& s
->cchip
.drir
);
395 case 0x0240: /* DIM1 */
396 /* DIM: Device Interrupt Mask Register, CPU1. */
397 s
->cchip
.dim
[0] = val
;
398 cpu_irq_change(s
->cchip
.cpu
[1], val
& s
->cchip
.drir
);
401 case 0x0280: /* DIR0 (RO) */
402 case 0x02c0: /* DIR1 (RO) */
403 case 0x0300: /* DRIR (RO) */
407 /* PRBEN: Probe Enable Register. */
410 case 0x0380: /* IIC0 */
411 s
->cchip
.iic
[0] = val
& 0xffffff;
413 case 0x03c0: /* IIC1 */
414 s
->cchip
.iic
[1] = val
& 0xffffff;
417 case 0x0400: /* MPR0 */
418 case 0x0440: /* MPR1 */
419 case 0x0480: /* MPR2 */
420 case 0x04c0: /* MPR3 */
421 /* MPR: Memory Programming Register. */
425 /* TTR: TIGbus Timing Register. */
426 /* All sorts of stuff related to interrupt delivery timings. */
429 /* TDR: TIGbug Device Timing Register. */
433 /* DIM2: Device Interrupt Mask Register, CPU2. */
434 s
->cchip
.dim
[2] = val
;
435 cpu_irq_change(s
->cchip
.cpu
[2], val
& s
->cchip
.drir
);
438 /* DIM3: Device Interrupt Mask Register, CPU3. */
439 s
->cchip
.dim
[3] = val
;
440 cpu_irq_change(s
->cchip
.cpu
[3], val
& s
->cchip
.drir
);
443 case 0x0680: /* DIR2 (RO) */
444 case 0x06c0: /* DIR3 (RO) */
447 case 0x0700: /* IIC2 */
448 s
->cchip
.iic
[2] = val
& 0xffffff;
450 case 0x0740: /* IIC3 */
451 s
->cchip
.iic
[3] = val
& 0xffffff;
455 /* PWR: Power Management Control. */
458 case 0x0c00: /* CMONCTLA */
459 case 0x0c40: /* CMONCTLB */
460 case 0x0c80: /* CMONCNT01 */
461 case 0x0cc0: /* CMONCNT23 */
465 cpu_unassigned_access(cpu_single_env
, addr
, 1, 0, 0, size
);
470 static void dchip_write(void *opaque
, hwaddr addr
,
471 uint64_t val
, unsigned size
)
473 /* Skip this. It's all related to DRAM timing and setup. */
476 static void pchip_write(void *opaque
, hwaddr addr
,
477 uint64_t v32
, unsigned size
)
479 TyphoonState
*s
= opaque
;
480 uint64_t val
, oldval
;
483 val
= v32
<< 32 | s
->latch_tmp
;
492 /* WSBA0: Window Space Base Address Register. */
493 s
->pchip
.win
[0].base_addr
= val
;
497 s
->pchip
.win
[1].base_addr
= val
;
501 s
->pchip
.win
[2].base_addr
= val
;
505 s
->pchip
.win
[3].base_addr
= val
;
509 /* WSM0: Window Space Mask Register. */
510 s
->pchip
.win
[0].mask
= val
;
514 s
->pchip
.win
[1].mask
= val
;
518 s
->pchip
.win
[2].mask
= val
;
522 s
->pchip
.win
[3].mask
= val
;
526 /* TBA0: Translated Base Address Register. */
527 s
->pchip
.win
[0].translated_base_pfn
= val
>> 10;
531 s
->pchip
.win
[1].translated_base_pfn
= val
>> 10;
535 s
->pchip
.win
[2].translated_base_pfn
= val
>> 10;
539 s
->pchip
.win
[3].translated_base_pfn
= val
>> 10;
543 /* PCTL: Pchip Control Register. */
544 oldval
= s
->pchip
.ctl
;
545 oldval
&= ~0x00001cff0fc7ffull
; /* RW fields */
546 oldval
|= val
& 0x00001cff0fc7ffull
;
548 s
->pchip
.ctl
= oldval
;
552 /* PLAT: Pchip Master Latency Register. */
555 /* PERROR: Pchip Error Register. */
558 /* PERRMASK: Pchip Error Mask Register. */
561 /* PERRSET: Pchip Error Set Register. */
565 /* TLBIV: Translation Buffer Invalidate Virtual Register. */
569 /* TLBIA: Translation Buffer Invalidate All Register (WO). */
581 cpu_unassigned_access(cpu_single_env
, addr
, 1, 0, 0, size
);
586 static const MemoryRegionOps cchip_ops
= {
588 .write
= cchip_write
,
589 .endianness
= DEVICE_LITTLE_ENDIAN
,
591 .min_access_size
= 4, /* ??? Should be 8. */
592 .max_access_size
= 8,
595 .min_access_size
= 4,
596 .max_access_size
= 4,
600 static const MemoryRegionOps dchip_ops
= {
602 .write
= dchip_write
,
603 .endianness
