qemu/hw/dma/pl330.c
<<
>>
Prefs
   1/*
   2 * ARM PrimeCell PL330 DMA Controller
   3 *
   4 * Copyright (c) 2009 Samsung Electronics.
   5 * Contributed by Kirill Batuzov <batuzovk@ispras.ru>
   6 * Copyright (c) 2012 Peter A.G. Crosthwaite (peter.crosthwaite@petalogix.com)
   7 * Copyright (c) 2012 PetaLogix Pty Ltd.
   8 *
   9 * This program is free software; you can redistribute it and/or
  10 * modify it under the terms of the GNU General Public License
  11 * as published by the Free Software Foundation; version 2 or later.
  12 *
  13 * You should have received a copy of the GNU General Public License along
  14 * with this program; if not, see <http://www.gnu.org/licenses/>.
  15 */
  16
  17#include "qemu/osdep.h"
  18#include "hw/sysbus.h"
  19#include "qapi/error.h"
  20#include "qemu/timer.h"
  21#include "sysemu/dma.h"
  22#include "qemu/log.h"
  23
  24#ifndef PL330_ERR_DEBUG
  25#define PL330_ERR_DEBUG 0
  26#endif
  27
  28#define DB_PRINT_L(lvl, fmt, args...) do {\
  29    if (PL330_ERR_DEBUG >= lvl) {\
  30        fprintf(stderr, "PL330: %s:" fmt, __func__, ## args);\
  31    } \
  32} while (0);
  33
  34#define DB_PRINT(fmt, args...) DB_PRINT_L(1, fmt, ## args)
  35
  36#define PL330_PERIPH_NUM            32
  37#define PL330_MAX_BURST_LEN         128
  38#define PL330_INSN_MAXSIZE          6
  39
  40#define PL330_FIFO_OK               0
  41#define PL330_FIFO_STALL            1
  42#define PL330_FIFO_ERR              (-1)
  43
  44#define PL330_FAULT_UNDEF_INSTR             (1 <<  0)
  45#define PL330_FAULT_OPERAND_INVALID         (1 <<  1)
  46#define PL330_FAULT_DMAGO_ERR               (1 <<  4)
  47#define PL330_FAULT_EVENT_ERR               (1 <<  5)
  48#define PL330_FAULT_CH_PERIPH_ERR           (1 <<  6)
  49#define PL330_FAULT_CH_RDWR_ERR             (1 <<  7)
  50#define PL330_FAULT_ST_DATA_UNAVAILABLE     (1 << 12)
  51#define PL330_FAULT_FIFOEMPTY_ERR           (1 << 13)
  52#define PL330_FAULT_INSTR_FETCH_ERR         (1 << 16)
  53#define PL330_FAULT_DATA_WRITE_ERR          (1 << 17)
  54#define PL330_FAULT_DATA_READ_ERR           (1 << 18)
  55#define PL330_FAULT_DBG_INSTR               (1 << 30)
  56#define PL330_FAULT_LOCKUP_ERR              (1 << 31)
  57
  58#define PL330_UNTAGGED              0xff
  59
  60#define PL330_SINGLE                0x0
  61#define PL330_BURST                 0x1
  62
  63#define PL330_WATCHDOG_LIMIT        1024
  64
  65/* IOMEM mapped registers */
  66#define PL330_REG_DSR               0x000
  67#define PL330_REG_DPC               0x004
  68#define PL330_REG_INTEN             0x020
  69#define PL330_REG_INT_EVENT_RIS     0x024
  70#define PL330_REG_INTMIS            0x028
  71#define PL330_REG_INTCLR            0x02C
  72#define PL330_REG_FSRD              0x030
  73#define PL330_REG_FSRC              0x034
  74#define PL330_REG_FTRD              0x038
  75#define PL330_REG_FTR_BASE          0x040
  76#define PL330_REG_CSR_BASE          0x100
  77#define PL330_REG_CPC_BASE          0x104
  78#define PL330_REG_CHANCTRL          0x400
  79#define PL330_REG_DBGSTATUS         0xD00
  80#define PL330_REG_DBGCMD            0xD04
  81#define PL330_REG_DBGINST0          0xD08
  82#define PL330_REG_DBGINST1          0xD0C
  83#define PL330_REG_CR0_BASE          0xE00
  84#define PL330_REG_PERIPH_ID         0xFE0
  85
  86#define PL330_IOMEM_SIZE    0x1000
  87
  88#define CFG_BOOT_ADDR 2
  89#define CFG_INS 3
  90#define CFG_PNS 4
  91#define CFG_CRD 5
  92
  93static const uint32_t pl330_id[] = {
  94    0x30, 0x13, 0x24, 0x00, 0x0D, 0xF0, 0x05, 0xB1
  95};
  96
  97/* DMA channel states as they are described in PL330 Technical Reference Manual
  98 * Most of them will not be used in emulation.
  99 */
 100typedef enum  {
 101    pl330_chan_stopped = 0,
 102    pl330_chan_executing = 1,
 103    pl330_chan_cache_miss = 2,
 104    pl330_chan_updating_pc = 3,
 105    pl330_chan_waiting_event = 4,
 106    pl330_chan_at_barrier = 5,
 107    pl330_chan_queue_busy = 6,
 108    pl330_chan_waiting_periph = 7,
 109    pl330_chan_killing = 8,
 110    pl330_chan_completing = 9,
 111    pl330_chan_fault_completing = 14,
 112    pl330_chan_fault = 15,
 113} PL330ChanState;
 114
 115typedef struct PL330State PL330State;
 116
 117typedef struct PL330Chan {
 118    uint32_t src;
 119    uint32_t dst;
 120    uint32_t pc;
 121    uint32_t control;
 122    uint32_t status;
 123    uint32_t lc[2];
 124    uint32_t fault_type;
 125    uint32_t watchdog_timer;
 126
 127    bool ns;
 128    uint8_t request_flag;
 129    uint8_t wakeup;
 130    uint8_t wfp_sbp;
 131
 132    uint8_t state;
 133    uint8_t stall;
 134
 135    bool is_manager;
 136    PL330State *parent;
 137    uint8_t tag;
 138} PL330Chan;
 139
 140static const VMStateDescription vmstate_pl330_chan = {
 141    .name = "pl330_chan",
 142    .version_id = 1,
 143    .minimum_version_id = 1,
 144    .fields = (VMStateField[]) {
 145        VMSTATE_UINT32(src, PL330Chan),
 146        VMSTATE_UINT32(dst, PL330Chan),
 147        VMSTATE_UINT32(pc, PL330Chan),
 148        VMSTATE_UINT32(control, PL330Chan),
 149        VMSTATE_UINT32(status, PL330Chan),
 150        VMSTATE_UINT32_ARRAY(lc, PL330Chan, 2),
 151        VMSTATE_UINT32(fault_type, PL330Chan),
 152        VMSTATE_UINT32(watchdog_timer, PL330Chan),
 153        VMSTATE_BOOL(ns, PL330Chan),
 154        VMSTATE_UINT8(request_flag, PL330Chan),
 155        VMSTATE_UINT8(wakeup, PL330Chan),
 156        VMSTATE_UINT8(wfp_sbp, PL330Chan),
 157        VMSTATE_UINT8(state, PL330Chan),
 158        VMSTATE_UINT8(stall, PL330Chan),
 159        VMSTATE_END_OF_LIST()
 160    }
 161};
 162
 163typedef struct PL330Fifo {
 164    uint8_t *buf;
 165    uint8_t *tag;
 166    uint32_t head;
 167    uint32_t num;
 168    uint32_t buf_size;
 169} PL330Fifo;
 170
 171static const VMStateDescription vmstate_pl330_fifo = {
 172    .name = "pl330_chan",
 173    .version_id = 1,
 174    .minimum_version_id = 1,
 175    .fields = (VMStateField[]) {
 176        VMSTATE_VBUFFER_UINT32(buf, PL330Fifo, 1, NULL, 0, buf_size),
 177        VMSTATE_VBUFFER_UINT32(tag, PL330Fifo, 1, NULL, 0, buf_size),
 178        VMSTATE_UINT32(head, PL330Fifo),
 179        VMSTATE_UINT32(num, PL330Fifo),
 180        VMSTATE_UINT32(buf_size, PL330Fifo),
 181        VMSTATE_END_OF_LIST()
 182    }
 183};
 184
 185typedef struct PL330QueueEntry {
 186    uint32_t addr;
 187    uint32_t len;
 188    uint8_t n;
 189    bool inc;
 190    bool z;
 191    uint8_t tag;
 192    uint8_t seqn;
 193} PL330QueueEntry;
 194
 195static const VMStateDescription vmstate_pl330_queue_entry = {
 196    .name = "pl330_queue_entry",
 197    .version_id = 1,
 198    .minimum_version_id = 1,
 199    .fields = (VMStateField[]) {
