1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27#include "qemu/osdep.h"
28#include "hw/dma/xlnx-zynq-devcfg.h"
29#include "qemu/bitops.h"
30#include "sysemu/sysemu.h"
31#include "sysemu/dma.h"
32#include "qemu/log.h"
33
34#define FREQ_HZ 900000000
35
36#define BTT_MAX 0x400
37
38#ifndef XLNX_ZYNQ_DEVCFG_ERR_DEBUG
39#define XLNX_ZYNQ_DEVCFG_ERR_DEBUG 0
40#endif
41
42#define DB_PRINT(fmt, args...) do { \
43 if (XLNX_ZYNQ_DEVCFG_ERR_DEBUG) { \
44 qemu_log("%s: " fmt, __func__, ## args); \
45 } \
46} while (0)
47
48REG32(CTRL, 0x00)
49 FIELD(CTRL, FORCE_RST, 31, 1)
50 FIELD(CTRL, PCAP_PR, 27, 1)
51 FIELD(CTRL, PCAP_MODE, 26, 1)
52 FIELD(CTRL, MULTIBOOT_EN, 24, 1)
53 FIELD(CTRL, USER_MODE, 15, 1)
54 FIELD(CTRL, PCFG_AES_FUSE, 12, 1)
55 FIELD(CTRL, PCFG_AES_EN, 9, 3)
56 FIELD(CTRL, SEU_EN, 8, 1)
57 FIELD(CTRL, SEC_EN, 7, 1)
58 FIELD(CTRL, SPNIDEN, 6, 1)
59 FIELD(CTRL, SPIDEN, 5, 1)
60 FIELD(CTRL, NIDEN, 4, 1)
61 FIELD(CTRL, DBGEN, 3, 1)
62 FIELD(CTRL, DAP_EN, 0, 3)
63
64REG32(LOCK, 0x04)
65#define AES_FUSE_LOCK 4
66#define AES_EN_LOCK 3
67#define SEU_LOCK 2
68#define SEC_LOCK 1
69#define DBG_LOCK 0
70
71
72static const uint32_t lock_ctrl_map[] = {
73 [AES_FUSE_LOCK] = R_CTRL_PCFG_AES_FUSE_MASK,
74 [AES_EN_LOCK] = R_CTRL_PCFG_AES_EN_MASK,
75 [SEU_LOCK] = R_CTRL_SEU_EN_MASK,
76 [SEC_LOCK] = R_CTRL_SEC_EN_MASK,
77 [DBG_LOCK] = R_CTRL_SPNIDEN_MASK | R_CTRL_SPIDEN_MASK |
78 R_CTRL_NIDEN_MASK | R_CTRL_DBGEN_MASK |
79 R_CTRL_DAP_EN_MASK,
80};
81
82REG32(CFG, 0x08)
83 FIELD(CFG, RFIFO_TH, 10, 2)
84 FIELD(CFG, WFIFO_TH, 8, 2)
85 FIELD(CFG, RCLK_EDGE, 7, 1)
86 FIELD(CFG, WCLK_EDGE, 6, 1)
87 FIELD(CFG, DISABLE_SRC_INC, 5, 1)
88 FIELD(CFG, DISABLE_DST_INC, 4, 1)
89#define R_CFG_RESET 0x50B
90
91REG32(INT_STS, 0x0C)
92 FIELD(INT_STS, PSS_GTS_USR_B, 31, 1)
93 FIELD(INT_STS, PSS_FST_CFG_B, 30, 1)
94 FIELD(INT_STS, PSS_CFG_RESET_B, 27, 1)
95 FIELD(INT_STS, RX_FIFO_OV, 18, 1)
96 FIELD(INT_STS, WR_FIFO_LVL, 17, 1)
97 FIELD(INT_STS, RD_FIFO_LVL, 16, 1)
98 FIELD(INT_STS, DMA_CMD_ERR, 15, 1)
99 FIELD(INT_STS, DMA_Q_OV, 14, 1)
100 FIELD(INT_STS, DMA_DONE, 13, 1)
101 FIELD(INT_STS, DMA_P_DONE, 12, 1)
102 FIELD(INT_STS, P2D_LEN_ERR, 11, 1)
103 FIELD(INT_STS, PCFG_DONE, 2, 1)
104#define R_INT_STS_RSVD ((0x7 << 24) | (0x1 << 19) | (0xF < 7))
105
106REG32(INT_MASK, 0x10)
107
108REG32(STATUS, 0x14)
109 FIELD(STATUS, DMA_CMD_Q_F, 31, 1)
110 FIELD(STATUS, DMA_CMD_Q_E, 30, 1)
111 FIELD(STATUS, DMA_DONE_CNT, 28, 2)
112 FIELD(STATUS, RX_FIFO_LVL, 20, 5)
113 FIELD(STATUS, TX_FIFO_LVL, 12, 7)
114 FIELD(STATUS, PSS_GTS_USR_B, 11, 1)
115 FIELD(STATUS, PSS_FST_CFG_B, 10, 1)
116 FIELD(STATUS, PSS_CFG_RESET_B, 5, 1)
117
118REG32(DMA_SRC_ADDR, 0x18)
119REG32(DMA_DST_ADDR, 0x1C)
120REG32(DMA_SRC_LEN, 0x20)
121REG32(DMA_DST_LEN, 0x24)
122REG32(ROM_SHADOW, 0x28)
123REG32(SW_ID, 0x30)
124REG32(UNLOCK, 0x34)
125
126#define R_UNLOCK_MAGIC 0x757BDF0D
