2 * QEMU JAZZ RC4030 chipset
4 * Copyright (c) 2007-2013 Hervé Poussineau
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25 #include "qemu/osdep.h"
26 #include "qemu/units.h"
28 #include "hw/mips/mips.h"
29 #include "hw/sysbus.h"
30 #include "qemu/timer.h"
32 #include "qemu/module.h"
33 #include "exec/address-spaces.h"
36 /********************************************************/
37 /* rc4030 emulation */
39 typedef struct dma_pagetable_entry
{
42 } QEMU_PACKED dma_pagetable_entry
;
44 #define DMA_PAGESIZE 4096
45 #define DMA_REG_ENABLE 1
46 #define DMA_REG_COUNT 2
47 #define DMA_REG_ADDRESS 3
49 #define DMA_FLAG_ENABLE 0x0001
50 #define DMA_FLAG_MEM_TO_DEV 0x0002
51 #define DMA_FLAG_TC_INTR 0x0100
52 #define DMA_FLAG_MEM_INTR 0x0200
53 #define DMA_FLAG_ADDR_INTR 0x0400
55 #define TYPE_RC4030 "rc4030"
57 OBJECT_CHECK(rc4030State, (obj), TYPE_RC4030)
59 #define TYPE_RC4030_IOMMU_MEMORY_REGION "rc4030-iommu-memory-region"
61 typedef struct rc4030State
{
65 uint32_t config
; /* 0x0000: RC4030 config register */
66 uint32_t revision
; /* 0x0008: RC4030 Revision register */
67 uint32_t invalid_address_register
; /* 0x0010: Invalid Address register */
70 uint32_t dma_regs
[8][4];
71 uint32_t dma_tl_base
; /* 0x0018: DMA transl. table base */
72 uint32_t dma_tl_limit
; /* 0x0020: DMA transl. table limit */
75 uint32_t cache_maint
; /* 0x0030: Cache Maintenance */
76 uint32_t remote_failed_address
; /* 0x0038: Remote Failed Address */
77 uint32_t memory_failed_address
; /* 0x0040: Memory Failed Address */
78 uint32_t cache_ptag
; /* 0x0048: I/O Cache Physical Tag */
79 uint32_t cache_ltag
; /* 0x0050: I/O Cache Logical Tag */
80 uint32_t cache_bmask
; /* 0x0058: I/O Cache Byte Mask */
82 uint32_t nmi_interrupt
; /* 0x0200: interrupt source */
83 uint32_t memory_refresh_rate
; /* 0x0210: memory refresh rate */
84 uint32_t nvram_protect
; /* 0x0220: NV ram protect register */
85 uint32_t rem_speed
[16];
86 uint32_t imr_jazz
; /* Local bus int enable mask */
87 uint32_t isr_jazz
; /* Local bus int source */
90 QEMUTimer
*periodic_timer
;
91 uint32_t itr
; /* Interval timer reload */
94 qemu_irq jazz_bus_irq
;
96 /* whole DMA memory region, root of DMA address space */
97 IOMMUMemoryRegion dma_mr
;
100 MemoryRegion iomem_chipset
;
101 MemoryRegion iomem_jazzio
;
104 static void set_next_tick(rc4030State
*s
)
107 qemu_irq_lower(s
->timer_irq
);
109 tm_hz
= 1000 / (s
->itr
+ 1);
111 timer_mod(s
->periodic_timer
, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL
) +
112 NANOSECONDS_PER_SECOND
/ tm_hz
);
115 /* called for accesses to rc4030 */
116 static uint64_t rc4030_read(void *opaque
, hwaddr addr
, unsigned int size
)
118 rc4030State
*s
= opaque
;
122 switch (addr
& ~0x3) {
123 /* Global config register */
127 /* Revision register */
131 /* Invalid Address register */
133 val
= s
->invalid_address_register
;
135 /* DMA transl. table base */
137 val
= s
->dma_tl_base
;
139 /* DMA transl. table limit */
141 val
= s
->dma_tl_limit
;
143 /* Remote Failed Address */
145 val
= s
->remote_failed_address
;
147 /* Memory Failed Address */
149 val
= s
->memory_failed_address
;
151 /* I/O Cache Byte Mask */
153 val
= s
->cache_bmask
;
155 if (s
->cache_bmask
== (uint32_t)-1) {
159 /* Remote Speed Registers */
176 val
= s
->rem_speed
[(addr
- 0x0070) >> 3];