 200        VMSTATE_UINT32(addr, PL330QueueEntry),
 201        VMSTATE_UINT32(len, PL330QueueEntry),
 202        VMSTATE_UINT8(n, PL330QueueEntry),
 203        VMSTATE_BOOL(inc, PL330QueueEntry),
 204        VMSTATE_BOOL(z, PL330QueueEntry),
 205        VMSTATE_UINT8(tag, PL330QueueEntry),
 206        VMSTATE_UINT8(seqn, PL330QueueEntry),
 207        VMSTATE_END_OF_LIST()
 208    }
 209};
 210
 211typedef struct PL330Queue {
 212    PL330State *parent;
 213    PL330QueueEntry *queue;
 214    uint32_t queue_size;
 215} PL330Queue;
 216
 217static const VMStateDescription vmstate_pl330_queue = {
 218    .name = "pl330_queue",
 219    .version_id = 1,
 220    .minimum_version_id = 1,
 221    .fields = (VMStateField[]) {
 222        VMSTATE_STRUCT_VARRAY_UINT32(queue, PL330Queue, queue_size, 1,
 223                                 vmstate_pl330_queue_entry, PL330QueueEntry),
 224        VMSTATE_END_OF_LIST()
 225    }
 226};
 227
 228struct PL330State {
 229    SysBusDevice parent_obj;
 230
 231    MemoryRegion iomem;
 232    qemu_irq irq_abort;
 233    qemu_irq *irq;
 234
 235    /* Config registers. cfg[5] = CfgDn. */
 236    uint32_t cfg[6];
 237#define EVENT_SEC_STATE 3
 238#define PERIPH_SEC_STATE 4
 239    /* cfg 0 bits and pieces */
 240    uint32_t num_chnls;
 241    uint8_t num_periph_req;
 242    uint8_t num_events;
 243    uint8_t mgr_ns_at_rst;
 244    /* cfg 1 bits and pieces */
 245    uint8_t i_cache_len;
 246    uint8_t num_i_cache_lines;
 247    /* CRD bits and pieces */
 248    uint8_t data_width;
 249    uint8_t wr_cap;
 250    uint8_t wr_q_dep;
 251    uint8_t rd_cap;
 252    uint8_t rd_q_dep;
 253    uint16_t data_buffer_dep;
 254
 255    PL330Chan manager;
 256    PL330Chan *chan;
 257    PL330Fifo fifo;
 258    PL330Queue read_queue;
 259    PL330Queue write_queue;
 260    uint8_t *lo_seqn;
 261    uint8_t *hi_seqn;
 262    QEMUTimer *timer; /* is used for restore dma. */
 263
 264    uint32_t inten;
 265    uint32_t int_status;
 266    uint32_t ev_status;
 267    uint32_t dbg[2];
 268    uint8_t debug_status;
 269    uint8_t num_faulting;
 270    uint8_t periph_busy[PL330_PERIPH_NUM];
 271
 272};
 273
 274#define TYPE_PL330 "pl330"
 275#define PL330(obj) OBJECT_CHECK(PL330State, (obj), TYPE_PL330)
 276
 277static const VMStateDescription vmstate_pl330 = {
 278    .name = "pl330",
 279    .version_id = 1,
 280    .minimum_version_id = 1,
 281    .fields = (VMStateField[]) {
 282        VMSTATE_STRUCT(manager, PL330State, 0, vmstate_pl330_chan, PL330Chan),
 283        VMSTATE_STRUCT_VARRAY_UINT32(chan, PL330State, num_chnls, 0,
 284                                     vmstate_pl330_chan, PL330Chan),
 285        VMSTATE_VBUFFER_UINT32(lo_seqn, PL330State, 1, NULL, 0, num_chnls),
 286        VMSTATE_VBUFFER_UINT32(hi_seqn, PL330State, 1, NULL, 0, num_chnls),
 287        VMSTATE_STRUCT(fifo, PL330State, 0, vmstate_pl330_fifo, PL330Fifo),
 288        VMSTATE_STRUCT(read_queue, PL330State, 0, vmstate_pl330_queue,
 289                       PL330Queue),
 290        VMSTATE_STRUCT(write_queue, PL330State, 0, vmstate_pl330_queue,
 291                       PL330Queue),
 292        VMSTATE_TIMER_PTR(timer, PL330State),
 293        VMSTATE_UINT32(inten, PL330State),
 294        VMSTATE_UINT32(int_status, PL330State),
 295        VMSTATE_UINT32(ev_status, PL330State),
 296        VMSTATE_UINT32_ARRAY(dbg, PL330State, 2),
 297        VMSTATE_UINT8(debug_status, PL330State),
 298        VMSTATE_UINT8(num_faulting, PL330State),
 299        VMSTATE_UINT8_ARRAY(periph_busy, PL330State, PL330_PERIPH_NUM),
 300        VMSTATE_END_OF_LIST()
 301    }
 302};
 303
 304typedef struct PL330InsnDesc {
 305    /* OPCODE of the instruction */
 306    uint8_t opcode;
 307    /* Mask so we can select several sibling instructions, such as
 308       DMALD, DMALDS and DMALDB */
 309    uint8_t opmask;
 310    /* Size of instruction in bytes */
 311    uint8_t size;
 312    /* Interpreter */
 313    void (*exec)(PL330Chan *, uint8_t opcode, uint8_t *args, int len);
 314} PL330InsnDesc;
 315
 316
 317/* MFIFO Implementation
 318 *
 319 * MFIFO is implemented as a cyclic buffer of BUF_SIZE size. Tagged bytes are
 320 * stored in this buffer. Data is stored in BUF field, tags - in the
 321 * corresponding array elements of TAG field.
 322 */
 323
 324/* Initialize queue. */
 325
 326static void pl330_fifo_init(PL330Fifo *s, uint32_t size)
 327{
 328    s->buf = g_malloc0(size);
 329    s->tag = g_malloc0(size);
 330    s->buf_size = size;
 331}
 332
 333/* Cyclic increment */
 334
 335static inline int pl330_fifo_inc(PL330Fifo *s, int x)
 336{
 337    return (x + 1) % s->buf_size;
 338}
 339
 340/* Number of empty bytes in MFIFO */
 341
 342static inline int pl330_fifo_num_free(PL330Fifo *s)
 343{
 344    return s->buf_size - s->num;
 345}
 346
 347/* Push LEN bytes of data stored in BUF to MFIFO and tag it with TAG.
 348 * Zero returned on success, PL330_FIFO_STALL if there is no enough free
 349 * space in MFIFO to store requested amount of data. If push was unsuccessful
 350 * no data is stored to MFIFO.
 351 */
 352
 353static int pl330_fifo_push(PL330Fifo *s, uint8_t *buf, int len, uint8_t tag)
 354{
 355    int i;
 356
 357    if (s->buf_size - s->num < len) {
 358        return PL330_FIFO_STALL;
 359    }
 360    for (i = 0; i < len; i++) {
 361        int push_idx = (s->head + s->num + i) % s->buf_size;
 362        s->buf[push_idx] = buf[i];
 363        s->tag[push_idx] = tag;
 364    }
 365    s->num += len;
 366    return PL330_FIFO_OK;
 367}
 368
 369/* Get LEN bytes of data from MFIFO and store it to BUF. Tag value of each
 370 * byte is verified. Zero returned on success, PL330_FIFO_ERR on tag mismatch
 371 * and PL330_FIFO_STALL if there is no enough data in MFIFO. If get was
 372 * unsuccessful no data is removed from MFIFO.
 373 */
 374
 375static int pl330_fifo_get(PL330Fifo *s, uint8_t *buf, int len, uint8_t tag)
 376{
 377    int i;
 378
 379    if (s->num < len) {
 380        return PL330_FIFO_STALL;
 381    }
 382    for (i = 0; i < len; i++) {
 383        if (s->tag[s->head] == tag) {
 384            int get_idx = (s->head + i) % s->buf_size;
 385            buf[i] = s->buf[get_idx];
 386        } else { /* Tag mismatch - Rollback transaction */
 387            return PL330_FIFO_ERR;
 388        }
 389    }
 390    s->head = (s->head + len) % s->buf_size;
 391    s->num -= len;
 392    return PL330_FIFO_OK;
 393}
 394
 395/* Reset MFIFO. This completely erases all data in it. */
 396
 397static inline void pl330_fifo_reset(PL330Fifo *s)
 398{
 399    s->head = 0;
 400    s->num = 0;
 401}
 402
 403/* Return tag of the first byte stored in MFIFO. If MFIFO is empty
 404 * PL330_UNTAGGED is returned.