127
128REG32(MCTRL, 0x80)
129 FIELD(MCTRL, PS_VERSION, 28, 4)
130 FIELD(MCTRL, PCFG_POR_B, 8, 1)
131 FIELD(MCTRL, INT_PCAP_LPBK, 4, 1)
132 FIELD(MCTRL, QEMU, 3, 1)
133
134static void xlnx_zynq_devcfg_update_ixr(XlnxZynqDevcfg *s)
135{
136 qemu_set_irq(s->irq, ~s->regs[R_INT_MASK] & s->regs[R_INT_STS]);
137}
138
139static void xlnx_zynq_devcfg_reset(DeviceState *dev)
140{
141 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(dev);
142 int i;
143
144 for (i = 0; i < XLNX_ZYNQ_DEVCFG_R_MAX; ++i) {
145 register_reset(&s->regs_info[i]);
146 }
147}
148
149static void xlnx_zynq_devcfg_dma_go(XlnxZynqDevcfg *s)
150{
151 do {
152 uint8_t buf[BTT_MAX];
153 XlnxZynqDevcfgDMACmd *dmah = s->dma_cmd_fifo;
154 uint32_t btt = BTT_MAX;
155 bool loopback = s->regs[R_MCTRL] & R_MCTRL_INT_PCAP_LPBK_MASK;
156
157 btt = MIN(btt, dmah->src_len);
158 if (loopback) {
159 btt = MIN(btt, dmah->dest_len);
160 }
161 DB_PRINT("reading %x bytes from %x\n", btt, dmah->src_addr);
162 dma_memory_read(&address_space_memory, dmah->src_addr, buf, btt);
163 dmah->src_len -= btt;
164 dmah->src_addr += btt;
165 if (loopback && (dmah->src_len || dmah->dest_len)) {
166 DB_PRINT("writing %x bytes from %x\n", btt, dmah->dest_addr);
167 dma_memory_write(&address_space_memory, dmah->dest_addr, buf, btt);
168 dmah->dest_len -= btt;
169 dmah->dest_addr += btt;
170 }
171 if (!dmah->src_len && !dmah->dest_len) {
172 DB_PRINT("dma operation finished\n");
173 s->regs[R_INT_STS] |= R_INT_STS_DMA_DONE_MASK |
174 R_INT_STS_DMA_P_DONE_MASK;
175 s->dma_cmd_fifo_num--;
176 memmove(s->dma_cmd_fifo, &s->dma_cmd_fifo[1],
177 sizeof(s->dma_cmd_fifo) - sizeof(s->dma_cmd_fifo[0]));
178 }
179 xlnx_zynq_devcfg_update_ixr(s);
180 } while (s->dma_cmd_fifo_num);
181}
182
183static void r_ixr_post_write(RegisterInfo *reg, uint64_t val)
184{
185 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(reg->opaque);
186
187 xlnx_zynq_devcfg_update_ixr(s);
188}
189
190static uint64_t r_ctrl_pre_write(RegisterInfo *reg, uint64_t val)
191{
192 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(reg->opaque);
193 int i;
194
195 for (i = 0; i < ARRAY_SIZE(lock_ctrl_map); ++i) {
196 if (s->regs[R_LOCK] & 1 << i) {
197 val &= ~lock_ctrl_map[i];
198 val |= lock_ctrl_map[i] & s->regs[R_CTRL];
199 }
200 }
201 return val;
202}
203
204static void r_ctrl_post_write(RegisterInfo *reg, uint64_t val)
205{
206 const char *device_prefix = object_get_typename(OBJECT(reg->opaque));
207 uint32_t aes_en = FIELD_EX32(val, CTRL, PCFG_AES_EN);
208
209 if (aes_en != 0 && aes_en != 7) {
210 qemu_log_mask(LOG_UNIMP, "%s: warning, aes-en bits inconsistent,"
211 "unimplemented security reset should happen!\n",
212 device_prefix);
213 }
214}
215
216static void r_unlock_post_write(RegisterInfo *reg, uint64_t val)
217{
218 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(reg->opaque);