178 /* DMA channel base address */
212 int entry
= (addr
- 0x0100) >> 5;
213 int idx
= (addr
& 0x1f) >> 3;
214 val
= s
->dma_regs
[entry
][idx
];
217 /* Interrupt source */
219 val
= s
->nmi_interrupt
;
225 /* Memory refresh rate */
227 val
= s
->memory_refresh_rate
;
229 /* NV ram protect register */
231 val
= s
->nvram_protect
;
233 /* Interval timer count */
236 qemu_irq_lower(s
->timer_irq
);
240 val
= 7; /* FIXME: should be read from EISA controller */
243 qemu_log_mask(LOG_GUEST_ERROR
,
244 "rc4030: invalid read at 0x%x", (int)addr
);
249 if ((addr
& ~3) != 0x230) {
250 trace_rc4030_read(addr
, val
);
256 static void rc4030_write(void *opaque
, hwaddr addr
, uint64_t data
,
259 rc4030State
*s
= opaque
;
263 trace_rc4030_write(addr
, val
);
265 switch (addr
& ~0x3) {
266 /* Global config register */
270 /* DMA transl. table base */
272 s
->dma_tl_base
= val
;
274 /* DMA transl. table limit */
276 s
->dma_tl_limit
= val
;
278 /* DMA transl. table invalidated */
281 /* Cache Maintenance */
283 s
->cache_maint
= val
;
285 /* I/O Cache Physical Tag */
289 /* I/O Cache Logical Tag */
293 /* I/O Cache Byte Mask */
295 s
->cache_bmask
|= val
; /* HACK */
297 /* I/O Cache Buffer Window */
300 if (s
->cache_ltag
== 0x80000001 && s
->cache_bmask
== 0xf0f0f0f) {
301 hwaddr dest
= s
->cache_ptag
& ~0x1;
302 dest
+= (s
->cache_maint
& 0x3) << 3;
303 cpu_physical_memory_write(dest
, &val
, 4);
306 /* Remote Speed Registers */
323 s
->rem_speed
[(addr
- 0x0070) >> 3] = val
;
325 /* DMA channel base address */
359 int entry
= (addr
- 0x0100) >> 5;
360 int idx
= (addr
& 0x1f) >> 3;
361 s
->dma_regs
[entry
][idx
] = val
;
364 /* Memory refresh rate */
366 s
->memory_refresh_rate
= val
;
368 /* Interval timer reload */
370 s
->itr
= val
& 0x01FF;
371 qemu_irq_lower(s
->timer_irq
);
378 qemu_log_mask(LOG_GUEST_ERROR
,
379 "rc4030: invalid write of 0x%02x at 0x%x",
385 static const MemoryRegionOps rc4030_ops
= {
387 .write
= rc4030_write
,
388 .impl
.min_access_size
= 4,
389 .impl
.max_access_size
= 4,
390 .endianness
= DEVICE_NATIVE_ENDIAN
,
393 static void update_jazz_irq(rc4030State
*s
)
397 pending
= s
->isr_jazz
& s
->imr_jazz
;
400 qemu_irq_raise(s
->jazz_bus_irq
);
402 qemu_irq_lower(s
->jazz_bus_irq
);
405 static void rc4030_irq_jazz_request(void *opaque
, int irq
, int level
)
407 rc4030State
*s
= opaque
;
410 s
->isr_jazz
|= 1 << irq
;
412 s
->isr_jazz
&= ~(1 << irq
);
418 static void rc4030_periodic_timer(void *opaque
)
420 rc4030State
*s
= opaque
;
423 qemu_irq_raise(s
->timer_irq
);
426 static uint64_t jazzio_read(void *opaque
, hwaddr addr
, unsigned int size
)
428 rc4030State
*s
= opaque
;
434 /* Local bus int source */
436 uint32_t pending
= s
->isr_jazz
& s
->imr_jazz
;
441 val
= (irq
+ 1) << 2;
449 /* Local bus int enable mask */
454 qemu_log_mask(LOG_GUEST_ERROR
,
455 "rc4030/jazzio: invalid read at 0x%x", (int)addr
);
460 trace_jazzio_read(addr
, val
);
465 static void jazzio_write(void *opaque
, hwaddr addr
, uint64_t data
,
468 rc4030State
*s
= opaque
;
472 trace_jazzio_write(addr
, val
);
475 /* Local bus int enable mask */
481 qemu_log_mask(LOG_GUEST_ERROR
,
482 "rc4030/jazzio: invalid write of 0x%02x at 0x%x",
488 static const MemoryRegionOps jazzio_ops
= {
490 .write
= jazzio_write
,
491 .impl
.min_access_size
= 2,
492 .impl