 405 */
 406
 407static inline uint8_t pl330_fifo_tag(PL330Fifo *s)
 408{
 409    return (!s->num) ? PL330_UNTAGGED : s->tag[s->head];
 410}
 411
 412/* Returns non-zero if tag TAG is present in fifo or zero otherwise */
 413
 414static int pl330_fifo_has_tag(PL330Fifo *s, uint8_t tag)
 415{
 416    int i, n;
 417
 418    i = s->head;
 419    for (n = 0; n < s->num; n++) {
 420        if (s->tag[i] == tag) {
 421            return 1;
 422        }
 423        i = pl330_fifo_inc(s, i);
 424    }
 425    return 0;
 426}
 427
 428/* Remove all entry tagged with TAG from MFIFO */
 429
 430static void pl330_fifo_tagged_remove(PL330Fifo *s, uint8_t tag)
 431{
 432    int i, t, n;
 433
 434    t = i = s->head;
 435    for (n = 0; n < s->num; n++) {
 436        if (s->tag[i] != tag) {
 437            s->buf[t] = s->buf[i];
 438            s->tag[t] = s->tag[i];
 439            t = pl330_fifo_inc(s, t);
 440        } else {
 441            s->num = s->num - 1;
 442        }
 443        i = pl330_fifo_inc(s, i);
 444    }
 445}
 446
 447/* Read-Write Queue implementation
 448 *
 449 * A Read-Write Queue stores up to QUEUE_SIZE instructions (loads or stores).
 450 * Each instruction is described by source (for loads) or destination (for
 451 * stores) address ADDR, width of data to be loaded/stored LEN, number of
 452 * stores/loads to be performed N, INC bit, Z bit and TAG to identify channel
 453 * this instruction belongs to. Queue does not store any information about
 454 * nature of the instruction: is it load or store. PL330 has different queues
 455 * for loads and stores so this is already known at the top level where it
 456 * matters.
 457 *
 458 * Queue works as FIFO for instructions with equivalent tags, but can issue
 459 * instructions with different tags in arbitrary order. SEQN field attached to
 460 * each instruction helps to achieve this. For each TAG queue contains
 461 * instructions with consecutive SEQN values ranging from LO_SEQN[TAG] to
 462 * HI_SEQN[TAG]-1 inclusive. SEQN is 8-bit unsigned integer, so SEQN=255 is
 463 * followed by SEQN=0.
 464 *
 465 * Z bit indicates that zeroes should be stored. No MFIFO fetches are performed
 466 * in this case.
 467 */
 468
 469static void pl330_queue_reset(PL330Queue *s)
 470{
 471    int i;
 472
 473    for (i = 0; i < s->queue_size; i++) {
 474        s->queue[i].tag = PL330_UNTAGGED;
 475    }
 476}
 477
 478/* Initialize queue */
 479static void pl330_queue_init(PL330Queue *s, int size, PL330State *parent)
 480{
 481    s->parent = parent;
 482    s->queue = g_new0(PL330QueueEntry, size);
 483    s->queue_size = size;
 484}
 485
 486/* Returns pointer to an empty slot or NULL if queue is full */
 487static PL330QueueEntry *pl330_queue_find_empty(PL330Queue *s)
 488{
 489    int i;
 490
 491    for (i = 0; i < s->queue_size; i++) {
 492        if (s->queue[i].tag == PL330_UNTAGGED) {
 493            return &s->queue[i];
 494        }
 495    }
 496    return NULL;
 497}
 498
 499/* Put instruction in queue.
 500 * Return value:
 501 * - zero - OK
 502 * - non-zero - queue is full
 503 */
 504
 505static int pl330_queue_put_insn(PL330Queue *s, uint32_t addr,
 506                                int len, int n, bool inc, bool z, uint8_t tag)
 507{
 508    PL330QueueEntry *entry = pl330_queue_find_empty(s);
 509
 510    if (!entry) {
 511        return 1;
 512    }
 513    entry->tag = tag;
 514    entry->addr = addr;
 515    entry->len = len;
 516    entry->n = n;
 517    entry->z = z;
 518    entry->inc = inc;
 519    entry->seqn = s->parent->hi_seqn[tag];
 520    s->parent->hi_seqn[tag]++;
 521    return 0;
 522}
 523
 524/* Returns a pointer to queue slot containing instruction which satisfies
 525 *  following conditions:
 526 *   - it has valid tag value (not PL330_UNTAGGED)
 527 *   - if enforce_seq is set it has to be issuable without violating queue
 528 *     logic (see above)
 529 *   - if TAG argument is not PL330_UNTAGGED this instruction has tag value
 530 *     equivalent to the argument TAG value.
 531 *  If such instruction cannot be found NULL is returned.
 532 */
 533
 534static PL330QueueEntry *pl330_queue_find_insn(PL330Queue *s, uint8_t tag,
 535                                              bool enforce_seq)
 536{
 537    int i;
 538
 539    for (i = 0; i < s->queue_size; i++) {
 540        if (s->queue[i].tag != PL330_UNTAGGED) {
 541            if ((!enforce_seq ||
 542                    s->queue[i].seqn == s->parent->lo_seqn[s->queue[i].tag]) &&
 543                    (s->queue[i].tag == tag || tag == PL330_UNTAGGED ||
 544                    s->queue[i].z)) {
 545                return &s->queue[i];
 546            }
 547        }
 548    }
 549    return NULL;
 550}
 551
 552/* Removes instruction from queue. */
 553
 554static inline void pl330_queue_remove_insn(PL330Queue *s, PL330QueueEntry *e)
 555{
 556    s->parent->lo_seqn[e->tag]++;
 557    e->tag = PL330_UNTAGGED;
 558}
 559
 560/* Removes all instructions tagged with TAG from queue. */
 561
 562static inline void pl330_queue_remove_tagged(PL330Queue *s, uint8_t tag)
 563{
 564    int i;
 565
 566    for (i = 0; i < s->queue_size; i++) {
 567        if (s->queue[i].tag == tag) {
 568            s->queue[i].tag = PL330_UNTAGGED;
 569        }
 570    }
 571}
 572
 573/* DMA instruction execution engine */
 574
 575/* Moves DMA channel to the FAULT state and updates it's status. */
 576
 577static inline void pl330_fault(PL330Chan *ch, uint32_t flags)
 578{
 579    DB_PRINT("ch: %p, flags: %" PRIx32 "\n", ch, flags);
 580    ch->fault_type |= flags;
 581    if (ch->state == pl330_chan_fault) {
 582        return;
 583    }
 584    ch->state = pl330_chan_fault;
 585    ch->parent->num_faulting++;
 586    if (ch->parent->num_faulting == 1) {
 587        DB_PRINT("abort interrupt raised\n");
 588        qemu_irq_raise(ch->parent->irq_abort);
 589    }
 590}
 591
 592/*
 593 * For information about instructions see PL330 Technical Reference Manual.