219 const char *device_prefix = object_get_typename(OBJECT(s));
220
221 if (val == R_UNLOCK_MAGIC) {
222 DB_PRINT("successful unlock\n");
223 s->regs[R_CTRL] |= R_CTRL_PCAP_PR_MASK;
224 s->regs[R_CTRL] |= R_CTRL_PCFG_AES_EN_MASK;
225 memory_region_set_enabled(&s->iomem, true);
226 } else {
227 qemu_log_mask(LOG_GUEST_ERROR, "%s: failed unlock\n", device_prefix);
228 s->regs[R_CTRL] &= ~R_CTRL_PCAP_PR_MASK;
229 s->regs[R_CTRL] &= ~R_CTRL_PCFG_AES_EN_MASK;
230
231 memory_region_set_enabled(&s->iomem, false);
232 }
233}
234
235static uint64_t r_lock_pre_write(RegisterInfo *reg, uint64_t val)
236{
237 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(reg->opaque);
238
239
240 return s->regs[R_LOCK] | val;
241}
242
243static void r_dma_dst_len_post_write(RegisterInfo *reg, uint64_t val)
244{
245 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(reg->opaque);
246
247 s->dma_cmd_fifo[s->dma_cmd_fifo_num] = (XlnxZynqDevcfgDMACmd) {
248 .src_addr = s->regs[R_DMA_SRC_ADDR] & ~0x3UL,
249 .dest_addr = s->regs[R_DMA_DST_ADDR] & ~0x3UL,
250 .src_len = s->regs[R_DMA_SRC_LEN] << 2,
251 .dest_len = s->regs[R_DMA_DST_LEN] << 2,
252 };
253 s->dma_cmd_fifo_num++;
254 DB_PRINT("dma transfer started; %d total transfers pending\n",
255 s->dma_cmd_fifo_num);
256 xlnx_zynq_devcfg_dma_go(s);
257}
258
259static const RegisterAccessInfo xlnx_zynq_devcfg_regs_info[] = {
260 { .name = "CTRL", .addr = A_CTRL,
261 .reset = R_CTRL_PCAP_PR_MASK | R_CTRL_PCAP_MODE_MASK | 0x3 << 13,
262 .rsvd = 0x1 << 28 | 0x3ff << 13 | 0x3 << 13,
263 .pre_write = r_ctrl_pre_write,
264 .post_write = r_ctrl_post_write,
265 },
266 { .name = "LOCK", .addr = A_LOCK,
267 .rsvd = MAKE_64BIT_MASK(5, 64 - 5),
268 .pre_write = r_lock_pre_write,
269 },
270 { .name = "CFG", .addr = A_CFG,
271 .reset = R_CFG_RESET,
272 .rsvd = 0xfffff00f,
273 },
274 { .name = "INT_STS", .addr = A_INT_STS,
275 .w1c = ~R_INT_STS_RSVD,
276 .reset = R_INT_STS_PSS_GTS_USR_B_MASK |
277 R_INT_STS_PSS_CFG_RESET_B_MASK |
278 R_INT_STS_WR_FIFO_LVL_MASK,
279 .rsvd = R_INT_STS_RSVD,
280 .post_write = r_ixr_post_write,
281 },
282 { .name = "INT_MASK", .addr = A_INT_MASK,
283 .reset = ~0,
284 .rsvd = R_INT_STS_RSVD,
285 .post_write = r_ixr_post_write,
286 },
287 { .name = "STATUS", .addr = A_STATUS,
288 .reset = R_STATUS_DMA_CMD_Q_E_MASK |
289 R_STATUS_PSS_GTS_USR_B_MASK |
290 R_STATUS_PSS_CFG_RESET_B_MASK,
291 .ro = ~0,
292 },
293 { .name = "DMA_SRC_ADDR", .addr = A_DMA_SRC_ADDR, },
294 { .name = "DMA_DST_ADDR", .addr = A_DMA_DST_ADDR, },
295 { .name = "DMA_SRC_LEN", .addr = A_DMA_SRC_LEN,
296 .ro = MAKE_64BIT_MASK(27, 64 - 27) },
297 { .name = "DMA_DST_LEN", .addr = A_DMA_DST_LEN,
298 .ro = MAKE_64BIT_MASK(27, 64 - 27),
299 .post_write = r_dma_dst_len_post_write,
300 },
301 { .name = "ROM_SHADOW", .addr = A_ROM_SHADOW,
302 .rsvd = ~0ull,
303 },
304 { .name = "SW_ID", .addr = A_SW_ID, },