.max_access_size
= 2,
493 .endianness
= DEVICE_NATIVE_ENDIAN
,
496 static IOMMUTLBEntry
rc4030_dma_translate(IOMMUMemoryRegion
*iommu
, hwaddr addr
,
497 IOMMUAccessFlags flag
, int iommu_idx
)
499 rc4030State
*s
= container_of(iommu
, rc4030State
, dma_mr
);
500 IOMMUTLBEntry ret
= {
501 .target_as
= &address_space_memory
,
502 .iova
= addr
& ~(DMA_PAGESIZE
- 1),
503 .translated_addr
= 0,
504 .addr_mask
= DMA_PAGESIZE
- 1,
507 uint64_t i
, entry_address
;
508 dma_pagetable_entry entry
;
510 i
= addr
/ DMA_PAGESIZE
;
511 if (i
< s
->dma_tl_limit
/ sizeof(entry
)) {
512 entry_address
= (s
->dma_tl_base
& 0x7fffffff) + i
* sizeof(entry
);
513 if (address_space_read(ret
.target_as
, entry_address
,
514 MEMTXATTRS_UNSPECIFIED
, (unsigned char *)&entry
,
515 sizeof(entry
)) == MEMTX_OK
) {
516 ret
.translated_addr
= entry
.frame
& ~(DMA_PAGESIZE
- 1);
524 static void rc4030_reset(DeviceState
*dev
)
526 rc4030State
*s
= RC4030(dev
);
529 s
->config
= 0x410; /* some boards seem to accept 0x104 too */
531 s
->invalid_address_register
= 0;
533 memset(s
->dma_regs
, 0, sizeof(s
->dma_regs
));
535 s
->remote_failed_address
= s
->memory_failed_address
= 0;
537 s
->cache_ptag
= s
->cache_ltag
= 0;
540 s
->memory_refresh_rate
= 0x18186;
541 s
->nvram_protect
= 7;
542 for (i
= 0; i
< 15; i
++) {
545 s
->imr_jazz
= 0x10; /* XXX: required by firmware, but why? */
550 qemu_irq_lower(s
->timer_irq
);
551 qemu_irq_lower(s
->jazz_bus_irq
);
554 static int rc4030_post_load(void *opaque
, int version_id
)
556 rc4030State
*s
= opaque
;
564 static const VMStateDescription vmstate_rc4030
= {
567 .post_load
= rc4030_post_load
,
568 .fields
= (VMStateField
[]) {
569 VMSTATE_UINT32(config
, rc4030State
),
570 VMSTATE_UINT32(invalid_address_register
, rc4030State
),
571 VMSTATE_UINT32_2DARRAY(dma_regs
, rc4030State
, 8, 4),
572 VMSTATE_UINT32(dma_tl_base
, rc4030State
),
573 VMSTATE_UINT32(dma_tl_limit
, rc4030State
),
574 VMSTATE_UINT32(cache_maint
, rc4030State
),
575 VMSTATE_UINT32(remote_failed_address
, rc4030State
),
576 VMSTATE_UINT32(memory_failed_address
, rc4030State
),
577 VMSTATE_UINT32(cache_ptag
, rc4030State
),
578 VMSTATE_UINT32(cache_ltag
, rc4030State
),
579 VMSTATE_UINT32(cache_bmask
, rc4030State
),
580 VMSTATE_UINT32(memory_refresh_rate
, rc4030State
),
581 VMSTATE_UINT32(nvram_protect
, rc4030State
),
582 VMSTATE_UINT32_ARRAY(rem_speed
, rc4030State
, 16),
583 VMSTATE_UINT32(imr_jazz
, rc4030State
),
584 VMSTATE_UINT32(isr_jazz
, rc4030State
),
585 VMSTATE_UINT32(itr
, rc4030State
),
586 VMSTATE_END_OF_LIST()
590 static void rc4030_do_dma(void *opaque
, int n
, uint8_t *buf
, int len
, int is_write
)
592 rc4030State
*s
= opaque
;
596 s
->dma_regs
[n
][DMA_REG_ENABLE
] &=
597 ~(DMA_FLAG_TC_INTR
| DMA_FLAG_MEM_INTR
| DMA_FLAG_ADDR_INTR
);
599 /* Check DMA channel consistency */
600 dev_to_mem
= (s
->dma_regs
[n
][DMA_REG_ENABLE
] & DMA_FLAG_MEM_TO_DEV
) ? 0 : 1;
601 if (!(s
->dma_regs
[n
][DMA_REG_ENABLE
] & DMA_FLAG_ENABLE
) ||
602 (is_write
!= dev_to_mem
)) {
603 s
->dma_regs
[n
][DMA_REG_ENABLE
] |= DMA_FLAG_MEM_INTR
;
604 s
->nmi_interrupt
|= 1 << n
;
608 /* Get start address and len */
609 if (len
> s
->dma_regs
[n
][DMA_REG_COUNT
]) {
610 len
= s
->dma_regs
[n
][DMA_REG_COUNT
];
612 dma_addr
= s
->dma_regs
[n
][DMA_REG_ADDRESS
];