 594 *
 595 * Arguments:
 596 *   CH - channel executing the instruction
 597 *   OPCODE - opcode
 598 *   ARGS - array of 8-bit arguments
 599 *   LEN - number of elements in ARGS array
 600 */
 601
 602static void pl330_dmaadxh(PL330Chan *ch, uint8_t *args, bool ra, bool neg)
 603{
 604    uint32_t im = (args[1] << 8) | args[0];
 605    if (neg) {
 606        im |= 0xffffu << 16;
 607    }
 608
 609    if (ch->is_manager) {
 610        pl330_fault(ch, PL330_FAULT_UNDEF_INSTR);
 611        return;
 612    }
 613    if (ra) {
 614        ch->dst += im;
 615    } else {
 616        ch->src += im;
 617    }
 618}
 619
 620static void pl330_dmaaddh(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
 621{
 622    pl330_dmaadxh(ch, args, extract32(opcode, 1, 1), false);
 623}
 624
 625static void pl330_dmaadnh(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
 626{
 627    pl330_dmaadxh(ch, args, extract32(opcode, 1, 1), true);
 628}
 629
 630static void pl330_dmaend(PL330Chan *ch, uint8_t opcode,
 631                         uint8_t *args, int len)
 632{
 633    PL330State *s = ch->parent;
 634
 635    if (ch->state == pl330_chan_executing && !ch->is_manager) {
 636        /* Wait for all transfers to complete */
 637        if (pl330_fifo_has_tag(&s->fifo, ch->tag) ||
 638            pl330_queue_find_insn(&s->read_queue, ch->tag, false) != NULL ||
 639            pl330_queue_find_insn(&s->write_queue, ch->tag, false) != NULL) {
 640
 641            ch->stall = 1;
 642            return;
 643        }
 644    }
 645    DB_PRINT("DMA ending!\n");
 646    pl330_fifo_tagged_remove(&s->fifo, ch->tag);
 647    pl330_queue_remove_tagged(&s->read_queue, ch->tag);
 648    pl330_queue_remove_tagged(&s->write_queue, ch->tag);
 649    ch->state = pl330_chan_stopped;
 650}
 651
 652static void pl330_dmaflushp(PL330Chan *ch, uint8_t opcode,
 653                                            uint8_t *args, int len)
 654{
 655    uint8_t periph_id;
 656
 657    if (args[0] & 7) {
 658        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
 659        return;
 660    }
 661    periph_id = (args[0] >> 3) & 0x1f;
 662    if (periph_id >= ch->parent->num_periph_req) {
 663        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
 664        return;
 665    }
 666    if (ch->ns && !(ch->parent->cfg[CFG_PNS] & (1 << periph_id))) {
 667        pl330_fault(ch, PL330_FAULT_CH_PERIPH_ERR);
 668        return;
 669    }
 670    /* Do nothing */
 671}
 672
 673static void pl330_dmago(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
 674{
 675    uint8_t chan_id;
 676    uint8_t ns;
 677    uint32_t pc;
 678    PL330Chan *s;
 679
 680    DB_PRINT("\n");
 681
 682    if (!ch->is_manager) {
 683        pl330_fault(ch, PL330_FAULT_UNDEF_INSTR);
 684        return;
 685    }
 686    ns = !!(opcode & 2);
 687    chan_id = args[0] & 7;
 688    if ((args[0] >> 3)) {
 689        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
 690        return;
 691    }
 692    if (chan_id >= ch->parent->num_chnls) {
 693        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
 694        return;
 695    }
 696    pc = (((uint32_t)args[4]) << 24) | (((uint32_t)args[3]) << 16) |
 697         (((uint32_t)args[2]) << 8)  | (((uint32_t)args[1]));
 698    if (ch->parent->chan[chan_id].state != pl330_chan_stopped) {
 699        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
 700        return;
 701    }
 702    if (ch->ns && !ns) {
 703        pl330_fault(ch, PL330_FAULT_DMAGO_ERR);
 704        return;
 705    }
 706    s = &ch->parent->chan[chan_id];
 707    s->ns = ns;
 708    s->pc = pc;
 709    s->state = pl330_chan_executing;
 710}
 711
 712static void pl330_dmald(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
 713{
 714    uint8_t bs = opcode & 3;
 715    uint32_t size, num;
 716    bool inc;
 717
 718    if (bs == 2) {
 719        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
 720        return;
 721    }
 722    if ((bs == 1 && ch->request_flag == PL330_BURST) ||
 723        (bs == 3 && ch->request_flag == PL330_SINGLE)) {
 724        /* Perform NOP */
 725        return;
 726    }
 727    if (bs == 1 && ch->request_flag == PL330_SINGLE) {
 728        num = 1;
 729    } else {
 730        num = ((ch->control >> 4) & 0xf) + 1;
 731    }
 732    size = (uint32_t)1 << ((ch->control >> 1) & 0x7);
 733    inc = !!(ch->control & 1);
 734    ch->stall = pl330_queue_put_insn(&ch->parent->read_queue, ch->src,
 735                                    size, num, inc, 0, ch->tag);
 736    if (!ch->stall) {
 737        DB_PRINT("channel:%" PRId8 " address:%08" PRIx32 " size:%" PRIx32
 738                 " num:%" PRId32 " %c\n",
 739                 ch->tag, ch->src, size, num, inc ? 'Y' : 'N');
 740        ch->src += inc ? size * num - (ch->src & (size - 1)) : 0;
 741    }
 742}
 743
 744static void pl330_dmaldp(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
 745{
 746    uint8_t periph_id;
 747
 748    if (args[0] & 7) {
 749        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
 750        return;
 751    }
 752    periph_id = (args[0] >> 3) & 0x1f;
 753    if (periph_id >= ch->parent->num_periph_req) {
 754        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
 755        return;
 756    }
 757    if (ch->ns && !(ch->parent->cfg[CFG_PNS] & (1 << periph_id))) {
 758        pl330_fault(ch, PL330_FAULT_CH_PERIPH_ERR);
 759        return;
 760    }
 761    pl330_dmald(ch, opcode, args, len);
 762}
 763
 764static void pl330_dmalp(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
 765{
 766    uint8_t lc = (opcode & 2) >> 1;
 767
 768    ch->lc[lc] = args[0];
 769}
 770
 771static void pl330_dmakill(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
 772{
 773    if (ch->state == pl330_chan_fault ||
 774        ch->state == pl330_chan_fault_completing) {
 775        /* This is the only way for a channel to leave the faulting state */
 776        ch->fault_type = 0;
 777        ch->parent->num_faulting--;
 778        if (ch->parent->num_faulting == 0) {
 779            DB_PRINT("abort interrupt lowered\n");
 780            qemu_irq_lower(ch->parent->irq_abort);
 781        }
 782    }
 783    ch->state = pl330_chan_killing;
 784    pl330_fifo_tagged_remove(&ch->parent->fifo, ch->tag);
 785    pl330_queue_remove_tagged(&ch->parent->read_queue, ch->tag);
 786    pl330_queue_remove_tagged(&ch->parent->write_queue, ch->tag);
 787    ch->state = pl330_chan_stopped;
 788}
 789
 790static void pl330_dmalpend(PL330Chan *ch, uint8_t opcode,
 791                                    uint8_t *args, int len)
 792{
 793    uint8_t nf = (opcode & 0x10) >> 4;
 794    uint8_t bs = opcode & 3;
 795    uint8_t lc = (opcode & 4) >> 2;
 796
 797    if (bs == 2) {
 798        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
 799        return;
 800    }
 801    if ((bs == 1 && ch->request_flag == PL330_BURST) ||
 802        (bs == 3 && ch->request_flag == PL330_SINGLE)) {
 803        /* Perform NOP */
 804        return;
 805    }
 806    if (!nf || ch->lc[lc]) {
 807        if (nf) {
 808            ch->lc[lc]--;
 809        }
 810        DB_PRINT("loop reiteration\n");
 811        ch->pc -= args[0];
 812        ch->pc -= len + 1;
 813        /* "ch->pc -= args[0] + len + 1" is incorrect when args[0] == 256 */
 814    } else {
 815        DB_PRINT("loop fallthrough\n");
 816    }
 817}
 818
 819
 820static void pl330_dmamov(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
 821{
 822    uint8_t rd = args[0] & 7;
 823    uint32_t im;
 824
 825    if ((args[0] >> 3)) {