305 { .name = "UNLOCK", .addr = A_UNLOCK,
306 .post_write = r_unlock_post_write,
307 },
308 { .name = "MCTRL", .addr = R_MCTRL * 4,
309
310
311
312 .reset = 0x2 << R_MCTRL_PS_VERSION_SHIFT | 1 << 23 | R_MCTRL_QEMU_MASK,
313 .ro = ~R_MCTRL_INT_PCAP_LPBK_MASK,
314 .rsvd = 0x00f00303,
315 },
316};
317
318static const MemoryRegionOps xlnx_zynq_devcfg_reg_ops = {
319 .read = register_read_memory,
320 .write = register_write_memory,
321 .endianness = DEVICE_LITTLE_ENDIAN,
322 .valid = {
323 .min_access_size = 4,
324 .max_access_size = 4,
325 }
326};
327
328static const VMStateDescription vmstate_xlnx_zynq_devcfg_dma_cmd = {
329 .name = "xlnx_zynq_devcfg_dma_cmd",
330 .version_id = 1,
331 .minimum_version_id = 1,
332 .fields = (VMStateField[]) {
333 VMSTATE_UINT32(src_addr, XlnxZynqDevcfgDMACmd),
334 VMSTATE_UINT32(dest_addr, XlnxZynqDevcfgDMACmd),
335 VMSTATE_UINT32(src_len, XlnxZynqDevcfgDMACmd),
336 VMSTATE_UINT32(dest_len, XlnxZynqDevcfgDMACmd),
337 VMSTATE_END_OF_LIST()
338 }
339};
340
341static const VMStateDescription vmstate_xlnx_zynq_devcfg = {
342 .name = "xlnx_zynq_devcfg",
343 .version_id = 1,
344 .minimum_version_id = 1,
345 .fields = (VMStateField[]) {
346 VMSTATE_STRUCT_ARRAY(dma_cmd_fifo, XlnxZynqDevcfg,
347 XLNX_ZYNQ_DEVCFG_DMA_CMD_FIFO_LEN, 0,
348 vmstate_xlnx_zynq_devcfg_dma_cmd,
349 XlnxZynqDevcfgDMACmd),
350 VMSTATE_UINT8(dma_cmd_fifo_num, XlnxZynqDevcfg),
351 VMSTATE_UINT32_ARRAY(regs, XlnxZynqDevcfg, XLNX_ZYNQ_DEVCFG_R_MAX),
352 VMSTATE_END_OF_LIST()
353 }
354};
355
356static void xlnx_zynq_devcfg_init(Object *obj)
357{
358 SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
359 XlnxZynqDevcfg *s = XLNX_ZYNQ_DEVCFG(obj);
360 RegisterInfoArray *reg_array;
361
362 sysbus_init_irq(sbd, &s->irq);
363
364 memory_region_init(&s->iomem, obj, "devcfg", XLNX_ZYNQ_DEVCFG_R_MAX * 4);
365 reg_array =
366 register_init_block32(DEVICE(obj), xlnx_zynq_devcfg_regs_info,
367 ARRAY_SIZE(xlnx_zynq_devcfg_regs_info),
368 s->regs_info, s->regs,
369 &xlnx_zynq_devcfg_reg_ops,
370 XLNX_ZYNQ_DEVCFG_ERR_DEBUG,
371 XLNX_ZYNQ_DEVCFG_R_MAX);
372 memory_region_add_subregion(&s->iomem,
373 A_CTRL,
374 ®_array->mem);
375
376 sysbus_init_mmio(sbd, &s->iomem);
377}
378
379static void xlnx_zynq_devcfg_class_init(ObjectClass *klass, void *data)
380{
381 DeviceClass *dc = DEVICE_CLASS(klass);
382
383 dc->reset = xlnx_zynq_devcfg_reset;
384 dc->vmsd = &vmstate_xlnx_zynq_devcfg;
385}
386
387static const TypeInfo xlnx_zynq_devcfg_info = {
388 .name = TYPE_XLNX_ZYNQ_DEVCFG,
389 .parent = TYPE_SYS_BUS_DEVICE,
390 .instance_size = sizeof(XlnxZynqDevcfg),
391 .instance_init = xlnx_zynq_devcfg_init,
392 .class_init = xlnx_zynq_devcfg_class_init,
393};
394
395static void xlnx_zynq_devcfg_register_types(void)
396{
397 type_register_static(&xlnx_zynq_devcfg_info);
398}
399
400type_init(xlnx_zynq_devcfg_register_types)
401