= DEVICE_LITTLE_ENDIAN
,
605 .min_access_size
= 4, /* ??? Should be 8. */
606 .max_access_size
= 8,
609 .min_access_size
= 4,
610 .max_access_size
= 8,
614 static const MemoryRegionOps pchip_ops
= {
616 .write
= pchip_write
,
617 .endianness
= DEVICE_LITTLE_ENDIAN
,
619 .min_access_size
= 4, /* ??? Should be 8. */
620 .max_access_size
= 8,
623 .min_access_size
= 4,
624 .max_access_size
= 4,
628 static void typhoon_set_irq(void *opaque
, int irq
, int level
)
630 TyphoonState
*s
= opaque
;
634 /* Set/Reset the bit in CCHIP.DRIR based on IRQ+LEVEL. */
635 drir
= s
->cchip
.drir
;
639 drir
&= ~(1ull << irq
);
641 s
->cchip
.drir
= drir
;
643 for (i
= 0; i
< 4; ++i
) {
644 cpu_irq_change(s
->cchip
.cpu
[i
], s
->cchip
.dim
[i
] & drir
);
648 static void typhoon_set_isa_irq(void *opaque
, int irq
, int level
)
650 typhoon_set_irq(opaque
, 55, level
);
653 static void typhoon_set_timer_irq(void *opaque
, int irq
, int level
)
655 TyphoonState
*s
= opaque
;
658 /* Thankfully, the mc146818rtc code doesn't track the IRQ state,
659 and so we don't have to worry about missing interrupts just
660 because we never actually ACK the interrupt. Just ignore any
661 case of the interrupt level going low. */
666 /* Deliver the interrupt to each CPU, considering each CPU's IIC. */
667 for (i
= 0; i
< 4; ++i
) {
668 AlphaCPU
*cpu
= s
->cchip
.cpu
[i
];
670 uint32_t iic
= s
->cchip
.iic
[i
];
672 /* ??? The verbage in Section 10.2.2.10 isn't 100% clear.
673 Bit 24 is the OverFlow bit, RO, and set when the count
674 decrements past 0. When is OF cleared? My guess is that
675 OF is actually cleared when the IIC is written, and that
676 the ICNT field always decrements. At least, that's an
677 interpretation that makes sense, and "allows the CPU to
678 determine exactly how mant interval timer ticks were
679 skipped". At least within the next 4M ticks... */
681 iic
= ((iic
- 1) & 0x1ffffff) | (iic
& 0x1000000);
682 s
->cchip
.iic
[i
] = iic
;
684 if (iic
& 0x1000000) {
685 /* Set the ITI bit for this cpu. */
686 s
->cchip
.misc
|= 1 << (i
+ 4);
687 /* And signal the interrupt. */
688 cpu_interrupt(CPU(cpu
), CPU_INTERRUPT_TIMER
);
694 static void typhoon_alarm_timer(void *opaque
)
696 TyphoonState
*s
= (TyphoonState
*)((uintptr_t)opaque
& ~3);
697 int cpu
= (uintptr_t)opaque
& 3;
699 /* Set the ITI bit for this cpu. */
700 s
->cchip
.misc
|= 1 << (cpu
+ 4);
701 cpu_interrupt(CPU(s
->cchip
.cpu
[cpu
]), CPU_INTERRUPT_TIMER
);
704 PCIBus
*typhoon_init(ram_addr_t ram_size
, ISABus
**isa_bus
,
706 AlphaCPU
*cpus
[4], pci_map_irq_fn sys_map_irq
)
708 const uint64_t MB
= 1024 * 1024;
709 const uint64_t GB
= 1024 * MB
;
710 MemoryRegion
*addr_space
= get_system_memory();
711 MemoryRegion
*addr_space_io
= get_system_io();
718 dev
= qdev_create(NULL
, TYPE_TYPHOON_PCI_HOST_BRIDGE
);
719 qdev_init_nofail(dev
);
721 s
= TYPHOON_PCI_HOST_BRIDGE(dev
);
722 phb
= PCI_HOST_BRIDGE(dev
);
724 /* Remember the CPUs so that we can deliver interrupts to them. */
725 for (i
= 0; i
< 4; i
++) {
726 AlphaCPU
*cpu
= cpus
[i
];
727 s
->cchip
.cpu
[i
] = cpu
;
729 cpu
->alarm_timer
= qemu_new_timer_ns(rtc_clock
,
731 (void *)((uintptr_t)s
+ i
));
735 *p_rtc_irq
= *qemu_allocate_irqs(typhoon_set_timer_irq
, s
, 1);
737 /* Main memory region, 0x00.0000.0000. Real hardware supports 32GB,
738 but the address space hole reserved at this point is 8TB. */
739 memory_region_init_ram(&s
->ram_region
, "ram", ram_size
);
740 vmstate_register_ram_global(&s