 826        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
 827        return;
 828    }
 829    im = (((uint32_t)args[4]) << 24) | (((uint32_t)args[3]) << 16) |
 830         (((uint32_t)args[2]) << 8)  | (((uint32_t)args[1]));
 831    switch (rd) {
 832    case 0:
 833        ch->src = im;
 834        break;
 835    case 1:
 836        ch->control = im;
 837        break;
 838    case 2:
 839        ch->dst = im;
 840        break;
 841    default:
 842        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
 843        return;
 844    }
 845}
 846
 847static void pl330_dmanop(PL330Chan *ch, uint8_t opcode,
 848                         uint8_t *args, int len)
 849{
 850    /* NOP is NOP. */
 851}
 852
 853static void pl330_dmarmb(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
 854{
 855   if (pl330_queue_find_insn(&ch->parent->read_queue, ch->tag, false)) {
 856        ch->state = pl330_chan_at_barrier;
 857        ch->stall = 1;
 858        return;
 859    } else {
 860        ch->state = pl330_chan_executing;
 861    }
 862}
 863
 864static void pl330_dmasev(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
 865{
 866    uint8_t ev_id;
 867
 868    if (args[0] & 7) {
 869        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
 870        return;
 871    }
 872    ev_id = (args[0] >> 3) & 0x1f;
 873    if (ev_id >= ch->parent->num_events) {
 874        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
 875        return;
 876    }
 877    if (ch->ns && !(ch->parent->cfg[CFG_INS] & (1 << ev_id))) {
 878        pl330_fault(ch, PL330_FAULT_EVENT_ERR);
 879        return;
 880    }
 881    if (ch->parent->inten & (1 << ev_id)) {
 882        ch->parent->int_status |= (1 << ev_id);
 883        DB_PRINT("event interrupt raised %" PRId8 "\n", ev_id);
 884        qemu_irq_raise(ch->parent->irq[ev_id]);
 885    }
 886    DB_PRINT("event raised %" PRId8 "\n", ev_id);
 887    ch->parent->ev_status |= (1 << ev_id);
 888}
 889
 890static void pl330_dmast(PL330Chan *ch, uint8_t opcode, uint8_t *args, int len)
 891{
 892    uint8_t bs = opcode & 3;
 893    uint32_t size, num;
 894    bool inc;
 895
 896    if (bs == 2) {
 897        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
 898        return;
 899    }
 900    if ((bs == 1 && ch->request_flag == PL330_BURST) ||
 901        (bs == 3 && ch->request_flag == PL330_SINGLE)) {
 902        /* Perform NOP */
 903        return;
 904    }
 905    num = ((ch->control >> 18) & 0xf) + 1;
 906    size = (uint32_t)1 << ((ch->control >> 15) & 0x7);
 907    inc = !!((ch->control >> 14) & 1);
 908    ch->stall = pl330_queue_put_insn(&ch->parent->write_queue, ch->dst,
 909                                    size, num, inc, 0, ch->tag);
 910    if (!ch->stall) {
 911        DB_PRINT("channel:%" PRId8 " address:%08" PRIx32 " size:%" PRIx32
 912                 " num:%" PRId32 " %c\n",
 913                 ch->tag, ch->dst, size, num, inc ? 'Y' : 'N');
 914        ch->dst += inc ? size * num - (ch->dst & (size - 1)) : 0;
 915    }
 916}
 917
 918static void pl330_dmastp(PL330Chan *ch, uint8_t opcode,
 919                         uint8_t *args, int len)
 920{
 921    uint8_t periph_id;
 922
 923    if (args[0] & 7) {
 924        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
 925        return;
 926    }
 927    periph_id = (args[0] >> 3) & 0x1f;
 928    if (periph_id >= ch->parent->num_periph_req) {
 929        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
 930        return;
 931    }
 932    if (ch->ns && !(ch->parent->cfg[CFG_PNS] & (1 << periph_id))) {
 933        pl330_fault(ch, PL330_FAULT_CH_PERIPH_ERR);
 934        return;
 935    }
 936    pl330_dmast(ch, opcode, args, len);
 937}
 938
 939static void pl330_dmastz(PL330Chan *ch, uint8_t opcode,
 940                         uint8_t *args, int len)
 941{
 942    uint32_t size, num;
 943    bool inc;
 944
 945    num = ((ch->control >> 18) & 0xf) + 1;
 946    size = (uint32_t)1 << ((ch->control >> 15) & 0x7);
 947    inc = !!((ch->control >> 14) & 1);
 948    ch->stall = pl330_queue_put_insn(&ch->parent->write_queue, ch->dst,
 949                                    size, num, inc, 1, ch->tag);
 950    if (inc) {
 951        ch->dst += size * num;
 952    }
 953}
 954
 955static void pl330_dmawfe(PL330Chan *ch, uint8_t opcode,
 956                         uint8_t *args, int len)
 957{
 958    uint8_t ev_id;
 959    int i;
 960
 961    if (args[0] & 5) {
 962        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
 963        return;
 964    }
 965    ev_id = (args[0] >> 3) & 0x1f;
 966    if (ev_id >= ch->parent->num_events) {
 967        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
 968        return;
 969    }
 970    if (ch->ns && !(ch->parent->cfg[CFG_INS] & (1 << ev_id))) {
 971        pl330_fault(ch, PL330_FAULT_EVENT_ERR);
 972        return;
 973    }
 974    ch->wakeup = ev_id;
 975    ch->state = pl330_chan_waiting_event;
 976    if (~ch->parent->inten & ch->parent->ev_status & 1 << ev_id) {
 977        ch->state = pl330_chan_executing;
 978        /* If anyone else is currently waiting on the same event, let them
 979         * clear the ev_status so they pick up event as well
 980         */
 981        for (i = 0; i < ch->parent->num_chnls; ++i) {
 982            PL330Chan *peer = &ch->parent->chan[i];
 983            if (peer->state == pl330_chan_waiting_event &&
 984                    peer->wakeup == ev_id) {
 985                return;
 986            }
 987        }
 988        ch->parent->ev_status &= ~(1 << ev_id);
 989        DB_PRINT("event lowered %" PRIx8 "\n", ev_id);
 990    } else {
 991        ch->stall = 1;
 992    }
 993}
 994
 995static void pl330_dmawfp(PL330Chan *ch, uint8_t opcode,
 996                         uint8_t *args, int len)
 997{
 998    uint8_t bs = opcode & 3;
 999    uint8_t periph_id;
1000
1001    if (args[0] & 7) {
1002        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
1003        return;
1004    }
1005    periph_id = (args[0] >> 3) & 0x1f;
1006    if (periph_id >= ch->parent->num_periph_req) {
1007        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
1008        return;
1009    }
1010    if (ch->ns && !(ch->parent->cfg[CFG_PNS] & (1 << periph_id))) {
1011        pl330_fault(ch, PL330_FAULT_CH_PERIPH_ERR);
1012        return;
1013    }
1014    switch (bs) {
1015    case 0: /* S */
1016        ch->request_flag = PL330_SINGLE;
1017        ch->wfp_sbp = 0;
1018        break;
1019    case 1: /* P */
1020        ch->request_flag = PL330_BURST;
1021        ch->wfp_sbp = 2;
1022        break;
1023    case 2: /* B */
1024        ch->request_flag = PL330_BURST;
1025        ch->wfp_sbp = 1;
1026        break;
1027    default:
1028        pl330_fault(ch, PL330_FAULT_OPERAND_INVALID);
1029        return;
1030    }
1031
1032    if (ch->parent->periph_busy[periph_id]) {
1033        ch->state = pl330_chan_waiting_periph;
1034        ch->stall = 1;
1035    } else if (ch->state == pl330_chan_waiting_periph) {
1036        ch->state = pl330_chan_executing;
1037    }
1038}
1039
1040static void pl330_dmawmb(PL330Chan *ch, uint8_t opcode,
1041                         uint8_t *args, int len)
1042{
1043    if (pl330_queue_find_insn(&ch->parent->write_queue, ch->tag, false)) {
1044        ch->state = pl330_chan_at_barrier;
1045        ch->stall = 1;
1046        return;
1047    } else {
1048        ch->state = pl330_chan_executing;
1049    }
1050}
1051
1052/* NULL terminated array of the instruction descriptions. */
1053static const PL330InsnDesc insn_desc[] = {