614 /* Read/write data at right place */
615 address_space_rw(&s
->dma_as
, dma_addr
, MEMTXATTRS_UNSPECIFIED
,
618 s
->dma_regs
[n
][DMA_REG_ENABLE
] |= DMA_FLAG_TC_INTR
;
619 s
->dma_regs
[n
][DMA_REG_COUNT
] -= len
;
622 struct rc4030DMAState
{
627 void rc4030_dma_read(void *dma
, uint8_t *buf
, int len
)
630 rc4030_do_dma(s
->opaque
, s
->n
, buf
, len
, 0);
633 void rc4030_dma_write(void *dma
, uint8_t *buf
, int len
)
636 rc4030_do_dma(s
->opaque
, s
->n
, buf
, len
, 1);
639 static rc4030_dma
*rc4030_allocate_dmas(void *opaque
, int n
)
642 struct rc4030DMAState
*p
;
645 s
= (rc4030_dma
*)g_malloc0(sizeof(rc4030_dma
) * n
);
646 p
= (struct rc4030DMAState
*)g_malloc0(sizeof(struct rc4030DMAState
) * n
);
647 for (i
= 0; i
< n
; i
++) {
656 static void rc4030_initfn(Object
*obj
)
658 DeviceState
*dev
= DEVICE(obj
);
659 rc4030State
*s
= RC4030(obj
);
660 SysBusDevice
*sysbus
= SYS_BUS_DEVICE(obj
);
662 qdev_init_gpio_in(dev
, rc4030_irq_jazz_request
, 16);
664 sysbus_init_irq(sysbus
, &s
->timer_irq
);
665 sysbus_init_irq(sysbus
, &s
->jazz_bus_irq
);
667 sysbus_init_mmio(sysbus
, &s
->iomem_chipset
);
668 sysbus_init_mmio(sysbus
, &s
->iomem_jazzio
);
671 static void rc4030_realize(DeviceState
*dev
, Error
**errp
)
673 rc4030State
*s
= RC4030(dev
);
674 Object
*o
= OBJECT(dev
);
676 s
->periodic_timer
= timer_new_ns(QEMU_CLOCK_VIRTUAL
,
677 rc4030_periodic_timer
, s
);
679 memory_region_init_io(&s
->iomem_chipset
, NULL
, &rc4030_ops
, s
,
680 "rc4030.chipset", 0x300);
681 memory_region_init_io(&s
->iomem_jazzio
, NULL
, &jazzio_ops
, s
,
682 "rc4030.jazzio", 0x00001000);
684 memory_region_init_iommu(&s
->dma_mr
, sizeof(s
->dma_mr
),
685 TYPE_RC4030_IOMMU_MEMORY_REGION
,
686 o
, "rc4030.dma", 4 * GiB
);
687 address_space_init(&s
->dma_as
, MEMORY_REGION(&s
->dma_mr
), "rc4030-dma");
690 static void rc4030_unrealize(DeviceState
*dev
, Error
**errp
)
692 rc4030State
*s
= RC4030(dev
);
694 timer_free(s
->periodic_timer
);
696 address_space_destroy(&s
->dma_as
);
697 object_unparent(OBJECT(&s
->dma_mr
));
700 static void rc4030_class_init(ObjectClass
*klass
, void *class_data
)
702 DeviceClass
*dc
= DEVICE_CLASS(klass
);
704 dc
->realize
= rc4030_realize
;
705 dc
->unrealize
= rc4030_unrealize
;
706 dc
->reset
= rc4030_reset
;
707 dc
->vmsd
= &vmstate_rc4030
;
710 static const TypeInfo rc4030_info
= {
712 .parent
= TYPE_SYS_BUS_DEVICE
,
713 .instance_size
= sizeof(rc4030State
),
714 .instance_init
= rc4030_initfn
,
715 .class_init
= rc4030_class_init
,
718 static void rc4030_iommu_memory_region_class_init(ObjectClass
*klass
,
721 IOMMUMemoryRegionClass
*imrc
= IOMMU_MEMORY_REGION_CLASS(klass
);
723 imrc
->translate
= rc4030_dma_translate
;
726 static const TypeInfo rc4030_iommu_memory_region_info
= {
727 .parent
= TYPE_IOMMU_MEMORY_REGION
,
728 .name
= TYPE_RC4030_IOMMU_MEMORY_REGION
,
729 .class_init
= rc4030_iommu_memory_region_class_init
,
732 static void rc4030_register_types(void)
734 type_register_static(&rc4030_info
);
735 type_register_static(&rc4030_iommu_memory_region_info
);
738 type_init(rc4030_register_types
)
740 DeviceState
*rc4030_init(rc4030_dma
**dmas
, IOMMUMemoryRegion
**dma_mr
)
744 dev
= qdev_create(NULL
, TYPE_RC4030
);
745 qdev_init_nofail(dev
);
747 *dmas
= rc4030_allocate_dmas(dev
, 4);
748 *dma_mr
= &RC4030(dev
)->dma_mr
;