->ram_region
);
741 memory_region_add_subregion(addr_space
, 0, &s
->ram_region
);
743 /* TIGbus, 0x801.0000.0000, 1GB. */
744 /* ??? The TIGbus is used for delivering interrupts, and access to
745 the flash ROM. I'm not sure that we need to implement it at all. */
747 /* Pchip0 CSRs, 0x801.8000.0000, 256MB. */
748 memory_region_init_io(&s
->pchip
.region
, &pchip_ops
, s
, "pchip0", 256*MB
);
749 memory_region_add_subregion(addr_space
, 0x80180000000ULL
,
752 /* Cchip CSRs, 0x801.A000.0000, 256MB. */
753 memory_region_init_io(&s
->cchip
.region
, &cchip_ops
, s
, "cchip0", 256*MB
);
754 memory_region_add_subregion(addr_space
, 0x801a0000000ULL
,
757 /* Dchip CSRs, 0x801.B000.0000, 256MB. */
758 memory_region_init_io(&s
->dchip_region
, &dchip_ops
, s
, "dchip0", 256*MB
);
759 memory_region_add_subregion(addr_space
, 0x801b0000000ULL
,
762 /* Pchip0 PCI memory, 0x800.0000.0000, 4GB. */
763 memory_region_init(&s
->pchip
.reg_mem
, "pci0-mem", 4*GB
);
764 memory_region_add_subregion(addr_space
, 0x80000000000ULL
,
767 /* Pchip0 PCI I/O, 0x801.FC00.0000, 32MB. */
768 /* ??? Ideally we drop the "system" i/o space on the floor and give the
769 PCI subsystem the full address space reserved by the chipset.
770 We can't do that until the MEM and IO paths in memory.c are unified. */
771 memory_region_init_io(&s
->pchip
.reg_io
, &alpha_pci_bw_io_ops
, NULL
,
773 memory_region_add_subregion(addr_space
, 0x801fc000000ULL
,
776 b
= pci_register_bus(dev
, "pci",
777 typhoon_set_irq
, sys_map_irq
, s
,
778 &s
->pchip
.reg_mem
, addr_space_io
, 0, 64, TYPE_PCI_BUS
);
781 /* Pchip0 PCI special/interrupt acknowledge, 0x801.F800.0000, 64MB. */
782 memory_region_init_io(&s
->pchip
.reg_iack
, &alpha_pci_iack_ops
, b
,
784 memory_region_add_subregion(addr_space
, 0x801f8000000ULL
,
787 /* Pchip0 PCI configuration, 0x801.FE00.0000, 16MB. */
788 memory_region_init_io(&s
->pchip
.reg_conf
, &alpha_pci_conf1_ops
, b
,
790 memory_region_add_subregion(addr_space
, 0x801fe000000ULL
,
793 /* For the record, these are the mappings for the second PCI bus.
794 We can get away with not implementing them because we indicate
795 via the Cchip.CSC<PIP> bit that Pchip1 is not present. */
796 /* Pchip1 PCI memory, 0x802.0000.0000, 4GB. */
797 /* Pchip1 CSRs, 0x802.8000.0000, 256MB. */
798 /* Pchip1 PCI special/interrupt acknowledge, 0x802.F800.0000, 64MB. */
799 /* Pchip1 PCI I/O, 0x802.FC00.0000, 32MB. */
800 /* Pchip1 PCI configuration, 0x802.FE00.0000, 16MB. */
802 /* Init the ISA bus. */
803 /* ??? Technically there should be a cy82c693ub pci-isa bridge. */
805 qemu_irq isa_pci_irq
, *isa_irqs
;
807 *isa_bus
= isa_bus_new(NULL
, addr_space_io
);
808 isa_pci_irq
= *qemu_allocate_irqs(typhoon_set_isa_irq
, s
, 1);
809 isa_irqs
= i8259_init(*isa_bus
, isa_pci_irq
);
810 isa_bus_irqs(*isa_bus
, isa_irqs
);
816 static int typhoon_pcihost_init(SysBusDevice
*dev
)
821 static void typhoon_pcihost_class_init(ObjectClass
*klass
, void *data
)
823 DeviceClass
*dc
= DEVICE_CLASS(klass
);
824 SysBusDeviceClass
*k
= SYS_BUS_DEVICE_CLASS(klass
);
826 k
->init
= typhoon_pcihost_init
;
830 static const TypeInfo typhoon_pcihost_info
= {
831 .name
= TYPE_TYPHOON_PCI_HOST_BRIDGE
,
832 .parent
= TYPE_PCI_HOST_BRIDGE
,
833 .instance_size
= sizeof(TyphoonState
),
834 .class_init
= typhoon_pcihost_class_init
,
837 static void typhoon_register_types(void)
839 type_register_static(&typhoon_pcihost_info
);
842 type_init(typhoon_register_types
)