1054    { .opcode = 0x54, .opmask = 0xFD, .size = 3, .exec = pl330_dmaaddh, },
1055    { .opcode = 0x5c, .opmask = 0xFD, .size = 3, .exec = pl330_dmaadnh, },
1056    { .opcode = 0x00, .opmask = 0xFF, .size = 1, .exec = pl330_dmaend, },
1057    { .opcode = 0x35, .opmask = 0xFF, .size = 2, .exec = pl330_dmaflushp, },
1058    { .opcode = 0xA0, .opmask = 0xFD, .size = 6, .exec = pl330_dmago, },
1059    { .opcode = 0x04, .opmask = 0xFC, .size = 1, .exec = pl330_dmald, },
1060    { .opcode = 0x25, .opmask = 0xFD, .size = 2, .exec = pl330_dmaldp, },
1061    { .opcode = 0x20, .opmask = 0xFD, .size = 2, .exec = pl330_dmalp, },
1062    /* dmastp  must be before dmalpend in this list, because their maps
1063     * are overlapping
1064     */
1065    { .opcode = 0x29, .opmask = 0xFD, .size = 2, .exec = pl330_dmastp, },
1066    { .opcode = 0x28, .opmask = 0xE8, .size = 2, .exec = pl330_dmalpend, },
1067    { .opcode = 0x01, .opmask = 0xFF, .size = 1, .exec = pl330_dmakill, },
1068    { .opcode = 0xBC, .opmask = 0xFF, .size = 6, .exec = pl330_dmamov, },
1069    { .opcode = 0x18, .opmask = 0xFF, .size = 1, .exec = pl330_dmanop, },
1070    { .opcode = 0x12, .opmask = 0xFF, .size = 1, .exec = pl330_dmarmb, },
1071    { .opcode = 0x34, .opmask = 0xFF, .size = 2, .exec = pl330_dmasev, },
1072    { .opcode = 0x08, .opmask = 0xFC, .size = 1, .exec = pl330_dmast, },
1073    { .opcode = 0x0C, .opmask = 0xFF, .size = 1, .exec = pl330_dmastz, },
1074    { .opcode = 0x36, .opmask = 0xFF, .size = 2, .exec = pl330_dmawfe, },
1075    { .opcode = 0x30, .opmask = 0xFC, .size = 2, .exec = pl330_dmawfp, },
1076    { .opcode = 0x13, .opmask = 0xFF, .size = 1, .exec = pl330_dmawmb, },
1077    { .opcode = 0x00, .opmask = 0x00, .size = 0, .exec = NULL, }
1078};
1079
1080/* Instructions which can be issued via debug registers. */
1081static const PL330InsnDesc debug_insn_desc[] = {
1082    { .opcode = 0xA0, .opmask = 0xFD, .size = 6, .exec = pl330_dmago, },
1083    { .opcode = 0x01, .opmask = 0xFF, .size = 1, .exec = pl330_dmakill, },
1084    { .opcode = 0x34, .opmask = 0xFF, .size = 2, .exec = pl330_dmasev, },
1085    { .opcode = 0x00, .opmask = 0x00, .size = 0, .exec = NULL, }
1086};
1087
1088static inline const PL330InsnDesc *pl330_fetch_insn(PL330Chan *ch)
1089{
1090    uint8_t opcode;
1091    int i;
1092
1093    dma_memory_read(&address_space_memory, ch->pc, &opcode, 1);
1094    for (i = 0; insn_desc[i].size; i++) {
1095        if ((opcode & insn_desc[i].opmask) == insn_desc[i].opcode) {
1096            return &insn_desc[i];
1097        }
1098    }
1099    return NULL;
1100}
1101
1102static inline void pl330_exec_insn(PL330Chan *ch, const PL330InsnDesc *insn)
1103{
1104    uint8_t buf[PL330_INSN_MAXSIZE];
1105
1106    assert(insn->size <= PL330_INSN_MAXSIZE);
1107    dma_memory_read(&address_space_memory, ch->pc, buf, insn->size);
1108    insn->exec(ch, buf[0], &buf[1], insn->size - 1);
1109}
1110
1111static inline void pl330_update_pc(PL330Chan *ch,
1112                                   const PL330InsnDesc *insn)
1113{
1114    ch->pc += insn->size;
1115}
1116
1117/* Try to execute current instruction in channel CH. Number of executed
1118   instructions is returned (0 or 1). */
1119static int pl330_chan_exec(PL330Chan *ch)
1120{
1121    const PL330InsnDesc *insn;
1122
1123    if (ch->state != pl330_chan_executing &&
1124            ch->state != pl330_chan_waiting_periph &&
1125            ch->state != pl330_chan_at_barrier &&
1126            ch->state != pl330_chan_waiting_event) {
1127        return 0;
1128    }
1129    ch->stall = 0;
1130    insn = pl330_fetch_insn(ch);
1131    if (!insn) {
1132        DB_PRINT("pl330 undefined instruction\n");
1133        pl330_fault(ch, PL330_FAULT_UNDEF_INSTR);
1134        return 0;
1135    }
1136    pl330_exec_insn(ch, insn);
1137    if (!ch->stall) {
1138        pl330_update_pc(ch, insn);
1139        ch->watchdog_timer = 0;
1140        return 1;
1141    /* WDT only active in exec state */
1142    } else if (ch->state == pl330_chan_executing) {
1143        ch->watchdog_timer++;
1144        if (ch->watchdog_timer >= PL330_WATCHDOG_LIMIT) {
1145            pl330_fault(ch, PL330_FAULT_LOCKUP_ERR);
1146        }
1147    }
1148    return 0;
1149}
1150
1151/* Try to execute 1 instruction in each channel, one instruction from read
1152   queue and one instruction from write queue. Number of successfully executed
1153   instructions is returned. */
1154static int pl330_exec_cycle(PL330Chan *channel)
1155{
1156    PL330State *s = channel->parent;
1157    PL330QueueEntry *q;
1158    int i;
1159    int num_exec = 0;
1160    int fifo_res = 0;
1161    uint8_t buf[PL330_MAX_BURST_LEN];
1162
1163    /* Execute one instruction in each channel */
1164    num_exec += pl330_chan_exec(channel);
1165
1166    /* Execute one instruction from read queue */
1167    q = pl330_queue_find_insn(&s->read_queue, PL330_UNTAGGED, true);
1168    if (q != NULL && q->len <= pl330_fifo_num_free(&s->fifo)) {
1169        int len = q->len - (q->addr & (q->len - 1));
1170
1171        dma_memory_read(&address_space_memory, q->addr, buf, len);
1172        if (PL330_ERR_DEBUG > 1) {
1173            DB_PRINT("PL330 read from memory @%08" PRIx32 " (size = %08x):\n",
1174                      q->addr, len);
1175            qemu_hexdump((char *)buf, stderr, "", len);
1176        }
1177        fifo_res = pl330_fifo_push(&s->fifo, buf, len, q->tag);
1178        if (fifo_res == PL330_FIFO_OK) {
1179            if (q->inc) {
1180                q->addr += len;
1181            }
1182            q->n--;
1183            if (!q->n) {
1184                pl330_queue_remove_insn(&s->read_queue, q);
1185            }
1186            num_exec++;
1187        }
1188    }
1189
1190    /* Execute one instruction from write queue. */
1191    q = pl330_queue_find_insn(&s->write_queue, pl330_fifo_tag(&s->fifo), true);
1192    if (q != NULL) {
1193        int len = q->len - (q->addr & (q->len - 1));
1194
1195        if (q->z) {
1196            for (i = 0; i < len; i++) {
1197                buf[i] = 0;
1198            }
1199        } else {
1200            fifo_res = pl330_fifo_get(&s->fifo, buf, len, q->tag);
1201        }
1202        if (fifo_res == PL330_FIFO_OK || q->z) {
1203            dma_memory_write(&address_space_memory, q->addr, buf, len);
1204            if (PL330_ERR_DEBUG > 1) {
1205                DB_PRINT("PL330 read from memory @%08" PRIx32
1206                         " (size = %08x):\n", q->addr, len);
1207                qemu_hexdump((char *)buf, stderr, "", len);
1208            }
1209            if (q->inc) {
1210                q->addr += len;
1211            }
1212            num_exec++;
1213        } else if (fifo_res == PL330_FIFO_STALL) {
1214            pl330_fault(&channel->parent->chan[q->tag],
1215                                PL330_FAULT_FIFOEMPTY_ERR);
1216        }
1217        q->n--;
1218        if (!q->n) {
1219            pl330_queue_remove_insn(&s->write_queue, q);
1220        }
1221    }
1222
1223    return num_exec;
1224}
1225
1226static int pl330_exec_channel(PL330Chan *channel)
1227{
1228    int insr_exec = 0;
1229
1230    /* TODO: Is it all right to execute everything or should we do per-cycle
1231       simulation? */
1232    while (pl330_exec_cycle(channel)) {
1233        insr_exec++;
1234    }
1235
1236    /* Detect deadlock */
1237    if (channel->state == pl330_chan_executing) {
1238        pl330_fault(channel, PL330_FAULT_LOCKUP_ERR);
1239    }
1240    /* Situation when one of the queues has deadlocked but all channels
1241     * have finished their programs should be impossible.
1242     */
1243
1244    return insr_exec;
1245}
1246
1247static inline void pl330_exec(PL330State *s)
1248{
1249    DB_PRINT("\n");
1250    int i, insr_exec;
1251    do {
1252        insr_exec = pl330_exec_channel(&s->manager);
1253
1254        for (i = 0; i < s->num_chnls; i++) {
1255            insr_exec += pl330_exec_channel(&s->chan[i]);
1256        }
1257    } while (insr_exec);
1258}
1259
1260static void pl330_exec_cycle_timer(void *opaque)
1261{
1262    PL330State *s = (PL330State *)opaque;
1263    pl330_exec(s);
1264}
1265
1266/* Stop or restore dma operations */
1267
1268static void pl330_dma_stop_irq(void *opaque, int irq, int level)
1269{
1270    PL330State *s = (PL330State *)opaque;
1271
1272    if (s->periph_busy[irq] != level) {
1273        s->periph_busy[irq] = level;
1274        timer_mod(s->timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
1275    }
1276}
1277
1278static void pl330_debug_exec(PL330State *s)
1279{
1280    uint8_t args[5];
1281    uint8_t opcode;
1282    uint8_t chan_id;
1283    int i;
1284    PL330Chan *ch;
1285    const PL330InsnDesc *insn;
1286
1287    s->debug_status = 1;
1288    chan_id = (s->dbg[0] >>  8) & 0x07;
1289    opcode  = (s->dbg[0] >> 16) & 0xff;
1290    args[0] = (s->dbg[0] >> 24) & 0xff;
1291    args[1] = (s->dbg[1] >>  0) & 0xff;
1292    args[2] = (s->dbg[1] >>  8) & 0xff;
1293    args[3] = (s->dbg[1] >> 16) & 0xff;
1294    args[4] = (s->dbg[1] >> 24) & 0xff;
1295    DB_PRINT("chan id: %" PRIx8 "\n", chan_id);
1296    if (s->dbg[0] & 1) {
1297        ch = &s->chan[chan_id];
1298    } else {
1299        ch = &s->manager;
1300    }
1301    insn = NULL;
1302    for (i = 0; debug_insn_desc[i].size; i++) {
1303        if ((opcode & debug_insn_desc[i].opmask) == debug_insn_desc[i].opcode) {
1304            insn = &debug_insn_desc[i];
1305        }
1306    }
1307    if (!insn) {
1308        pl330_fault(ch, PL330_FAULT_UNDEF_INSTR | PL330_FAULT_DBG_INSTR);
1309        return ;
1310    }
1311    ch->stall = 0;
1312    insn->exec(ch, opcode, args, insn->size - 1);
1313    if (ch->fault_type) {
1314        ch->fault_type |= PL330_FAULT_DBG_INSTR;
1315    }
1316    if (ch->stall) {
1317        qemu_log_mask(LOG_UNIMP, "pl330: stall of debug instruction not "
1318                      "implemented\n");
1319    }
1320    s->debug_status = 0;
1321}
1322
1323/* IOMEM mapped registers */
1324
1325static void pl330_iomem_write(void *opaque, hwaddr offset,
1326                              uint64_t value, unsigned size)
1327{
1328    PL330State *s = (PL330State *) opaque;
1329    int i;
1330
1331    DB_PRINT("addr: %08x data: %08x\n", (unsigned)offset, (unsigned)value);
1332
1333    switch (offset) {
1334    case PL330_REG_INTEN:
1335        s->inten = value;
1336        break;
1337    case PL330_REG_INTCLR:
1338        for (i = 0; i < s->num_events; i++) {
1339            if (s->int_status & s->inten & value & (1 << i)) {
1340                DB_PRINT("event interrupt lowered %d\n", i);
1341                qemu_irq_lower(s->irq[i]);
1342            }
1343        }
1344        s->ev_status &= ~(value & s->inten);
1345        s->int_status &= ~(value & s->inten);
1346        break;
1347    case PL330_REG_DBGCMD:
1348        if ((value & 3) == 0) {
1349            pl330_debug_exec(s);
1350            pl330_exec(s);
1351        } else {
1352            qemu_log_mask(LOG_GUEST_ERROR, "pl330: write of illegal value %u "
1353                          "for offset " TARGET_FMT_plx "\n", (unsigned)value,
1354                          offset);
1355        }
1356        break;
1357    case PL330_REG_DBGINST0:
1358        DB_PRINT("s->dbg[0] = %08x\n", (unsigned)value);
1359        s->dbg[0] = value;
1360        break;
1361    case PL330_REG_DBGINST1:
1362        DB_PRINT("s->dbg[1] = %08x\n", (unsigned)value);
1363        s->dbg[1] = value;
1364        break;
1365    default:
1366        qemu_log_mask(LOG_GUEST_ERROR, "pl330: bad write offset " TARGET_FMT_plx
1367                      "\n", offset);
1368        break;
1369    }
1370}
1371
1372static inline uint32_t pl330_iomem_read_imp(void *opaque,
1373        hwaddr offset)
1374{
1375    PL330State *s = (PL330State *)opaque;
1376    int chan_id;
1377    int i;
1378    uint32_t res;
1379
1380    if (offset >= PL330_REG_PERIPH_ID && offset < PL330_REG_PERIPH_ID + 32) {
1381        return pl330_id[(offset - PL330_REG_PERIPH_ID) >> 2];
1382    }
1383    if (offset >= PL330_REG_CR0_BASE && offset < PL330_REG_CR0_BASE + 24) {
1384        return s->cfg[(offset - PL330_REG_CR0_BASE) >> 2];
1385    }
1386    if (offset >= PL330_REG_CHANCTRL && offset < PL330_REG_DBGSTATUS) {
1387        offset -= PL330_REG_CHANCTRL;
1388        chan_id = offset >> 5;
1389        if (chan_id >= s->num_chnls) {
1390            qemu_log_mask(LOG_GUEST_ERROR, "pl330: bad read offset "
1391                          TARGET_FMT_plx "\n", offset);
1392            return 0;
1393        }
1394        switch (offset & 0x1f) {
1395        case 0x00:
1396            return s->chan[chan_id].src;
1397        case 0x04:
1398            return s->chan[chan_id].dst;
1399        case 0x08:
1400            return s->chan[chan_id].control;
1401        case 0x0C:
1402            return s->chan[chan_id].lc[0];
1403        case 0x10:
1404            return s->chan[chan_id].lc[1];
1405        default:
1406            qemu_log_mask(LOG_GUEST_ERROR, "pl330: bad read offset "
1407                          TARGET_FMT_plx "\n", offset);
1408            return 0;
1409        }
1410    }
1411    if (offset >= PL330_REG_CSR_BASE && offset < 0x400) {
1412        offset -= PL330_REG_CSR_BASE;
1413        chan_id = offset >> 3;
1414        if (chan_id >= s->num_chnls) {
1415            qemu_log_mask(LOG_GUEST_ERROR, "pl330: bad read offset "
1416                          TARGET_FMT_plx "\n", offset);
1417            return 0;
1418        }
1419        switch ((offset >> 2) & 1) {
1420        case 0x0:
1421            res = (s->chan[chan_id].ns << 21) |
1422                    (s->chan[chan_id].wakeup << 4) |
1423                    (s->chan[chan_id].state) |
1424                    (s->chan[chan_id].wfp_sbp << 14);
1425            return res;
1426        case 0x1:
1427            return s->chan[chan_id].pc;
1428        default:
1429            qemu_log_mask(LOG_GUEST_ERROR, "pl330: read error\n");
1430            return 0;
1431        }
1432    }
1433    if (offset >= PL330_REG_FTR_BASE && offset < 0x100) {
1434        offset -= PL330_REG_FTR_BASE;
1435        chan_id = offset >> 2;
1436        if (chan_id >= s->num_chnls) {
1437            qemu_log_mask(LOG_GUEST_ERROR, "pl330: bad read offset "
1438                          TARGET_FMT_plx "\n", offset);
1439            return 0;
1440        }
1441        return s->chan[chan_id].fault_type;
1442    }
1443    switch (offset) {
1444    case PL330_REG_DSR:
1445        return (s->manager.ns << 9) | (s->manager.wakeup << 4) |
1446            (s->manager.state & 0xf);
1447    case PL330_REG_DPC:
1448        return s->manager.pc;
1449    case PL330_REG_INTEN:
1450        return s->inten;
1451    case PL330_REG_INT_EVENT_RIS:
1452        return s->ev_status;
1453    case PL330_REG_INTMIS:
1454        return s->int_status;
1455    case PL330_REG_INTCLR:
1456        /* Documentation says that we can't read this register
1457         * but linux kernel does it
1458         */
1459        return 0;
1460    case PL330_REG_FSRD:
1461        return s->manager.state ? 1 : 0;
1462    case PL330_REG_FSRC:
1463        res = 0;
1464        for (i = 0; i < s->num_chnls; i++) {
1465            if (s->chan[i].state == pl330_chan_fault ||
1466                s->chan[i].state == pl330_chan_fault_completing) {
1467                res |= 1 << i;
1468            }
1469        }
1470        return res;
1471    case PL330_REG_FTRD:
1472        return s->manager.fault_type;
1473    case PL330_REG_DBGSTATUS:
1474        return s->debug_status;
1475    default:
1476        qemu_log_mask(LOG_GUEST_ERROR, "pl330: bad read offset "
1477                      TARGET_FMT_plx "\n", offset);
1478    }
1479    return 0;
1480}
1481
1482static uint64_t pl330_iomem_read(void *opaque, hwaddr offset,
1483        unsigned size)
1484{
1485    uint32_t ret = pl330_iomem_read_imp(opaque, offset);
1486    DB_PRINT("addr: %08" HWADDR_PRIx " data: %08" PRIx32 "\n", offset, ret);
1487    return ret;
1488}
1489
1490static const MemoryRegionOps pl330_ops = {
1491    .read = pl330_iomem_read,
1492    .write = pl330_iomem_write,
1493    .endianness = DEVICE_NATIVE_ENDIAN,
1494    .impl = {
1495        .min_access_size = 4,
1496        .max_access_size = 4,
1497    }
1498};
1499
1500/* Controller logic and initialization */
1501
1502static void pl330_chan_reset(PL330Chan *ch)
1503{
1504    ch->src = 0;
1505    ch->dst = 0;
1506    ch->pc = 0;
1507    ch->state = pl330_chan_stopped;
1508    ch->watchdog_timer = 0;
1509    ch->stall = 0;
1510    ch->control = 0;
1511    ch->status = 0;
1512    ch->fault_type = 0;
1513}
1514
1515static void pl330_reset(DeviceState *d)
1516{
1517    int i;
1518    PL330State *s = PL330(d);
1519
1520    s->inten = 0;
1521    s->int_status = 0;
1522    s->ev_status = 0;
1523    s->debug_status = 0;
1524    s->num_faulting = 0;
1525    s->manager.ns = s->mgr_ns_at_rst;
1526    pl330_fifo_reset(&s->fifo);
1527    pl330_queue_reset(&s->read_queue);
1528    pl330_queue_reset(&s->write_queue);
1529
1530    for (i = 0; i < s->num_chnls; i++) {
1531        pl330_chan_reset(&s->chan[i]);
1532    }
1533    for (i = 0; i < s->num_periph_req; i++) {
1534        s->periph_busy[i] = 0;
1535    }
1536
1537    timer_del(s->timer);
1538}
1539
1540static void pl330_realize(DeviceState *dev, Error **errp)
1541{
1542    int i;
1543    PL330State *s = PL330(dev);
1544
1545    sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq_abort);
1546    memory_region_init_io(&s->iomem, OBJECT(s), &pl330_ops, s,
1547                          "dma", PL330_IOMEM_SIZE);
1548    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
1549
1550    s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, pl330_exec_cycle_timer, s);
1551
1552    s->cfg[0] = (s->mgr_ns_at_rst ? 0x4 : 0) |
1553                (s->num_periph_req > 0 ? 1 : 0) |
1554                ((s->num_chnls - 1) & 0x7) << 4 |
1555                ((s->num_periph_req - 1) & 0x1f) << 12 |
1556                ((s->num_events - 1) & 0x1f) << 17;
1557
1558    switch (s->i_cache_len) {
1559    case (4):
1560        s->cfg[1] |= 2;
1561        break;
1562    case (8):
1563        s->cfg[1] |= 3;
1564        break;
1565    case (16):
1566        s->cfg[1] |= 4;
1567        break;
1568    case (32):
1569        s->cfg[1] |= 5;
1570        break;
1571    default:
1572        error_setg(errp, "Bad value for i-cache_len property: %" PRIx8,
1573                   s->i_cache_len);
1574        return;
1575    }
1576    s->cfg[1] |= ((s->num_i_cache_lines - 1) & 0xf) << 4;
1577
1578    s->chan = g_new0(PL330Chan, s->num_chnls);
1579    s->hi_seqn = g_new0(uint8_t, s->num_chnls);
1580    s->lo_seqn = g_new0(uint8_t, s->num_chnls);
1581    for (i = 0; i < s->num_chnls; i++) {
1582        s->chan[i].parent = s;
1583        s->chan[i].tag = (uint8_t)i;
1584    }
1585    s->manager.parent = s;
1586    s->manager.tag = s->num_chnls;
1587    s->manager.is_manager = true;
1588
1589    s->irq = g_new0(qemu_irq, s->num_events);
1590    for (i = 0; i < s->num_events; i++) {
1591        sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq[i]);
1592    }
1593
1594    qdev_init_gpio_in(dev, pl330_dma_stop_irq, PL330_PERIPH_NUM);
1595
1596    switch (s->data_width) {
1597    case (32):
1598        s->cfg[CFG_CRD] |= 0x2;
1599        break;
1600    case (64):
1601        s->cfg[CFG_CRD] |= 0x3;
1602        break;
1603    case (128):
1604        s->cfg[CFG_CRD] |= 0x4;
1605        break;
1606    default:
1607        error_setg(errp, "Bad value for data_width property: %" PRIx8,
1608                   s->data_width);
1609        return;
1610    }
1611
1612    s->cfg[CFG_CRD] |= ((s->wr_cap - 1) & 0x7) << 4 |
1613                    ((s->wr_q_dep - 1) & 0xf) << 8 |
1614                    ((s->rd_cap - 1) & 0x7) << 12 |
1615                    ((s->rd_q_dep - 1) & 0xf) << 16 |
1616                    ((s->data_buffer_dep - 1) & 0x1ff) << 20;
1617
1618    pl330_queue_init(&s->read_queue, s->rd_q_dep, s);
1619    pl330_queue_init(&s->write_queue, s->wr_q_dep, s);
1620    pl330_fifo_init(&s->fifo, s->data_width / 4 * s->data_buffer_dep);
1621}
1622
1623static Property pl330_properties[] = {
1624    /* CR0 */
1625    DEFINE_PROP_UINT32("num_chnls", PL330State, num_chnls, 8),
1626    DEFINE_PROP_UINT8("num_periph_req", PL330State, num_periph_req, 4),
1627    DEFINE_PROP_UINT8("num_events", PL330State, num_events, 16),
1628    DEFINE_PROP_UINT8("mgr_ns_at_rst", PL330State, mgr_ns_at_rst, 0),
1629    /* CR1 */
1630    DEFINE_PROP_UINT8("i-cache_len", PL330State, i_cache_len, 4),
1631    DEFINE_PROP_UINT8("num_i-cache_lines", PL330State, num_i_cache_lines, 8),
1632    /* CR2-4 */
1633    DEFINE_PROP_UINT32("boot_addr", PL330State, cfg[CFG_BOOT_ADDR], 0),
1634    DEFINE_PROP_UINT32("INS", PL330State, cfg[CFG_INS], 0),
1635    DEFINE_PROP_UINT32("PNS", PL330State, cfg[CFG_PNS], 0),
1636    /* CRD */
1637    DEFINE_PROP_UINT8("data_width", PL330State, data_width, 64),
1638    DEFINE_PROP_UINT8("wr_cap", PL330State, wr_cap, 8),
1639    DEFINE_PROP_UINT8("wr_q_dep", PL330State, wr_q_dep, 16),
1640    DEFINE_PROP_UINT8("rd_cap", PL330State, rd_cap, 8),
1641    DEFINE_PROP_UINT8("rd_q_dep", PL330State, rd_q_dep, 16),
1642    DEFINE_PROP_UINT16("data_buffer_dep", PL330State, data_buffer_dep, 256),
1643
1644    DEFINE_PROP_END_OF_LIST(),
1645};
1646
1647static void pl330_class_init(ObjectClass *klass, void *data)
1648{
1649    DeviceClass *dc = DEVICE_CLASS(klass);
1650
1651    dc->realize = pl330_realize;
1652    dc->reset = pl330_reset;
1653    dc->props = pl330_properties;
1654    dc->vmsd = &vmstate_pl330;
1655}
1656
1657static const TypeInfo pl330_type_info = {
1658    .name           = TYPE_PL330,
1659    .parent         = TYPE_SYS_BUS_DEVICE,
1660    .instance_size  = sizeof(PL330State),
1661    .class_init      = pl330_class_init,
1662};
1663
1664static void pl330_register_types(void)
1665{
1666    type_register_static(&pl330_type_info);
1667}
1668
1669type_init(pl330_register_types)
1670